Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently one of my machines was put behind a proxy meaning some programs I had working no longer do.

When i try to do "openssl s_client -showcerts -connect remoteserver:remoteport" it presents me with a lovely "Verify return code: 20 (unable to get local issuer certificate)", I take it that is because the intermediate (proxy) certificate is not recognized.

If my assumption is correct i believe i have to install the root certificate of the proxy in order to have my programs to work again.

I was given a .cer file which i transformed to a pem file as follows:

openssl x509 -inform der -in certificate.cer -out certificate.pem

I then went on to get the hash of the pem (as suggested here

openssl x509 -issuer_hash -noout -in certificate.pem

this gave me a string (e.g: a8a87a6a).

I then went and copied the pem file, renamed as a8a87a6a to /etc/pki/tls/certs however i still get the same "Verify return code: 20 (unable to get local issuer certificate)" even when running with "-CApath /etc/pki/tls/certs/" .

I also tried renaming the file to have the extensions .pem .crt .cer to no avail.

Quite frustrated on this, how can i get this certificate to be recognized as legit and get my stuff working again?

share|improve this question
up vote 3 down vote accepted

In CentOS 5 trusted certificates are located in /etc/pki/tls/certs/ca-bundle.crt. Simply append your new trusted cert to this file.

This is answer to your question how to add new cert. But propably this will not resolve your problem. It's highly possibly that your proxy cert (CN name) will not match you service CN.

share|improve this answer
That does indeed solve the problem of adding a cert and the verification now shows "Verify return code: 0 (ok)" yet as you mentioned my programs still don't work, i'll investigate further... – Onitlikesonic Oct 12 '12 at 7:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.