Chapter 12
Who do we trust? CAs, trust stores and self-signed certificates
Every client trusts only the root certificates in its own trust store, so a certificate is accepted only if its chain ends at one of them; being self-signed earns nothing.
Topic
Chains and trust stores
A client trusts a server's certificate only if it can build a chain from that certificate, usually through one or more intermediate CAs, to a root that is already in its trust store. A root is trusted because it is in the store, not because it signed itself.
Most "unable to get local issuer certificate" and "unknown authority" errors come from a broken chain or a missing root. This hub has the explanations, the fixes for each tool and the guides for trusting a private CA safely.
Understand it: handbook chapters
Plain words first, then the real mechanism, what it looks like at work and why it matters.
Chapter 13
Certificate chains and path validation
Servers must send their leaf and intermediate certificates; clients link them by name and key identifier up to a trusted root and check every signature, date and constraint.
Chapter 14
Two roads to the same root: cross-signing and root expiry
Cross-signing gives one CA key two certificates from different issuers, so a chain can reach either an old or a new root; clients must pick a path that is valid.
Chapter 7
Whose key is it? Binding identity to keys
Encryption and signatures only help if you use the right person's public key, so something you already trust must vouch that a key belongs to a name.
Chapter 18
Famous failures and what changed
Real PKI failures, from a hacked CA to expired certificates, follow one pattern: a weak point breaks trust, someone notices, and the rules or practices change.
Do it: how-to guides
Step-by-step, with real commands and a way to check it worked.
How to check the certificate chain a server sends
You will have listed every certificate a server sends, checked their order and links, and verified the chain with a strict client instead of a browser.
How to build the full chain file your server needs
You will have one PEM file with your certificate followed by its intermediates in the right order, verified offline and proven to work with a strict client.
How to trust a private root CA on Windows
Your Windows computer, or a whole fleet, trusts your organisation's private root CA, and you know which apps still need their own setting.
How to trust a private root CA on macOS
Your Mac, or every managed Mac, trusts your organisation's private root CA in the System keychain, and you know which apps need their own setting.
How to trust a private root CA on Linux
Your Linux server, desktop or container image trusts your organisation's private root CA system-wide, and you know which programs keep their own list.
How to add a CA to a Java trust store (cacerts)
Your Java program trusts your private root CA, either through the JDK's cacerts or through its own trust store, and you have proved it with a real connection.
How to make Python, Node.js and npm trust a private CA
Python, pip, requests, Node.js and npm trust your private root CA, through the operating system's store or a bundle file, with verification still fully on.
How to work behind a TLS-inspecting corporate proxy, safely
You will have confirmed that your traffic is inspected, obtained your company's inspection root through a trusted channel, and made each tool trust it with verification still on.
Fix it: error pages
The exact messages tools and browsers print, with likely causes and safe fixes.
- curlSSL certificate problem: unable to get local issuer certificate
- curlSSL certificate problem: self-signed certificate in certificate chain
- curlcurl: (77) error setting certificate verify locations
- OpenSSLverify error:num=20:unable to get local issuer certificate
- OpenSSLverify error:num=21:unable to verify the first certificate
- OpenSSLtlsv1 alert unknown ca
- JavaPKIX path building failed … unable to find valid certification path to requested target
- Python[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
- Node.jsUNABLE_TO_VERIFY_LEAF_SIGNATURE
- Node.jsSELF_SIGNED_CERT_IN_CHAIN
- npmUNABLE_TO_GET_ISSUER_CERT_LOCALLY
- Go, Docker, Kubernetesx509: certificate signed by unknown authority
- .NET, PowerShellThe remote certificate is invalid according to the validation procedure
- .NET, PowerShellCould not establish trust relationship for the SSL/TLS secure channel
- git on Windowsschannel: SEC_E_UNTRUSTED_ROOT (0x80090325)
- AndroidTrust anchor for certification path not found
- Chrome, EdgeNET::ERR_CERT_AUTHORITY_INVALID
- FirefoxSEC_ERROR_UNKNOWN_ISSUER
- FirefoxMOZILLA_PKIX_ERROR_SELF_SIGNED_CERT
Check yours: browser tools
They run in your browser. Nothing you paste is sent anywhere.
Tool
Chain checker
Paste a chain and see which link is missing, expired or out of order.
Tool
Certificate decoder
Paste a PEM certificate and read every field in plain words.
Tool
Paste your error
Paste a certificate error from any tool and get the page that explains it.
The big picture: crash course
Short lessons of about nine minutes each, with check questions.
Look it up: glossary terms
Every term in plain words, linked to its full entry.
- Authority Information Access (AIA)
- Authority Key Identifier (AKI)
- Certificate authority (CA)
- Certificate chain
- Certificate pinning
- Cross-signing
- Distrust
- Intermediate certificate
- Key substitution
- Leaf certificate
- Man-in-the-middle
- Path validation
- PKI
- Public key infrastructure (PKI)
- Relying party
- Root certificate
- Root program
- Self-signed certificate
- Subject Key Identifier (SKI)
- TLS inspection
- Trust anchor
- Trust store