Forum Discussion
certitcate error
we have issue when enable new certitcate this error it observed
ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
[M.Najm@BIGIP01:Active:In Sync
2 Replies
Hi Najm ,
Your issue is almost certainly missing intermediate certificate chain on F5 SSL profile
This error is very common when enabling a new certificate on F5 — and your curl output already tells the exact problem:
SSL certificate problem: unable to get local issuer certificate
The client (curl) does NOT trust your server certificate because:
The certificate chain is incomplete, OR
The intermediate CA is missing, OR
The client cannot build a full trust chain to a root CA
Most Likely Cause (in F5 cases)
Intermediate certificate NOT attached in SSL profile
When you install only:
Server cert
Private key
But miss the intermediate chain
Clients fail with this exact error
Let me know for any further help in fixing the SSL chain.- Najm
Cirrus
thanks for update but let me know how resolve with steps it or share with article with steps to help me out ?
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com