SSL certificate problem: unable to get local issuer certificate
Most likely cause: The local system or tool lacks the required root certificate authority (CA) that signed the remote server's certificate.
Try first: Find which tool shows the error
Likely causes
- The local system or tool lacks the required root certificate authority (CA) that signed the remote server's certificate.most likely
- A corporate proxy or firewall is intercepting the connection and presenting its own certificate.possible
- The remote server is using a self-signed or misconfigured certificate.less likely
How to fix it
Find which tool shows the errorSafe
Note whether it comes from Git, curl, pip/Python, npm/Node.js or something else; each one has its own CA setting.
Update your CA certificatesChanges settings
Update the trusted certificate bundle. Debian/Ubuntu: run the command below. Fedora/RHEL: sudo dnf update ca-certificates. macOS: install system updates. Windows: run Windows Update. Python: pip install --upgrade certifi.
sudo apt update && sudo apt install --reinstall ca-certificatesPoint Git at a CA bundleChanges settings
Tell Git which CA file to trust, such as your system bundle or a bundle from your company. On Git for Windows, git config --global http.sslBackend schannel makes Git use the Windows certificate store instead.
git config --global http.sslCAInfo /path/to/ca-bundle.crtTrust your corporate proxy or antivirus certificateChanges settings
On a work network, or with antivirus that scans HTTPS, a proxy may re-sign traffic with its own root certificate. Get that root certificate from IT, then add it to your system store or point the tool at it: NODE_EXTRA_CA_CERTS for Node.js, REQUESTS_CA_BUNDLE for Python requests, http.sslCAInfo for Git.
export NODE_EXTRA_CA_CERTS=/path/to/corporate-root.pemLast resort: turn off verification for a single testDangerous
Only to confirm the cause, run one command with verification turned off, then stop. Never set this globally and never use it on a network you do not trust.
git -c http.sslVerify=false ls-remote https://example.com/repo.git⚠ This turns off HTTPS security for that command, so an attacker could read or change the data. Use it once for testing only, never leave it on, and never use it to push code or install packages. No backup is needed, because it changes nothing on disk.
If that didn't fix it
Run openssl s_client -connect host:443 -showcerts to see who issued the server's certificate. If it's a company or antivirus name, the proxy step applies. If the server sends an incomplete chain, the server owner has to fix it.
When to see a technician
If this happens inside a company network with managed devices or proxies, ask your IT team to review the certificate trust settings.
Quick answers
- What does SSL certificate problem: unable to get local issuer certificate mean?
- Git, curl, Python, Node.js and other tools show this when they can't verify a server's HTTPS certificate because they don't trust the certificate authority (CA) that issued it. The fix is to give the tool the right CA certificates, not to turn verification off.
- What causes SSL certificate problem: unable to get local issuer certificate?
- The local system or tool lacks the required root certificate authority (CA) that signed the remote server's certificate. (most likely) A corporate proxy or firewall is intercepting the connection and presenting its own certificate. (possible) The remote server is using a self-signed or misconfigured certificate. (less likely)
- How do I fix SSL certificate problem: unable to get local issuer certificate?
- Try these in order, safest first: 1. Find which tool shows the error. 2. Update your CA certificates. 3. Point Git at a CA bundle. 4. Trust your corporate proxy or antivirus certificate. 5. Last resort: turn off verification for a single test.
- What if that didn't fix it?
- Run openssl s_client -connect host:443 -showcerts to see who issued the server's certificate. If it's a company or antivirus name, the proxy step applies. If the server sends an incomplete chain, the server owner has to fix it.
- When should I see a technician?
- If this happens inside a company network with managed devices or proxies, ask your IT team to review the certificate trust settings.