Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Najm's avatar
Najm
Icon for Cirrus rankCirrus
May 21, 2026

certitcate error

we have issue when enable new certitcate this error it observed

ALPN, offering h2

* ALPN, offering http/1.1

* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH

* successfully set certificate verify locations:

* CAfile: /etc/pki/tls/certs/ca-bundle.crt

CApath: none

* TLSv1.2 (OUT), TLS header, Certificate Status (22):

* TLSv1.2 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (OUT), TLS alert, Server hello (2):

* SSL certificate problem: unable to get local issuer certificate

* Closing connection 0

curl: (60) SSL certificate problem: unable to get local issuer certificate

More details here: https://curl.haxx.se/docs/sslcerts.html

 

curl performs SSL certificate verification by default, using a "bundle"

of Certificate Authority (CA) public keys (CA certs). If the default

bundle file isn't adequate, you can specify an alternate file

using the --cacert option.

If this HTTPS server uses a certificate signed by a CA represented in

the bundle, the certificate verification probably failed due to a

problem with the certificate (it might be expired, or the name might

not match the domain name in the URL).

If you'd like to turn off curl's verification of the certificate, use

the -k (or --insecure) option.

[M.Najm@BIGIP01:Active:In Sync

 

2 Replies

  • Hi Najm​ ,

     

    Your issue is almost certainly missing intermediate certificate chain on F5 SSL profile

     

    This error is very common when enabling a new certificate on F5 — and your curl output already tells the exact problem:

     

    SSL certificate problem: unable to get local issuer certificate

     

     

    The client (curl) does NOT trust your server certificate because:

     

    The certificate chain is incomplete, OR

    The intermediate CA is missing, OR

    The client cannot build a full trust chain to a root CA

    Most Likely Cause (in F5 cases)

     

    Intermediate certificate NOT attached in SSL profile

     

    When you install only:

     

    Server cert

    Private key

    But miss the intermediate chain

     

    Clients fail with this exact error

    Let me know for any further help in fixing the SSL chain.

    • Najm's avatar
      Najm
      Icon for Cirrus rankCirrus

      thanks for update but let me know how resolve with steps  it or share with article with steps to help me out ?