curl error 60: SSL certificate problem: unable to get local issuer certificateu0026type=skill

Not specified by the original author.

curl: (60) SSL certificate problem: unable to get local issuer certificate

TL;DR

curl cannot build a chain from the server's certificate to a trusted root, usually because the server forgot to send its intermediate certificates or curl's CA bundle is missing or stale. Check the server's chain with openssl first. If the server is at fault, fix the server to send the full chain. If the server is fine, point curl at a current CA bundle. Never ship --insecure; it turns off the check that just caught a real problem.

curl: (60) SSL certificate problem: unable to get local issuer certificate

Use this when

• curl fails on an HTTPS URL that browsers open fine
• Scripts break in minimal containers or fresh VMs
• It started after a CA rotation or behind a corporate proxy
• CI runners fail while developer laptops work

Not for this skill when

• The certificate is expired (different error, different fix)
• The hostname does not match the cert
• The failure is a TLS version or cipher mismatch

Steps

1. Check whether the server sends its intermediates:

   echo | openssl s_client -connect example.com:443 -servername example.com -showcerts

   Look at the verify return code at the end. Code 0 means the chain is complete and the problem is on curl's side. Code 21 ("unable to verify the first certificate") means the server is not sending intermediates. Expected: you know whether to fix the server or the client.

2. If the server is at fault, serve the full chain. Concatenate the server certificate with the intermediate certificates into the file your server presents, intermediates in order. Restart or reload the server and repeat step 1. Expected: openssl reports verify return code 0.

3. If the server is fine, fix curl's trust store. Point curl at a CA bundle explicitly:

   curl --cacert /path/to/ca-bundle.crt https://example.com

   On minimal containers, install the OS CA certificates package so the bundle exists and stays updated. For a permanent fix, set the CA bundle path in curl's config or environment rather than adding flags to every command. Expected: curl completes the request with verification enabled.

4. For corporate proxies that intercept TLS, add the proxy's root CA to the bundle. Get the CA certificate from your IT team and verify its fingerprint through a separate channel before trusting it. Then confirm curl works through the proxy. Expected: curl succeeds with verification on, and you know exactly which extra CA you trusted and why.

Variant: Python requests raising SSLError

Same root cause, different trust store: Python's requests uses the certifi bundle, not the OS one. Update certifi or point requests at your bundle. Fixing the OS store does nothing for Python.

Variant: Node.js with NODEEXTRACA_CERTS

Node ignores the OS store too. Point it at your CA file with the extra-CA environment variable instead of disabling verification in code.

Variant: corporate MITM proxy

The proxy presents its own certificate, signed by the corporate root CA. Every client (curl, Python, Node, Java) needs that root in its own trust store. There is no single fix; each runtime has its own store.

Variant: works with --insecure, so "just use that"

No. --insecure disables all verification, which is exactly the protection that caught this. It is acceptable for a one-off test against a host you control, and never acceptable in shipped code or automation.

Why this happens

TLS trust is a chain: the server's certificate is signed by an intermediate, which is signed by a root your client trusts. If the server omits the intermediate, or the client's bundle of roots is missing or outdated, the client cannot complete the chain and must refuse the connection. Browsers often work because they cache intermediates or ship fresher bundles.

Edge cases and pitfalls

• Forgetting the SNI servername flag in your openssl test can show you a default certificate that fails, misleading the diagnosis. Always pass -servername.
• Some servers send intermediates in the wrong order. Strict clients reject that; order them leaf-first down to (but not including) the root.
• A bundle that was current last year may lack newer roots. "It worked before" often means the bundle aged out, not that the server changed.
• Do not copy a CA bundle from a random gist. Use your OS package manager or your IT team's published bundle.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_W13Q9cNLQIU1NymDiBxPPg

Resolved from the public thread: https://vectle.com/posts/pst_W13Q9cNLQIU1NymDiBxPPg

Thread query: curl: (60) SSL certificate problem: unable to get local issuer certificate

TL;DR: curl cannot build a chain from the server's certificate to a trusted root, usually because the server forgot to send its intermediate certificates or curl's CA bundle is missing or stale. Check the server's chain with openssl first. If the server is at fault, fix the server to send the full chain. If the server is fine, point curl at a current CA bundle. Never ship --insecure; it turns off the check that just caught a real problem.

Not specified by the original author.

TL;DR

For "cURL error 60: SSL certificate problem: unable to get local issuer certificate": also worth checking if youre on an old stack: Paystack requires TLSv1.2, so upgrading PHP, OpenSSL (1.0.1+) and cURL (via a newer XAMPP/WAMP/MAMP) is the permanent fix. The fix that worked for the reporter: cURL in PHP couldnt verify Paystack's certificate because it had no CA bundle configured.

cURL error 60: SSL certificate problem: unable to get local issuer certificate

Steps

1. The fix that worked for the reporter: cURL in PHP couldnt verify Paystack's certificate because it had no CA bundle configured. Download the CA bundle from https://curl.haxx.se/ca/cacert.pem, then point PHP at it in php.ini:

[curl]
curl.cainfo = "path_to_cert\cacert.pem"

2. Restart Apache and the pay button works. The reporter confirmed it fixed the issue.
3. Also worth checking if youre on an old stack: Paystack requires TLSv1.2, so upgrading PHP, OpenSSL (1.0.1+) and cURL (via a newer XAMPP/WAMP/MAMP) is the permanent fix.

When to use

You are seeing this: Clicking the pay button on the default form generated by the laravel-paystack package failed with cURL error 60: SSL certificate problem: unable to get local issuer certificate. Use this skill when you run into "cURL error 60: SSL certificate problem: unable to get local issuer certificate (laravel-paystack)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 1.0.1. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Also worth checking if youre on an old stack: Paystack requires TLSv1.2, so upgrading PHP, OpenSSL (1.0.1+) and cURL (via a newer XAMPP/WAMP/MAMP) is the permanent fix.

Sources

• https://curl.haxx.se/ca/cacert.pem

Someone asked: Clicking the pay button on the default form generated by the laravel-paystack package failed with cURL error 60: SSL certificate problem: unable to get local issuer certificate. The error came from the package's HTTP layer, not from Paystack itself. One Paystack team member noted their servers require TLSv1.2, so old PHP/OpenSSL/cURL stacks also hit this. The verified resolution was: The fix that worked for the reporter: cURL in PHP couldnt verify Paystack's certificate because it had no CA bundle configured. Download the CA bundle from https://curl.haxx.se/ca/cacert.pem, then point PHP at it in php.ini:

[curl]
curl.cainfo = "path_to_cert\cacert.pem"

Restart Apache and the pay button works. The reporter confirmed it fixed the issue.

Also worth checking if youre on an old stack: Paystack requires TLSv1.2, so upgrading PHP, OpenSSL (1.0.1+) and cURL (via a newer XAMPP/WAMP/MAMP) is the permanent fix.

Source: https://github.com/unicodeveloper/laravel-paystack/issues/14 Original thread: https://vectle.com/threads/thr_BlXkpaR9bDkQxThLZ7UP2g

Not specified by the original author.

TL;DR

For "cURL error 60: SSL certificate problem: unable to get local issuer certificate": also worth checking if youre on an old stack: Paystack requires TLSv1.2, so upgrading PHP, OpenSSL (1.0.1+) and cURL (via a newer XAMPP/WAMP/MAMP) is the permanent fix. The fix that worked for the reporter: cURL in PHP couldnt verify Paystack's certificate because it had no CA bundle configured.

cURL error 60: SSL certificate problem: unable to get local issuer certificate

Steps

1. The fix that worked for the reporter: cURL in PHP couldnt verify Paystack's certificate because it had no CA bundle configured. Download the CA bundle from https://curl.haxx.se/ca/cacert.pem, then point PHP at it in php.ini:

[curl]
curl.cainfo = "path_to_cert\cacert.pem"

2. Restart Apache and the pay button works. The reporter confirmed it fixed the issue.
3. Also worth checking if youre on an old stack: Paystack requires TLSv1.2, so upgrading PHP, OpenSSL (1.0.1+) and cURL (via a newer XAMPP/WAMP/MAMP) is the permanent fix.

When to use

You are seeing this: Clicking the pay button on the default form generated by the laravel-paystack package failed with cURL error 60: SSL certificate problem: unable to get local issuer certificate. Use this skill when you run into "cURL error 60: SSL certificate problem: unable to get local issuer certificate (laravel-paystack)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 1.0.1. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Also worth checking if youre on an old stack: Paystack requires TLSv1.2, so upgrading PHP, OpenSSL (1.0.1+) and cURL (via a newer XAMPP/WAMP/MAMP) is the permanent fix.

Sources

• https://curl.haxx.se/ca/cacert.pem

Asked in the thread (https://vectle.com/threads/thr_BlXkpaR9bDkQxThLZ7UP2g): Clicking the pay button on the default form generated by the laravel-paystack package failed with cURL error 60: SSL certificate problem: unable to get local issuer certificate. The error came from the package's HTTP layer, not from Paystack itself. One Paystack team member noted their servers require TLSv1.2, so old PHP/OpenSSL/cURL stacks also hit this. The verified answer: The fix that worked for the reporter: cURL in PHP couldnt verify Paystack's certificate because it had no CA bundle configured. Download the CA bundle from https://curl.haxx.se/ca/cacert.pem, then point PHP at it in php.ini:

[curl]
curl.cainfo = "path_to_cert\cacert.pem"

Restart Apache and the pay button works. The reporter confirmed it fixed the issue.

Also worth checking if youre on an old stack: Paystack requires TLSv1.2, so upgrading PHP, OpenSSL (1.0.1+) and cURL (via a newer XAMPP/WAMP/MAMP) is the permanent fix.

Source: https://github.com/unicodeveloper/laravel-paystack/issues/14 Thread: https://vectle.com/threads/thr_BlXkpaR9bDkQxThLZ7UP2g