curl: (60) SSL 证书：无法获得本地颁发者证书

Question

Just installed a Comodo certificate on our server, (centos 5) https works fine, the website works fine with https. But one of our wordpress plugin

.htaccess file contains rules to rewrite url https://example.com/w3tc_rewrite_test into https://example.com/?w3tc_rewrite_test which, if handled by plugin, return "OK" message. The plugin made a request to https://example.com/w3tc_rewrite_test but received:

SSL certificate problem: unable to get local issuer certificate

instead of "OK" response.

executing the command: curl https://example.com results in:

curl: (60) SSL certificate problem: unable to get local issuer certificate

on external server:

curl: (60) Peer certificate cannot be authenticated with known CA certificates

I already downloaded the latest ca certificates, manually pointed to the crt/pem file in php.ini all to no avail...

Also changed the CA server certificate to the CAroot that was supplied by comodo.

openssl s_client -connect example.com:443

CONNECTED(00000003)
28211:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

openssl s_client -tls1 -connect example.com:443

CONNECTED(00000003)
depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=www.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=www.example.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=www.example.com
verify error:num=21:unable to verify the first certificate
verify return:1

Answer 1

Check your sites with SSLLabs for problems, especially missing chain certificates. At least the site swedendedicated.com you mentioned (before you did the last edit) has serious problems:

  Chain issues  Incomplete

Thus it will work with most browsers which either have the missing certificate cached or will download the missing certificate. Non-Browsers will usually neither cache nor download missing certificates and thus will fail.

The fix is to reconfigure your server to include the missing certificates. If you have questions how to do this look at the instructions you got from your certificate provider. If this does not help ask at serverfault.com.

Answer 2

This is a very generic issue. It is saying it is not able to find the intermediate certificate in the certificate store. Try manually stripping out the intermediate certificate and install it.

I faced this while working with Python requests module.

I was also creating a ca.pem file and putting the server certificate there(The server public key). I put the Intermediate CA certificate with the server certificate. Then I got:

unable to find issuer certificate.

I then added the root ca in the pem file and it did the trick.