# wget "cannot verify certificate" error: how to fix it safely

> wget cannot verify a site's certificate when the chain is incomplete, the CA bundle is old or a proxy re-signs traffic. Fix the server or set the CA file.

Source: https://ssl.sh/errors/wget-cannot-verify-certificate/
Last updated: 2026-11-10

**`cannot verify example.com's certificate` means wget could not link the server's certificate to any root CA it trusts.** The line after it says why; "Unable to locally verify the issuer's authority" is the most common and points to an incomplete chain on the server or a CA store on your machine that lacks the right root.

## Quick fix

Fix the server if its chain is incomplete; otherwise give wget the right root.

Check whether the server sends a complete chain:

```bash
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null | grep -E "^ *[0-9] s:|Verify return"
```

- **Only certificate `0`:** the server is missing its intermediate; fix the server (see [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/)).
- **Full chain, unfamiliar root (company proxy or internal CA):** trust that root:

```bash
wget --ca-certificate=/path/to/company-root.pem https://example.com/file.tar.gz
```

- **Full chain, public root:** update the CA bundle on this machine.

## Causes

An incomplete server chain, or a client CA store without the right root, causes most failures.

### 1. Incomplete chain on the server

- **Confirm:** `openssl s_client` shows only the leaf and `Verify return code: 21`.
- **Fix:** configure the server with the full chain; the [chain builder](https://ssl.sh/tools/chain-builder/) builds it from the leaf.

### 2. Outdated or missing CA bundle

Old distributions and minimal images may miss newer roots.

- **Confirm:** the same URL works on an up-to-date machine; `wget --version` shows the TLS library, and its CA file is old or absent.
- **Fix:** update `ca-certificates` (`apt-get install --reinstall ca-certificates`, `yum update ca-certificates`).

### 3. Private CA or TLS-inspecting proxy

- **Confirm:** the `issued by` field in the message names your company or a security vendor.
- **Fix:** add the root to the system store (`/usr/local/share/ca-certificates/` + `update-ca-certificates`, or `/etc/pki/ca-trust/source/anchors/` + `update-ca-trust`), or use `--ca-certificate`.

### 4. Self-signed certificate

The message then reads "Self-signed certificate encountered".

- **Fix:** download the certificate once, verify its fingerprint with the owner, and pass it with `--ca-certificate`. Prefer issuing a proper certificate for the server.

### 5. Expired certificate or wrong clock

"Issued certificate has expired" means the date check failed.

- **Fix:** renew on the server, or fix NTP on the client.

### 6. Name mismatch

A separate message, `certificate common name ... doesn't match requested host name`, means the certificate does not list that hostname. Use the right hostname or fix the certificate's [SAN](https://ssl.sh/glossary/san/) list.

## Fixes by environment

Every fix gives wget a current CA bundle that includes any private root, or fixes the server chain.

**Debian / Ubuntu:**

```bash
sudo cp company-root.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
```

**RHEL / CentOS / Rocky:**

```bash
sudo cp company-root.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust
```

**Alpine / BusyBox:** BusyBox `wget` has limited TLS verification support depending on build; install the full `wget` package and `ca-certificates`, or use curl.

**Windows (wget.exe builds):** set `ca_certificate` in a `.wgetrc` next to the executable or in `%HOME%`, pointing at a PEM bundle such as the one from curl.se.

**Installer one-liners:** many projects document `wget -qO- https://... | sh`. If that fails with a certificate error on an old server, update `ca-certificates` first and rerun the same command; never append `--no-check-certificate` to a command whose output you are about to execute.

**Proxies:** wget reads `https_proxy` and `http_proxy`. If a corporate proxy intercepts TLS, trusting its root is still required even when the proxy variables are correct.

**Scripts:** pass `--ca-certificate` explicitly when a script downloads from an internal server, so it does not depend on each machine's store.

## Don't do this

- **`--no-check-certificate` in install scripts.** Many "curl | sh" or "wget | sh" installers become a remote code execution path for anyone on the network.
- **`check_certificate = off` in `/etc/wgetrc`.** It silently disables verification for every user and every download.
- **Switch the URL to `http://`.** You lose both confidentiality and integrity of the download.