Command-line tools
wget "cannot verify certificate" error: how to fix it safely
ERROR: cannot verify example.com's certificate, issued by 'CN=Example Issuing CA': Unable to locally verify the issuer's authority.cannot verify example.com's certificate means wget could not link the server's certificate to any root CA it trusts. The line after it says why; "Unable to locally verify the issuer's authority" is the most common and points to an incomplete chain on the server or a CA store on your machine that lacks the right root.
Quick fix
Fix the server if its chain is incomplete; otherwise give wget the right root.
Check whether the server sends a complete chain:
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null | grep -E "^ *[0-9] s:|Verify return"
- Only certificate
0: the server is missing its intermediate; fix the server (see missing intermediate certificate). - Full chain, unfamiliar root (company proxy or internal CA): trust that root:
wget --ca-certificate=/path/to/company-root.pem https://example.com/file.tar.gz
- Full chain, public root: update the CA bundle on this machine.
Causes
An incomplete server chain, or a client CA store without the right root, causes most failures.
1. Incomplete chain on the server
- Confirm:
openssl s_clientshows only the leaf andVerify return code: 21. - Fix: configure the server with the full chain; the chain builder builds it from the leaf.
2. Outdated or missing CA bundle
Old distributions and minimal images may miss newer roots.
- Confirm: the same URL works on an up-to-date machine;
wget --versionshows the TLS library, and its CA file is old or absent. - Fix: update
ca-certificates(apt-get install --reinstall ca-certificates,yum update ca-certificates).
3. Private CA or TLS-inspecting proxy
- Confirm: the
issued byfield in the message names your company or a security vendor. - Fix: add the root to the system store (
/usr/local/share/ca-certificates/+update-ca-certificates, or/etc/pki/ca-trust/source/anchors/+update-ca-trust), or use--ca-certificate.
4. Self-signed certificate
The message then reads "Self-signed certificate encountered".
- Fix: download the certificate once, verify its fingerprint with the owner, and pass it with
--ca-certificate. Prefer issuing a proper certificate for the server.
5. Expired certificate or wrong clock
"Issued certificate has expired" means the date check failed.
- Fix: renew on the server, or fix NTP on the client.
6. Name mismatch
A separate message, certificate common name ... doesn't match requested host name, means the certificate does not list that hostname. Use the right hostname or fix the certificate's SAN list.
Fixes by environment
Every fix gives wget a current CA bundle that includes any private root, or fixes the server chain.
Debian / Ubuntu:
sudo cp company-root.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
RHEL / CentOS / Rocky:
sudo cp company-root.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust
Alpine / BusyBox: BusyBox wget has limited TLS verification support depending on build; install the full wget package and ca-certificates, or use curl.
Windows (wget.exe builds): set ca_certificate in a .wgetrc next to the executable or in %HOME%, pointing at a PEM bundle such as the one from curl.se.
Installer one-liners: many projects document wget -qO- https://... | sh. If that fails with a certificate error on an old server, update ca-certificates first and rerun the same command; never append --no-check-certificate to a command whose output you are about to execute.
Proxies: wget reads https_proxy and http_proxy. If a corporate proxy intercepts TLS, trusting its root is still required even when the proxy variables are correct.
Scripts: pass --ca-certificate explicitly when a script downloads from an internal server, so it does not depend on each machine's store.
Don't do this
--no-check-certificatein install scripts. Many "curl | sh" or "wget | sh" installers become a remote code execution path for anyone on the network.check_certificate = offin/etc/wgetrc. It silently disables verification for every user and every download.- Switch the URL to
http://. You lose both confidentiality and integrity of the download.
FAQ
Why does curl work but wget fail on the same machine?
They may use different TLS libraries and CA locations. wget is built with GnuTLS on some distributions and OpenSSL on others, and each reads its own default paths. Compare with wget --version and point both at the same bundle if needed.
How do I make the fix permanent?
Add the private root to the system trust store, or put ca_certificate = /path/to/ca-bundle.pem in /etc/wgetrc (all users) or ~/.wgetrc (one user).
The message says "Issued certificate has expired". What now?
The server's certificate, or one in its chain, is past its expiry date, or the client clock is wrong. Check with date -u and the SSL checker; see openssl verify error 10.