Cannot verify certificate: unable to get local issuer certificate | how to use --rootcert

[andrebolzan]

Hello!

We have 2 certificate, one for Let's Encrypt for a single host and another for GlobalSign nv-sa for a wild card

Both show me "Cannot verify certificate: unable to get local issuer certificate"

We try run update-ca-certificates

We checked in documentation, i need using "--rootcert" but we don't do know how "informe the correct" CA

We need run "wget ​​Lets Encrypt.org"

and inform in CLI

check_ssl_cert -h hostname --rootcert /path/file

We check in Let's Encrypt website and can't see any information about "rootcert" download

Thnaks in advanced !

best regards

[matteocorti]

The root certificate should usually already be on your machine but without any details (e.g., the OS you are using) it's difficult to help.

Anyway the root certificates for Let's Encrypt can be downloaded from: https://letsencrypt.org/certificates/

[andrebolzan]

Thanks for help Matteo!

I try run: check_ssl_cert website --rootcert /root/isrgrootx1.pem

Show the same information:

SSL_CERT CRITICAL speedtest01.xxxx.com. Cannot verify certificate: unable to get local issuer certificate, unable to verify the first certificate|days_chain_elem1=89;20;15;;

I try running in debian 11 (without GUI), this is problem of machine or certificate ?

We using the plugin to "monitoring" certificate validity.

[matteocorti]

Please post the debugging output (--debug)

[andrebolzan]

Thanks for help !

[DBG] Command line arguments: -H sp.FQDN.com --debug
[DBG] SNI =
[DBG] HOST_NAME = sp.FQDN.com
[DBG] HOST_ADDR = sp.FQDN.com
[DBG] COMMON_NAME = sp.FQDN.com
[DBG] -c specified: 15
[DBG] ROOT_CA =
[DBG] file version: file-5.39
[DBG] magic file from /etc/magic:/usr/share/misc/magic
[DBG] cURL binary needed. SSL Labs = , OCSP = 1, CURL =
[DBG] cURL binary not specified
[DBG] cURL available: /usr/bin/curl
[DBG] curl 7.74.0 (x86_64-pc-linux-gnu) libcurl/7.74.0 OpenSSL/1.1.1k zlib/1.2.11 brotli/1.0.9 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.3.0) libssh2/1.9.0 nghttp2/1.43.0 librtmp/2.3
[DBG] Release-Date: 2020-12-09
[DBG] Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
[DBG] Features: alt-svc AsynchDNS brotli GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets
[DBG] nmap binary not needed. No disallowed protocols
[DBG] perl available: /usr/bin/perl
[DBG] date available: /usr/bin/date
[DBG] checking date version
[DBG] check_ssl_cert version: 2.3.0
[DBG] OpenSSL binary: /usr/bin/openssl
[DBG] OpenSSL info:
[DBG] OpenSSL configuration directory: /usr/lib/ssl
[DBG] 0 root certificates installed by default
[DBG] System info: Linux nagios 5.10.0-10-amd64 #1 SMP Debian 5.10.84-1 (2021-12-08) x86_64 GNU/Linux
[DBG] Date computation: GNU
[DBG] '/usr/bin/openssl s_client' supports '-servername': using -servername sp.FQDN.com
[DBG] '/usr/bin/openssl s_client' supports '-name': using nagios
[DBG] '/usr/bin/openssl s_client' supports '-xmpphost': using -xmpphost sp.FQDN.com
[DBG] temporary file /tmp/1Am4N3 created
[DBG] temporary file /tmp/51JTx2 created
[DBG] temporary file /tmp/IxHNT6 created
[DBG] temporary file /tmp/X7HV7B created
[DBG] temporary file /tmp/MW1SkJ created
[DBG] temporary file /tmp/6yr0ZC created
[DBG] temporary file /tmp/0sf9XU created
[DBG] sp.FQDN.com is not an IP address
[DBG] Adding -ign_eof to the options
[DBG] executing with timeout (120s): printf 'HEAD / HTTP/1.1
[DBG] Host: sp.FQDN.com
[DBG] User-Agent: check_ssl_cert/2.3.0
[DBG] Connection: close
[DBG]
[DBG] ' | /usr/bin/openssl s_client -crlf -ign_eof -connect sp.FQDN.com:443 -servername sp.FQDN.com -showcerts -verify 6 2> /tmp/51JTx2 1> /tmp/1Am4N3
[DBG] start time = 1648312647
[DBG] /usr/bin/timeout 120 /bin/sh -c "printf 'HEAD / HTTP/1.1
[DBG] Host: sp.FQDN.com
[DBG] User-Agent: check_ssl_cert/2.3.0
[DBG] Connection: close
[DBG]
[DBG] ' | /usr/bin/openssl s_client -crlf -ign_eof -connect sp.FQDN.com:443 -servername sp.FQDN.com -showcerts -verify 6 2> /tmp/51JTx2 1> /tmp/1Am4N3"
[DBG] end time = 1648312652
[DBG] new timeout = 115
[DBG] Return value of the command = 0
[DBG] executing with timeout (115s): printf 'R
[DBG] ' | openssl s_client -connect sp.FQDN.com:443 2>&1 | grep -F -q err
[DBG] start time = 1648312652
[DBG] /usr/bin/timeout 115 /bin/sh -c "printf 'R
[DBG] ' | openssl s_client -connect sp.FQDN.com:443 2>&1 | grep -F -q err"
[DBG] end time = 1648312657
[DBG] new timeout = 110
[DBG] Skipping 0 element of the chain
[DBG] ISSUERS =
[DBG] issuer=C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
[DBG] ISSUERS =
[DBG] O = GlobalSign nv-sa
[DBG] CN = AlphaSSL CA - SHA256 - G2
[DBG] subject=CN = *.FQDN.com
[DBG] CN = .FQDN.com
[DBG] CA = O = GlobalSign nv-sa
[DBG] CA = CN = AlphaSSL CA - SHA256 - G2
[DBG] SERIAL = 757A19609AF90E183FBB9DF8
[DBG] FINGERPRINT= 7D:3D:46:4F:0E:97:23:82:BC:1B:FD:E4:29:17:99:DB:89:ED:F4:C3
[DBG] OCSP_URI = http://ocsp2.globalsign.com/gsalphasha2g2
[DBG] ISSUER_URI = http://secure2.alphassl.com/cacert/gsalphasha2g2r1.crt
[DBG] Signature Algorithm: sha256WithRSAEncryption
[DBG] subjectAlternativeName = .FQDN.com fixfibra.com.br
[DBG] check CN: .FQDN.com
[DBG] COMMON_NAME = sp.FQDN.com
[DBG] ALTNAMES = 1
[DBG] checking if the common name matches ^[A-Za-z0-9_-][.]fixfibra[.]com[.]br$
[DBG] the common name sp.FQDN.com matches ^[A-Za-z0-9_-][.]fixfibra[.]com[.]br$
[DBG] checking if the common name matches ^.FQDN.com$
[DBG] CN check finished
[DBG] Checking expiration date
[DBG] Number of certificates in CA chain: 1
[DBG] Skipping 0 element of the chain
[DBG] ------------------------------------------------------------------------------
[DBG] Checking expiration date of element 1
[DBG] Validity date on cert element 1 is Jun 26 19:11:04 2022 GMT
[DBG] Date computations: GNU
[DBG] Computing number of hours until 'Jun 26 19:11:04 2022 GMT'
[DBG] Hours until Jun 26 19:11:04 2022 GMT: 2210
[DBG] executing: /usr/bin/openssl x509 -noout -checkend 0 on cert element 1
[DBG] executing: /usr/bin/openssl x509 -noout -checkend 1296000 on cert element 1
[DBG] executing: /usr/bin/openssl x509 -noout -checkend 1728000 on cert element 1
[DBG] ------------------------------------------------------------------------------
[DBG] Checking OCSP status of element 1
[DBG] temporary file /tmp/xADOrw created
[DBG] Storing the chain element in /tmp/xADOrw
[DBG] Checking revokation via OCSP
[DBG] Issuer hash: 16744f0c
[DBG] Chain element issuer URIs: http://secure2.alphassl.com/cacert/gsalphasha2g2r1.crt
[DBG] checking issuer URIs: http://secure2.alphassl.com/cacert/gsalphasha2g2r1.crt
[DBG] OCSP: fetching issuer certificate http://secure2.alphassl.com/cacert/gsalphasha2g2r1.crt to /tmp/6yr0ZC
[DBG] executing with timeout (110s): /usr/bin/curl --silent --location "http://secure2.alphassl.com/cacert/gsalphasha2g2r1.crt\" > /tmp/6yr0ZC
[DBG] start time = 1648312657
[DBG] /usr/bin/timeout 110 /bin/sh -c "/usr/bin/curl --silent --location "http://secure2.alphassl.com/cacert/gsalphasha2g2r1.crt\" > /tmp/6yr0ZC"
[DBG] end time = 1648312663
[DBG] new timeout = 104
[DBG] OCSP: issuer certificate type (1): Certificate, Version=3
[DBG] OCSP: issuer certificate type (2): Certificate, Version=3
[DBG] OCSP: converting issuer certificate from DER to PEM
[DBG] OCSP: issuer certificate type (3): PEM certificate
[DBG] OCSP: URIs = http://ocsp2.globalsign.com/gsalphasha2g2
[DBG] OCSP: URI = http://ocsp2.globalsign.com/gsalphasha2g2
[DBG] OCSP: host = ocsp2.globalsign.com
[DBG] openssl ocsp supports the -header option
[DBG] /usr/bin/openssl ocsp -header requires 'key=value'
[DBG] executing /usr/bin/openssl ocsp -timeout "104" -no_nonce -issuer /tmp/6yr0ZC -cert /tmp/xADOrw -url http://ocsp2.globalsign.com/gsalphasha2g2 -header HOST=ocsp2.globalsign.com
[DBG] OCSP: response = Response verify OK
[DBG] OCSP: response = /tmp/xADOrw: good
[DBG] OCSP: response = This Update: Mar 26 16:37:48 2022 GMT
[DBG] OCSP: response = Next Update: Mar 30 16:37:48 2022 GMT
[DBG] Checking if the certificate was self signed
[DBG] Error: verify depth is 6
[DBG] Error: depth=0 CN = *.FQDN.com
[DBG] Error: verify error:num=20:unable to get local issuer certificate
[DBG] Error: verify return:1
[DBG] Error: depth=0 CN = *.FQDN.com
[DBG] Error: verify error:num=21:unable to verify the first certificate
[DBG] Error: verify return:1
[DBG] Error: depth=0 CN = *.FQDN.com
[DBG] Error: verify return:1
[DBG] CRITICAL >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[DBG] prepend_critical_message: new message = Cannot verify certificate: unable to get local issuer certificate, unable to verify the first certificate
[DBG] prepend_critical_message: HOST_NAME = sp.FQDN.com
[DBG] prepend_critical_message: HOST_ADDR = sp.FQDN.com
[DBG] prepend_critical_message: CN = *.FQDN.com
[DBG] prepend_critical_message: SNI =
[DBG] prepend_critical_message: FILE =
[DBG] prepend_critical_message: SHORTNAME = SSL_CERT
[DBG] prepend_critical_message: MSG =
[DBG] prepend_critical_message: CRITICAL_MSG =
[DBG] prepend_critical_message: ALL_MSG 1 =
[DBG] prepend_critical_message: MSG 2 = SSL_CERT CRITICAL *.FQDN.com: Cannot verify certificate: unable to get local issuer certificate, unable to verify the first certificate
[DBG] prepend_critical_message: CRITICAL_MSG 2 = SSL_CERT CRITICAL *.FQDN.com: Cannot verify certificate: unable to get local issuer certificate, unable to verify the first certificate
[DBG] prepend_critical_message: ALL_MSG 2 =
[DBG] SSL_CERT CRITICAL *.FQDN.com: Cannot verify certificate: unable to get local issuer certificate, unable to verify the first certificate
[DBG] CRITICAL <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
[DBG] openssl_version 1.1.0
[DBG] Checking if OpenSSL version is at least 1.1.0 ( '1' '1' '0' ':0' )
[DBG] openssl version: OpenSSL 1.1.1k 25 Mar 2021
[DBG] Current version 1.1.1k ( '1' '1' '1' 'k:107' )
[DBG] true
[DBG] Checking Signed Certificate Timestamps (SCTs)
[DBG] cleaning up temporary files
[DBG]
[DBG] /tmp/1Am4N3
[DBG] /tmp/51JTx2
[DBG] /tmp/IxHNT6
[DBG] /tmp/X7HV7B
[DBG] /tmp/MW1SkJ
[DBG] /tmp/6yr0ZC
[DBG] /tmp/0sf9XU
[DBG] /tmp/xADOrw
[DBG] exiting with CRITICAL
[DBG] ALL_MSG =
[DBG] SSL_CERT CRITICAL *.FQDN.com: Cannot verify certificate: unable to get local issuer certificate, unable to verify the first certificate
[DBG] number of errors = 1

[matteocorti]

First of all use the latest version of the plugin and if you hide your URL I can't really test and help ...