I am receiving the following error on my HPUX/Apache server:

Certificate Verification: Error (20): unable to get local issuer certificate

When I look at my root certificates, I have the DoD Root CA-2 Root certificate included on the server.

My site certificate has the chain of DoD Root CA-2 -> DoD CA-28 -> Certificate.

when I do the following, I do receive an error:

-bash-4.3$ openssl s_client -connect mysite:443 -showcerts
depth=0 /C=US/O=U.S. Government/OU=DoD/OU=PKI/OU=USN/CN=mysite
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=US/O=U.S. Government/OU=DoD/OU=PKI/OU=USN/CN=mysite
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=US/O=U.S. Government/OU=DoD/OU=PKI/OU=USN/CN=mysite
verify error:num=21:unable to verify the first certificate
verify return:1
20509:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1102:SSL alert number 40
20509:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:182:

Other than the error and confirmation from the openssl command above, my site works most of the time (I do have a lack of memory that is causing me issues).

Do I need the DoD CA-28 certificate in my root store on my server?


For Apache HTTPD you only "require" the RSA key and the X509 signed certificate or self-signed. No CA's are needed.

Although, some clients will complain if they don't see you have the complete chain or at least the chain of CA's except for the root one if they have it.

Let's assume there is a signing authority called with 3 ca's, called EXAMPLE, and has signed your certificate.

ROOT-EXAMPLE <-- browsers may have this if it is a known authority
SUB-EXAMPLE  <--- you haven't included this one
SIGNER-EXAMPLE <--- you haven't included this one
YOURCERT <-- you are offering this one
YOURKEY <-- you are offering this one

So briefly, to be able to encrypt-decrypt Apache HTTPd just needs the first two starting from the bottom, and you should add the all the rest (except the root if its included in browsers which then it is not necessary.

How to do this with Apache HTTPD (include all)? Simple

SSLCertificateKeyFile /path/to/rsa.key
SSLCertificateFile /path/to/chain.crt <-- here you can include the signed and the ca's from root to leaf.
  • So, not to be a pain, I should add the intermediate certificate, DoD CA-28, after the root certificate DoD Root CA-2 in my SSLCertificateFile, right? Also, just to confirm, my site will still function if I don't add the intermediate cert (like I have now), but it is better to have included it? – Bart Oct 20 '16 at 19:01
  • This actually didn't help me. I assume it is because they included the chain in with the CACertificate. – Bart Oct 26 '16 at 16:52
  • you should include the whole chain, except for the known CA's by the browser, which it is usually the absolute Root CA. – ezra-s Oct 26 '16 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.