OpenSSL "verify error: unable to get local issuer certificate" in CI

By Kaveh Alemi·Latchkey

OpenSSL received the server certificate but could not find the CA that issued it (or an incomplete chain omitted an intermediate). It reports verify error 20. On a CI runner this is a trust-store gap: the root or an intermediate CA is missing, either because ca-certificates is stale or because a proxy re-signs with an untrusted CA. It is the OpenSSL-level view of the same problem curl reports as error 60.

What this error means

openssl s_client or openssl verify prints "verify error:num=20:unable to get local issuer certificate" and "Verify return code: 20" at the end of the output.

depth=0 CN = example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
...
Verify return code: 20 (unable to get local issuer certificate)

Common causes

The issuing CA is not in the trust store

The root CA that signed the chain is missing from the runner bundle, so OpenSSL cannot complete the path to a trusted anchor.

The server sends an incomplete chain

The endpoint omits an intermediate certificate. Without -CAfile or the missing intermediate available, OpenSSL cannot bridge to the root.

How to fix it

Point OpenSSL at the correct CA bundle

1. Refresh the system trust store with update-ca-certificates.
2. Verify against the bundle explicitly with -CAfile.
3. For a proxy CA, add its root to the store first.

openssl s_client -connect example.com:443 \
  -CAfile /etc/ssl/certs/ca-certificates.crt

Supply the missing intermediate

If the server ships an incomplete chain, provide the intermediate so OpenSSL can reach the root.

openssl verify -CAfile root.pem -untrusted intermediate.pem server.pem

How to prevent it

• Keep ca-certificates current on runner images.
• Serve full certificate chains, including intermediates, from your endpoints.
• Install any corporate proxy CA into the trust store.

Frequently asked questions

Related guides

References

• GitHub Actions documentation