Openssl : error "self signed certificate in certificate chain"

Question

When I used openssl APIs to validate server certificate (self signed), I got following error :

error 19 at 1 depth lookup:self signed certificate in certificate chain

As per openssl documentation, this error (19) is

"X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in certificate chain - the certificate chain could be built up using the untrusted certificates but the root could not be found locally."

Why this error occurs ? Any problems with my server certificate ?

Parttime

Answer 1

You have a certificate which is self-signed, so it's non-trusted by default, that's why OpenSSL complains. This warning is actually a good thing, because this scenario might also rise due to a man-in-the-middle attack.

To solve this, you'll need to install it as a trusted server. If it's signed by a non-trusted CA, you'll have to install that CA's certificate as well.

Have a look at this link about installing self-signed certificates.

Eduction

Answer 2

Here is one-liner to verify certificate to be signed by specific CA:

openssl verify -verbose -x509_strict -CAfile ca.pem certificate.pem

This doesn't require to install CA anywhere.

See How does an SSL certificate chain bundle work? for details and correct certificate chain handling.

Dotted

Answer 3

The solution for the error is to add this line at the top of the code:

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Gyimah

i would consider this a work around or an option for testing. it should not be persistant because it undermines the available security. – Stans

This seems to be specific to Node.js, if I'm not mistaken. – Actin

It is NodeJS-specific and just disables all certificate checks. You could do this but only if you really know what you're doing. Just putting this in here as an answer is bad because whoever is using this doesn't get any information on what they're doing. – Tumult

This is not a solution. -10 – Oligochaete

I am fine using this for development. DevOps can deal with certs on production however they want. – Ruttger

Answer 4

If you're running Charles and trying to build a docker container then you'll most likely get this error.

Make sure to disable Charles (macos) proxy under proxy -> macOS proxy

Charles is an

HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP and SSL / HTTPS traffic between their machine and the Internet.

So anything similar may cause the same issue.

Electrotechnology

worked for me even though I didn't have Charles open at the time I hit the error. – Fillet

Thanks. I am using TLS connections with Postgres, Charles was causing them to fail. – Zymase

Answer 5

if you are testing your end points using Postman, just go to settings and disable "Enable SSL certificate verification"

Cristinecristiona

Answer 6

if you are using mtls it is expected, if it is tls only it is not normal, and potentially man on the middle attack

Lavish

Answer 7

You can try to update CA certificates as below(Worked for me):

For Linux users(Run below):

apt-get update ca-certificates
yum update ca-certificates

if you use RVM, run below:

rvm osx-ssl-certs update all

---

For Mac users(Run below):

brew upgrade ca-certificates
rvm osx-ssl-certs update all

If you do not use RVM, refer: Source

Icelandic

Answer 8

You can also skip the SSL verification globally using the command:

git config --global http.sslVerify false

Snowwhite