How to Fix "SSL certificate problem: unable to get local issuer certificate"

When interacting with HTTPS endpoints via cURL, Git, PHP, or Python scripts, OpenSSL validates the remote server's SSL/TLS certificate chain against a local bundle of trusted Certificate Authorities (CAs). If the client runtime lacks an up-to-date CA store, or if the target server fails to chain intermediate certificates, OpenSSL throws the error SSL certificate problem: unable to get local issuer certificate. This issue can be resolved permanently by downloading a fresh Mozilla CA bundle and pointing your HTTP runtime environment to it.

The Problem

When sending requests or configuring components in your development environment, the application or HTTP client fails with the following exact error trace:

# Example 1: cURL command line error
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

# Example 2: Git clone error
fatal: unable to access 'https://github.com/org/repo.git/': SSL certificate problem: unable to get local issuer certificate

# Example 3: PHP cURL execution error
cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.se/libcurl/c/libcurl-errors.html)

This error halts script execution, prevents API communication, or results in immediate client-side connection drops.

Why It Happens

This failure occurs due to misconfigurations at the networking, cryptographic, or application protocol layer. The primary causes include:

• Unconfigured Local CA Bundle: PHP, Git, or standalone OpenSSL runtime environments on Windows or Linux do not automatically inherit operating system root certificates and lack a configured cacert.pem path.
• Incomplete Server Certificate Chain: The target server presents its leaf certificate but omits intermediate certificates required to establish a trust path back to a recognized root authority.
• Outdated Root Certificates: The local certificate store has expired or lacks recently issued root certificates from providers like Let's Encrypt (e.g., ISRG Root X1 transitions).
• Corporate Interception Proxies: Enterprise security software intercepts outbound SSL traffic and replaces remote certificates with custom corporate certificates not listed in standard Mozilla CA bundles.

The Fix

Follow these step-by-step solutions to resolve the error in your environment.

Step 1: Download the Official Mozilla CA Certificate Bundle

Download the latest verified CA root certificate bundle maintained by cURL from the official repository:

# Download cacert.pem using cURL or PowerShell
curl.exe -k -o C:\certs\cacert.pem https://curl.se/ca/cacert.pem

Step 2: Configure PHP runtime (php.ini)

If you encounter this error in PHP scripts, Guzzle, or Composer, edit your active php.ini configuration file to point explicitly to the downloaded bundle:

[curl]
curl.cainfo = "C:\certs\cacert.pem"

[openssl]
openssl.cafile = "C:\certs\cacert.pem"

Verify PHP configuration via terminal:

php -r "print_r(openssl_get_cert_locations());"

Step 3: Configure Git SSL Authority

For fatal: unable to access... SSL certificate problem errors during git clone or git fetch, set the global http.sslCAInfo path:

git config --global http.sslCAInfo "C:/certs/cacert.pem"

Confirm the configuration is applied:

git config --global --get http.sslCAInfo

Step 4: Configure Python / Certifi Bundle

In Python projects using requests, install or update the certifi package, or export the environment variable:

# Install updated certifi bundle
pip install --upgrade certifi

# Set environment variables in Linux/macOS or Windows PowerShell
export REQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt"
$env:REQUESTS_CA_BUNDLE="C:\certs\cacert.pem"

Still Not Working?

Missing Intermediate Certificates on Target Server

If the error persists specifically for a single domain despite configuring an updated cacert.pem, the remote web server itself may be improperly configured by not sending intermediate CA certificates. Test the domain chain using OpenSSL s_client:

openssl s_client -connect api.yourdomain.com:443 -showcerts

If the output shows Verify return code: 21 (unable to verify the first certificate), the web server administrator must update their Nginx/Apache certificate bundle to include the full certificate chain (e.g., combining fullchain.pem instead of cert.pem alone).