title: SSL Error: unable to get local issuer certificate
body: <p>I'm having trouble configuring SSL on a Debian 6.0 32bit server. I'm relatively new with SSL so please bear with me. I'm including as much information as I can.<br>
  <em>Note: The true domain name has been changed to protect the identity and integrity of the server.</em></p>
  
  <h3>Configuration</h3>
  
  <p>The server is running using nginx. It is configured as follows:</p>
  
  <pre><code>ssl_certificate           /usr/local/nginx/priv/mysite.ca.chained.crt;
  ssl_certificate_key       /usr/local/nginx/priv/mysite.ca.key;
  ssl_protocols             SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers               HIGH:!aNULL:!MD5;
  ssl_verify_depth          2;
  </code></pre>
  
  <p>I chained my certificate using the method described <a href="http://nginx.org/en/docs/http/configuring_https_servers.html" rel="noreferrer">here</a></p>
  
  <pre><code>cat mysite.ca.crt bundle.crt &gt; mysite.ca.chained.crt
  </code></pre>
  
  <p>where <code>mysite.ca.crt</code> is the certificate given to me by the signing authority, and the <code>bundle.crt</code> is the CA certificate also sent to me by my signing authority. The problem is that I did not purchase the SSL certificate directly from GlobalSign, but instead through my hosting provider, Singlehop.</p>
  
  <h3>Testing</h3>
  
  <p>The certificate validates properly on Safari and Chrome, but not on Firefox. Initial searching revealed that it may be a problem with the CA. </p>
  
  <p>I explored the answer to a <a href="https://stackoverflow.com/questions/7587851/openssl-unable-to-verify-the-first-certificate-for-experian-url">similar question</a>, but was unable to find a solution, as I don't really understand what purpose each certificate serves.</p>
  
  <p>I used openssl's s_client to test the connection, and received output which seems to indicate the same problem as <a href="https://stackoverflow.com/questions/7587851/openssl-unable-to-verify-the-first-certificate-for-experian-url">the similar question</a>. The error is as follows:</p>
  
  <pre><code>depth=0 /OU=Domain Control Validated/CN=*.mysite.ca
  verify error:num=20:unable to get local issuer certificate
  verify return:1
  depth=0 /OU=Domain Control Validated/CN=*.mysite.ca
  verify error:num=27:certificate not trusted
  verify return:1
  </code></pre>
  
  <p>A full detail of openssl's response (with certificates and unnecessary information truncated) can be found <a href="https://gist.github.com/jamiecounsell/a3988d56965d81d1a4b0" rel="noreferrer">here</a>.</p>
  
  <p>I also see the warning:</p>
  
  <pre><code>No client certificate CA names sent
  </code></pre>
  
  <p>Is it possible that this is the problem? How can I ensure that nginx sends these CA names?</p>
  
  <h3>Attempts to Solve the Problem</h3>
  
  <p>I attempted to solve the problem by downloading the root CA directly from GlobalSign, but received the same error. I updated the root CA's on my Debian server using the <code>update-ca-certificates</code> command, but nothing changed. This is likely because the CA sent from my provider was correct, so it led to the certificate being chained twice, which doesn't help.</p>
  
  <pre><code>0 s:/OU=Domain Control Validated/CN=*.mysite.ca
     i:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
  1 s:/O=AlphaSSL/CN=AlphaSSL CA - G2
     i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
  2 s:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
     i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
  </code></pre>
  
  <h3>Next Steps</h3>
  
  <p>Please let me know if there is anything I can try, or if I just have the whole thing configured incorrectly.</p>