certitcate error

Forums Technical Forums
1

we have issue when enable new certitcate this error it observed

ALPN, offering h2

* ALPN, offering http/1.1

* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH

* successfully set certificate verify locations:

* CAfile: /etc/pki/tls/certs/ca-bundle.crt

CApath: none

* TLSv1.2 (OUT), TLS header, Certificate Status (22):

* TLSv1.2 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (OUT), TLS alert, Server hello (2):

* SSL certificate problem: unable to get local issuer certificate

* Closing connection 0

curl: (60) SSL certificate problem: unable to get local issuer certificate

More details here: curl - SSL CA Certificates

curl performs SSL certificate verification by default, using a “bundle”

of Certificate Authority (CA) public keys (CA certs). If the default

bundle file isn’t adequate, you can specify an alternate file

using the --cacert option.

If this HTTPS server uses a certificate signed by a CA represented in

the bundle, the certificate verification probably failed due to a

problem with the certificate (it might be expired, or the name might

not match the domain name in the URL).

If you’d like to turn off curl’s verification of the certificate, use

the -k (or --insecure) option.

[M.Najm@BIGIP01:Active:In Sync

2

Hi @Najm ,

Your issue is almost certainly missing intermediate certificate chain on F5 SSL profile

This error is very common when enabling a new certificate on F5 — and your curl output already tells the exact problem:

SSL certificate problem: unable to get local issuer certificate

The client (curl) does NOT trust your server certificate because:

The certificate chain is incomplete, OR

The intermediate CA is missing, OR

The client cannot build a full trust chain to a root CA

Most Likely Cause (in F5 cases)

Intermediate certificate NOT attached in SSL profile

When you install only:

Server cert

Private key

But miss the intermediate chain

Clients fail with this exact error

Let me know for any further help in fixing the SSL chain.

3

thanks for update but let me know how resolve with steps  it or share with article with steps to help me out ?

4

Hi @Najm , check out Configure the BIG-IP system to use an SSL chain certificate. There is also a video demo/guide available here: Import a custom chain certificate to the BIG-IP system and configure an SSL profile to use it.

5

Hi @Najm

Can you share the output of

openssl s_client -connect <vip>:443 -showcerts

6

hi,

Thanks for your updated .