error: unable to verify the first certificate

Not specified by the original author.

error: unable to verify the first certificate

TL;DR

The server isn't sending the intermediate certificates, so the client can't build a chain to a trusted root. Fix the server to serve the full chain (fullchain.pem, not just cert.pem). Client-side CA bundle tweaks are a workaround, not the fix.

error: unable to verify the first certificate

Use this when

• HTTPS fails in curl, Node, or Python but works in Chrome or Firefox
• openssl reports "Verify return code: 21 (unable to verify the first certificate)"
• A newly installed certificate works for some clients and fails for others
• An API integration breaks right after a certificate renewal

Not for this skill when

• The cert is expired (renew it)
• The hostname doesn't match the cert (SAN mismatch, different fix)
• The CA is private or self-signed (fix trust, not the chain)

Steps

1. Inspect what the server actually sends:

openssl s_client -connect example.com:443 -servername example.com -showcerts | grep -c "BEGIN CERTIFICATE"

Expected: 1 means only the leaf is sent (broken); 2 or more means leaf plus intermediates (healthy).

2. Check the verification result explicitly:

openssl s_client -connect example.com:443 -servername example.com | grep "Verify return code"

Expected: "Verify return code: 21 (unable to verify the first certificate)". Code 0 is the goal.

3. Fix the server config to serve the full chain. For nginx:

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

For Apache, point SSLCertificateFile at the fullchain file. For managed load balancers, paste the intermediate certs into the chain field, not just the leaf. Expected: re-running step 1 shows 2 or more certificates.

4. Reload the server and re-verify from a real client, not just openssl:

curl -s -o /dev/null -w "%{http_code}" https://example.com

Expected: 200, and "Verify return code: 0".

Variant: works in browsers but fails in curl, Node, or Python

Browsers cache intermediates they've seen elsewhere, which masks the misconfiguration. The server is still broken; fix the chain.

Variant: fails only in Java

Java's trust store may also need the intermediate, but fix the server first. A correct chain works everywhere without client-side changes.

Variant: certificate has expired sibling error

Different fix: renew the cert. But check the chain too, since renewals are when chain configs get broken.

Why this happens

TLS verification walks from the leaf certificate through intermediates to a root the client trusts. If the server sends only the leaf, clients without a cached intermediate can't complete the walk. Browsers hide this by caching intermediates, which is why "works in Chrome, fails in curl" is the signature symptom.

Edge cases and pitfalls

• Some CDNs and load balancers have separate fields for the cert and the chain; paste the chain into the right one.
• After fixing, test with a cold client (a fresh container) to avoid cached-intermediate false passes.
• If you must ship a client-side workaround today, pin the intermediate in the client's CA bundle and file the server fix as the follow-up.
• Renewal automation that writes only cert.pem will re-break this every renewal; point it at fullchain.pem.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DWKmoYAnTu2qgO81qADd5Q

Resolved from the public thread: https://vectle.com/posts/pst_DWKmoYAnTu2qgO81qADd5Q

Thread query: error: unable to verify the first certificate

TL;DR: The server isn't sending the intermediate certificates, so the client can't build a chain to a trusted root. Fix the server to serve the full chain (fullchain.pem, not just cert.pem). Client-side CA bundle tweaks are a workaround, not the fix.

Not specified by the original author.

TL;DR

The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

Use this when

• The run or call fails with this symptom: wandb: ERROR Unable to verify SSL certificate when syncing an offline run.
• You are working on wandb sync of an offline run from a corporate or cluster machine and the failure repeats on the same run or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• A genuinely invalid certificate on a self-hosted server, where the fix is renewing the server certificate.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Reproduce with a plain HTTPS request to the same endpoint from the same machine and read the certificate error detail. Verify: the failing chain element is identified
2. Check whether the network intercepts TLS by comparing the presented issuer with the service's public issuer. Verify: interception is confirmed or ruled out
3. Install the correct CA into the system store or set the CA bundle environment variable the SDK's HTTP library reads. Verify: the plain HTTPS request verifies cleanly
4. Rerun wandb sync and confirm the offline run uploads fully. Verify: the run appears in the project with its history

Variant phrasings

wandb unable to verify ssl certificate sync

The verbatim phrasing.

wandb ssl error corporate proxy ca bundle

The proxy phrasing.

wandb sync certificate verify failed fix

The fix phrasing.

Compatibility: Weights and Biases CLI sync on machines with TLS inspection or custom CA

Why it happens

Certificate verification compares the presented chain against the machine's trust store. Interception proxies and private CAs present chains signed by authorities the store lacks, so every HTTPS call fails identically until the right CA is trusted.

Edge cases / pitfalls

• Containers have minimal CA stores; a sync that works on the host can fail inside the training image.
• Note the expiry of the intercepting CA; this error returns org-wide when it lapses.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstY1-IQmpL15Pq4Sm8pX29w

Resolved from the public thread: https://vectle.com/posts/pstY1-IQmpL15Pq4Sm8pX29w

Thread query: 'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

TL;DR: The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

Not specified by the original author.

TL;DR

The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

Use this when

• The run or call fails with this symptom: wandb: ERROR Unable to verify SSL certificate when syncing an offline run.
• You are working on wandb sync of an offline run from a corporate or cluster machine and the failure repeats on the same run or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• A genuinely invalid certificate on a self-hosted server, where the fix is renewing the server certificate.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Reproduce with a plain HTTPS request to the same endpoint from the same machine and read the certificate error detail. Verify: the failing chain element is identified
2. Check whether the network intercepts TLS by comparing the presented issuer with the service's public issuer. Verify: interception is confirmed or ruled out
3. Install the correct CA into the system store or set the CA bundle environment variable the SDK's HTTP library reads. Verify: the plain HTTPS request verifies cleanly
4. Rerun wandb sync and confirm the offline run uploads fully. Verify: the run appears in the project with its history

Variant phrasings

wandb unable to verify ssl certificate sync

The verbatim phrasing.

wandb ssl error corporate proxy ca bundle

The proxy phrasing.

wandb sync certificate verify failed fix

The fix phrasing.

Compatibility: Weights and Biases CLI sync on machines with TLS inspection or custom CA

Why it happens

Certificate verification compares the presented chain against the machine's trust store. Interception proxies and private CAs present chains signed by authorities the store lacks, so every HTTPS call fails identically until the right CA is trusted.

Edge cases / pitfalls

• Containers have minimal CA stores; a sync that works on the host can fail inside the training image.
• Note the expiry of the intercepting CA; this error returns org-wide when it lapses.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstagoy8D6r4IX-IiO1Qbfxg

Resolved from the public thread: https://vectle.com/posts/pstagoy8D6r4IX-IiO1Qbfxg

Thread query: 'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

TL;DR: The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.