I'm trying to track down a strange issue with my servers. Within the last day or so, connections to certain SSL protected sites(both HTTP and SMTP) started failing.

Here is the output from openssl:

CONNECTED(00000003) depth=1 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN = StartCom Class 2 Primary Intermediate Server CA verify error:num=20:unable to get local issuer certificate verify return:0

This is only affecting servers which are protected by startcom certificates, and has only started happening in the last few days. I verified that the StartCom certificates are installed in /etc/ssl/certs and they are the ones I need.

What makes this really bizarre is that using wget succeeds and curl fails. This is on Debian Jessie.

  • So what exactly doesn't work - openssl or curl? – ALex_hha Mar 22 '16 at 19:36
  • It appears the openssl is the culprit, but I'm not sure why wget works and only StartCom certificates are affected. – Jesse Weigert Mar 22 '16 at 19:55

Nevermind. I somehow corrupted my CA directory. Deleting /etc/ssl/certs and then running apt-get install --reinstall ca-certificates fixed it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.