ONTAP S3 "unable to get local issuer certificate" error with third party intermediate certificate chain

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 2,745

Visibility:: Public

Votes:: 3

Category:: ontap-9

Specialty:: CORE

Last Updated:

Applies to

ONTAP S3
Signed Certificate
ONTAP 9.7 to 9.11.1

Issue

When using third party signed certificate chain, ONTAP S3 server doesn't send the whole chain and therefore verification fails:

# curl -I https://<URL/ -v * Expire in 0 ms for 6 (transfer 0x5623be65fdd0) ... * Expire in 0 ms for 1 (transfer 0x5623be65fdd0) * Trying 172.16.XX.XX... * TCP_NODELAY set * Expire in 200 ms for 4 (transfer 0x5623be65fdd0) * Connected to s3.local (172.16.XX.XX) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (OUT), TLS alert, unknown CA (560): * SSL certificate problem: unable to get local issuer certificate * Closing connection 0 curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.