I have a SSL certificate that is valid for *.example.com. I have been able to set up this SSL certificate on IIS correctly for subdomain.example.com.

But I'm having problems on ubuntu 16.04 server and nginx.

I've created key and certificate files using open SSL from a pfx file. then added a sample site to nginx. Here is my nginx config.

server {

 listen 443 ssl;
 server_name subdomain2.example.com subdomain2.example.com;
 ssl_certificate /etc/nginx/cert.crt;
 ssl_certificate_key /etc/nginx/cert.rsa;

 root /subdomain2/test;
 index index.html;
 include /etc/nginx/mime.types;

It works fine on browsers. But when I try to make a request with curl or using python requests library I get following error

unable to get local issuer certificate

If iI disable ssl verification on python requests lib I get correct response but I don't want to disable this verification.

What am I doing wrong?

  • You probably forgot an intermediate certificate. Use an online SSL test website to figure out what you missed. – Michael Hampton Feb 7 '19 at 13:37

You should concatenate in your server certificate file also the intermediate certificates. Check here for Q/A about this issue

As @Martin pointed out, the order of certificates in the file is important. RFC 4346 for TLS 1.1 states:

This is a sequence (chain) of X.509v3 certificates. The sender's certificate must come first in the list. Each following certificate must directly certify the one preceding it.

Thus the order is:

1. Your domain's certificate
2. Vendor's intermediate certificate that certifies (1)
3. Vendor's intermediate certificate that certifies (2)
n. Vendor's root certificate that certifies (n-1). Optional, because it should be contained in client's CA store.

Check also this RFC for precise definitions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.