Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I completed the following steps to generate my SSL cert request:

openssl genrsa -out key 2048
openssl req -new -key key -out csr

Then I submitted my csr to my signing authority, and got my cert back.

I put in in a file named "cert"

Now I want to verify that the cert is correct.

openssl verify cert

I get the original O and OU results back, but additionally I get the following error:

error 20 at 0 depth lookup:unable to get local issuer certificate

Am I correctly verifying the cert, and if so, why am I getting this error? If not, what am I doing wrong?

share|improve this question
up vote 5 down vote accepted

Openssl is trying to check the issuer certificate in order to verify your certificate you need to extend your command as follows:-

openssl verify [-CAfile cafile] file

where file is the cert you previously specified and cafile is the cafile of the root CA.

share|improve this answer

Is the CA cert of the issuer present on your system ? You have to check that the issuer's certificate chain is installed in order to validate in-depth your certificate. On most linuxes, public certificate are stored under /etc/ssl.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.