Unable to verify the first certificate nginx Verify this by checking the issuer and subject fields of each certificate in the chain. Nov 16, 2024 · Verify return code: 21 (unable to verify the first certificate) Even though the intermediate certificate is missing, browsers can still show no problems with https://client-cert-missing. Jul 27, 2020 · As that answer on SO says, the error unable to verify the first certificate means that the webserver you are connecting to is misconfigured and did not include the intermediate certificate in the certificate chain it sent to you. 4. Certificate chain It most likely looks as follows: Server certificate - stores a certificate signed by intermediate. Upvoting indicates when questions and answers are useful. 1 NGINX openssl , tls , networking 9 91 August 1, 2025 Optimizing Resource Usage for Complex SSL Configurations in NGINX Community Showcase blog 2 Jan 9, 2016 · 如果上面的结果中, 出现的证书是自签发证书或者 verify error:num=21:unable to verify the first certificate , 就说明商业证书未生效. It was in x509 PEM format and contained a chain of the IntermediateCA's certificate by the RootCA's cert. 2. net domain as the Subject Aug 12, 2020 · Hi All, I have googled this like mad, and am still getting the same issue. May 24, 2022 · Hello currently im trying to setup WeKan with Keycloack and Docker in an intranet environment this means I have to use my own CA certificate. The config for the site in question is (all the other configs are basically the same, minus default_server of course): server { listen 443 default_server ssl; listen [::]:443 default_server ipv6only=on ssl; server_name furry. Jul 27, 2025 · The "Unable to verify first certificate" error in Postman arises when Postman cannot trust the server's security certificate. Apr 26, 2021 · SSL Error: Unable to verify the first certificate (Nginx -> Spring Boot) Asked 4 years, 1 month ago Modified 4 years, 1 month ago Viewed 3k times Apr 27, 2023 · I'm looking to create an NGINX reverse proxy to my WiFi router, and I'm looking to verify the connection. Upon Googling, i have double and triple checked that: File > Settings > Request > SSL certificate verification = OFF and have also made sure that this is not overridden in “Settings” for the tests But i still get: Any Feb 11, 2015 · The first certificate #L is correctly the leaf certificate. 1 (stretch) Release: 9. 0 and TLS 1. 1 Codename: stretch My hosting provider, if applicable, is: 15 You need to use the ssl_verify_depth directive set to at least 2 since your certificate chain requires two hops. Installation f Oct 16, 2020 · $ssl_client_verify 变量 "FAILED:unable to verify the first certificate" 成立。 有没有办法让 NGINX 在不知道其颁发者的情况下接受来自 B 的客户端证书？ Error: Mismatched chain Example log entry: num=21:unable to verify the first certificate Cause: The intermediate certificates provided do not match the server certificate. xxx. For each other sub-CA between the root and the client certificates, you need to increase that number by one. My router uses a self-signed certificate which lists the tplinkwifi. Document Server version:… Dec 24, 2024 · I have a reverse proxy server where the root certificate is configured using the proxy_ssl_trusted_certificate directive in Nginx. conf file. g. Notifications You must be signed in to change notification settings Fork 2k May 18, 2023 · Here’s a summary and experience on how to fix the “verify error:num=20:unable to get local issuer certificate” issue when working with… May 6, 2025 · 3 205 May 6, 2025 Client SSL certificate verify error: (3:unable to get certificate CRL) while reading client request headers NGINX ssl , openssl 4 438 July 16, 2025 Cannot disable TLS 1. Aug 18, 2021 · NGINX - Unable to verify the first certificate Asked 4 years, 3 months ago Modified 2 years, 11 months ago Viewed 16k times Nov 29, 2019 · I've tried using the intermediary CA in addition to setting ssl_client_certificate to the chained certificates to no avail. Sep 15, 2017 · When I try to use the "https://ip" to request the service, I get it "Kubernetes Ingress Controller Fake Certificate" ,This caused me to verify the certificate when I requested the network,How can I solve this problem? Feb 19, 2020 · To overcome the fact that it's a self-signed certificate, Valet already imports that certificate to your Mac's keychain so that keychain-supported browsers will automatically trust it, and also tells Nginx about it so it knows how to link up with the site-specific certificates in your sites' nginx configs. unable to verify the first certificate I have a simple getServerSideProps () function that calls an external API but throws this error: FetchError: request to https://nginx/api/items failed, reason: unable to verify the first certificate The Node server does not trust my self-signed certificate. combined instead of ssl. Is there a way to make NGINX accept the client certificate from B without knowing its Issuer? Aug 17, 2020 · I have NGINX setup as a reverse proxy to host multiple websites using only one IP address. pem: certificate sent by the upstream server Sep 23, 2019 · I was setting up a mutual authentication in nginx and generated certificates from "Let's Encrypt". io/secure-verify-ca-secret annotation for an ingress, and having the corresponding backend serve up a completely different (and self-signed) certificate does not lead to any error. Everything works otherwise, but when checked with openssl, we get the following error: verify error:num=21:unable to verify the first certificate The openssl command: openssl s_client -servername some. 6-1ubuntu3. Aug 28, 2019 · Others: What happened: I am unable to get nginx-ingress-controller to reject a backend certificate. Nov 16, 2021 · Has anyone faced this problem with haproxy and ssl certificate. The same localhost endpoint worked within a browser, but not in Postman while running in debug in VS. I'm running nginx using docker with letsencrypt certificates securing the traffic. Aug 17, 2021 · CONNECTED(00000003) depth =0 CN = *. When I merge the certificates into a single one and don’t use the ca. In my docker-compose I set up keycloak/oauth like this. I am seeing intermittent SSL handshake issues from the Ubuntu side, where the error lists that it is unable to get the first certificate. The 2 certificates provided by RapidSSL as the "certificate chain" were removed from the CA file (declared in nginx config as ssl_client_certificate) and appended to the certificate file (declared as ssl_certificate) instead. But the following certificate #A does not sign #L as you can see from the fact that the subject of #A does not match the issuer of #L. I am submitting requests, but tests throw up the warning " Unable to Verify The First Certificate". homebridge / nginx etc… must use the fullchain. Usually that means it can't find the certificate, other errors tend to be more descriptive. Server side SSL is working fine. I had this problem when using the issued certificate from GoDaddy to secure connection using ssl/tls in nginx. 10. From inside the GitLab environment, verify if the unable to verify the first certificate The certificate chain is incomplete. Jul 18, 2019 · I need to setup a web server on it but when I try to install packages from the Ubuntu repository I cannot download any packages because of certificate verification issues. Aug 12, 2021 · I have Nextcloud (21. From the s_client output, the chain received ended with i:/O=Digital Signature Trust Co. I’ve already read some information about the problem, but I haven’t been able to solve the problem yet. I'm using european ssl certificate. 2) installed on the same server without docker. I have a Lets Encrypt certificate on the proxy and a different Lets Encrypt certificate on the upstream se Jan 29, 2015 · I'm trying to set up Nginx (1. . I've been following the documentation to get it working, but Nginx only serves the server certificate, not the intermediat Sep 25, 2017 · You'll need to complete a few actions and gain 15 reputation points before being able to upvote. 3 The operating system my web server runs on is (include version): Distributor ID: Debian Description: Debian GNU/Linux 9. This fixes the error with the openssl command above but not the one with the curl command. 3. I checked and didn't find similar issue 🛡️ Security Policy I agree to have read this project Security Policy 📝 Describe your problem I set Apr 24, 2019 · an nginx bug would be low down on my list of possibilities. 4 -port 443 < /dev/null | grep subject=CN The certificate purchaced from ssls. # fullchain. will report that they're unable to find valid certification path to requested target. pem which contains the full chain) or some devices will be unable to verify the trust May 19, 2025 · 文章浏览阅读567次，点赞3次，收藏9次。nginx证书即将过期，需要更新为新证书。_verify error:num=20:unable to get local issuer certificate Nov 29, 2019 · 除了将 ssl_client_certificate 设置为链接证书外，我还尝试使用中间CA，但没有效果。 我正在使用带有letsencrypt证书的docker运行nginx，以保护通信量。我不确定这是否是造成这些问题的原因，但我认为这不应该是一个问题，因为客户端证书可以而且经常由不同的CA授权机构签名。 这是我的网站设置： The first error (verify error:num=2:unable to get issuer certificate) resulted from the form of the -CAfile used on the client side. Verifying the SSL certificate being served Serving the full certificate chain is recommended in order to prevent SSL errors when clients connect. Specifying one certificate in the nginx. Apr 15, 2025 · My issue: I want to use ssl_crl to verify the client certificate’s revocation status， but it didn’t work fine for me, while the browser shows “The SSL certificate error”, and the nginx’s error. Can be temporary solved by muting certificate verification on NodeJS side with placing such line before api/express calls: process. Mar 13, 2021 · Problem is somehow related to default self-signed certificate on Keycloak side. bot Aug 4, 2025 · I then updated nginx configuration so it uses ssl. As mentioned in my first message, if I make the request using curl (with -v flag) not only the answer is OK, but also, curl says that SSL certificat verify ok and domain name matches certificate without any warning or issue ! In the same way, If I send the (I'm using the fetch API server-side, if that matters) I'm receiving these errors: Error: unable to verify the first certificate Code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' The API I'm reaching out to is HTTPS, and the app presently is being locally developed. badssl. Sep 10, 2017 · I use openssl to create a self signed CA cert on ubuntu gnome 16. Unable to verify the first certificate is an error message that can occur when you try to establish a secure connection. Apr 24, 2019 · @codenirvana With the option "SSL certificate verification" disabled the request is ok and the answer corresponds to the expected result. I'm using only nginx as webserver. Feb 29, 2024 · "unable to verify the first certificate" when deploy the Nextjs with Nginx Asked 1 year, 2 months ago Modified 1 year, 2 months ago Viewed 214 times Feb 9, 2021 · However, I've encountered a problem where nginx can't establish a secure connection to the upstream server and reports an upstream SSL certificate verify error: (2:unable to get issuer certificate) while SSL handshaking to upstream, while verifying the certificate with openssl does work. com i:C = DE, ST = Baden -W\ C3\BCrttemberg, L = Durmersheim, O = EUNETIC GmbH, CN = EuropeanSSL Server CA 2 --- Server certificate Jan 23, 2023 · I searched for it and found threads like this: ([Solved] [CLI] Failed to login on our server: "reason: unable to verify the first certificate") but the steps mentioned didn’t work for me. Discover its causes and fixes here. 3) and Onlyoffice Document Server (6. 1) with a StartSSL certificate. What's reputation and how do I get it? Instead, you can save this post to reference later. env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0; Dec 18, 2018 · Verify return code: 21 (unable to verify the first certificate) I found some possible solutions but they suggest to use the fullchain which I don't have idea what they are talking about. 0. crt Bitwarden isn’t accessible at all. Oct 10, 2025 · 当我打开ssl验证的时候就出现了标题的错误提示（SSL Error: Unable to verify the first certificate）顿时就麻了，也就说通了为什么百世仓调用不通。 因为他们对ssl进行验证了。 原来的服务器的域名是www 的三级域名，新域名就是去掉了前面的www，就是所谓的二级域名。 Feb 9, 2024 · 0 I have an Ubuntu server running nginx that forwards requests to a AWS elastic beanstalk environment running an API (partial migration, work in progress). crt for example, add all the intermediate Dec 17, 2020 · Early data was not sent Verify return code: 21 (unable to verify the first certificate) closed My web server is (include version): nginx/1. 04, and use this CA cert to sign a cert for postfix and httpd, but when using tls to connect postfix, the command was: openssl s_cl Apply your changes with sudo gitlab-ctl reconfigure. This article will explore the possible solutions to this problem so your API requests can start flowing smoothly again! Jun 1, 2023 · Hello! I have the problem that I cannot open any documents with an active SSL connection. But after enabling the client side certificate verification, it Apr 23, 2018 · unable to verify the first certificate proxy nginx Asked 7 years, 7 months ago Modified 6 years, 11 months ago Viewed 3k times Apr 20, 2016 · The problem is that the connection closes with a Verify return code: 21 (unable to verify the first certificate). Jul 17, 2022 · ⚠️ Please verify that this bug has NOT been raised before. com: but tools like curl, java. kubernetes. My solution was to find a similar server and extract the certificates from that server with something like: Jul 28, 2021 · Using wget, openssl s_client or curl on normal web resources, I get the message: "Verify return code: 20 (unable to get local issuer certificate)", or equivalent. com and the CA is added Jun 10, 2024 · When using a certificate A on the server that I signed with a self signed certificate B, and adding the self signed certificate B to Postman's CA certificates, the error message changes to "unable to verify the first certificate". com verify error:num =20:unable to get local issuer certificate verify return:1 depth =0 CN = *. The simple solution was to install the intermediate certificates, by simply downloading the intermediate certificates that were send to your email that was used to issue the certificate in GoDaddy, simply create a file called fullchain. log shows “client SSL cer… May 26, 2019 · The servers nginx is proxying to are node express servers, and one flask server (which isn't relevant to this). Intermediate certificate - stores a Jun 29, 2017 · Yes, All upstream servers have valid certificates with CN matching their hostnames, and CA has been placed on the NGINX server with proper permissions and set in the nginx. /CN=DST Root CA X3, so its necessary that that cert be in your local CA store. server -host 1. It means that the webserver you are connecting to is misconfigured and did not include the intermediate certificate in the certificate chain it sent to you. Jul 18, 2012 · I got this problem when my NGINX server did not have a complete certificate chain in the certificate file it was configured with. It is recommended to use the full certificate chain in order to prevent SSL errors when clients connect. I only have 2 files, cert and key Would be amazing if someone can guide me in the right direction for fixing this annoying issue. Dec 17, 2020 · Early data was not sent Verify return code: 21 (unable to verify the first certificate) closed My web server is (include version): nginx/1. 1 Codename: stretch My hosting provider, if applicable, is: Oct 16, 2020 · The $ssl_client_verify variable holds "FAILED:unable to verify the first certificate". Mar 3, 2020 · When I try this for your site I get: Start Time: 1583258842 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) Extended master secret: yes Again, this shows the certificate can't be authenticated. js I have a Nodejs API and it uses ssl and https, so i'm trying to consume it on a different server to build a web app using express-js. 解决的办法, 是在nginx中将对应IP的证书也设置为商业证书, 而原来直接用IP访问的应用, 新建一个二级域名来访问. The full certificate chain order should consist of the server certificate first, followed by all intermediate certificates, with the root CA last. Unable to verify the first certificate in Node. Oct 2, 2024 · Showing Unable to verify first certificate. com verify error:num =21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:CN = *. I've checked the certificate list, and the Certificate used to sign Experian (VeriSign Class 3 Secure Server CA - G3) is included in the list. Apr 11, 2025 · UNABLE_TO_VERIFY_LEAF_SIGNATURE | unable to verify the first certificate Ted James Follow 1 min read Feb 14, 2025 · If the verify return code is 21 (unable to verify the first certificate), it may signify that the intermediate certificate is missing or is incorrect. The upstream server is configured with a certificate that includes Jan 19, 2021 · I had the same issue with the Postman unable to verify the first certificate. To solve the issue, add the correct intermediate certificate to the chain. People recommend spending some time on obtaining proper certificate. Resolution: Ensure that the intermediate certificates match the server certificate. ingress. Error: Self-signed intermediate certificates Example In the case of certificates issued from Letsencrypt etc… the full chain of certificates including the CA (certificate authority), the intermediate CA certificate as well as your own domain’s issued certificate must be supplied added to your service (e. cert (a chain with the certificate and the CA). xzar moc ftnozng syjqnqf hlwhfu dcfxla kgbsu yseu gmhkm hmoz vprgzv bmfsgc lquwq bkv tlqw