Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Ubuntu 12.04 LTS, I am getting error for certificate validation error if the CApath is not explicitly set

Tried several solution. But nothing works. It is causing so much of issue to install new packages on my system (tried at least on two system)

Successful command:

openssl s_client -connect -showcerts -CApath /etc/ssl/certs/ 

Success with Verify return code: 0 (ok) 

Unsuccessful command

openssl s_client -connect -showcerts 

Failed with Verify return code: 20 (unable to get local issuer certificate)

I tried following solution based on the wiki responses but it is also not working

openssl x509 -noout -hash -in /etc/ssl/certs/GeoTrust_Global_CA.pem 2c543cd1    
openssl x509 -noout -subject_hash_old -in /etc/ssl/certs/GeoTrust_Global_CA.pem 7999be0d    
openssl x509 -noout -subject_hash -in /etc/ssl/certs/GeoTrust_Global_CA.pem 2c543cd1

I can see the difference in hash values

I tried adding a script to create symbolic link with -subject_hash_old and -subject_hash.

But the problem continues to happen and I get the error code Verify return code: 20 (unable to get local issuer certificate).

Create following script to create symbolic links in /etc/ssl/certs
Link with subject_hash_old and subject_hash is successfully created

for FILE in /etc/ssl/certs/*.pem
   hasholdsub=`openssl x509 -noout -subject_hash_old -in $FILE`
   hashsub=`openssl x509 -noout -subject_hash -in $FILE`

   echo $hasholdsub $hashsub

   ln -s $FILE  $hasholdsub.0
   ln -s $FILE  $hashsub.0
   cat  $FILE >> ca-certificats-gen.crt

But this problem is still existing

Please help to resolve the issue.

share|improve this question

Please try using -CAfile instead of -CApath and point to the single concatenated CA certificates file. E.g.:

openssl s_client -connect -showcerts \
                 -CAfile /etc/ssl/certs/ca-certificates.crt

This works for me, showing verify return:1 and a full certificate chain.

Background information: This /etc/ssl/certs/ca-certificates.crt is managed by the update-ca-certificates command, simply concatenating all system-wide installed certificates, including those manually installed in /usr/local/share/ca-certificates/.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.