Zimbra error 20 at 0 depth lookup unable to get local issuer certificate

i created a PEM certificate from a PFX certificate and wanted to verify it.
However i ran into this issue, try to find some answers, but i didnt and therefore i dont know how to fix it.
could you please advice?
thank you very much.

C:OpenSSL-Win32bin>set OPENSSL_CONF=C:OpenSSL-Win32binopenssl.cfg

C:OpenSSL-Win32bin>openssl
OpenSSL> verify C:mycert.pem
C:mycert.pem: C = CZ, ST = Sprava zakladnich registru, L = "Obec=Praha,Ulice=Na Vapence,PSC=13000", O = 72054506, OU = 4333, CN = tstcawilly.szr.local
error 20 at 0 depth lookup:unable to get local issuer certificate
error in verify
OpenSSL>
OpenSSL> verify -CAfile C:mycert.pem C:mycert.pem
C:mycert.pem: C = CZ, ST = Sprava zakladnich registru, L = "Obec=Praha,Ulice=Na Vapence,PSC=13000", O = 72054506, OU = 4333, CN = tstcawilly.szr.local
error 20 at 0 depth lookup:unable to get local issuer certificate
error in verify
OpenSSL>

I also had problems using the openssl verify command properly. So I also got the error:
«error 20 at 0 depth lookup:unable to get local issuer certificate»

Here is a short explanation how to use the openssl verify command correctly if you have a certificate chain with multiple intermediate certificates (more than 2 certificates).

Lets imagine we have following certificate chain:
my_root_ca.crt > my_intermediate_ca1.crt > my_intermediate_ca2.crt > leaf_cert.crt

openssl verify -CAfile my_root_ca.crt -untrusted all_my_intermediate_ca.crt leaf_cert.crt

my_root_ca.crt: This is the root certificate (self-signed)

all_my_intermediate_ca.crt: This file must include both intermediate certificates (my_intermediate_ca1.crt & my_intermediate_ca2.crt)

leaf_cert.crt: This is the actual certificate that gets verified.

So this would also work if you have more than two intermediate certificates. But you must include them all in one file.

answered Sep 9, 2021 at 10:08

I discovered two potential issues you might face.

Potential issue 1.
The intermediate certificates might give you an issue.

When verifying our new QSeal certificate (in PEM format) against multiple intermediate certificates, I used option -untrusted for each intermediate certificate.
Here follows an example on MacOS / Linux.

openssl verify -verbose -CAfile ./quovadis_root_ca1g3.pem -untrusted ./quovadis_quovadisenterprisetrustca1g3.pem -untrusted ./quovadis_quovadiseuissuingcertificationauthorityg4.pem ./qseal_new.crt

Output is now

./qseal_new.crt: OK

Potential issue 2.
I get keeping this issue when using LibreSSL, even when fixing the intermediate certificate issue. Switching to OpenSSL solved it. I am aware that you use Windows, but others might encounter this issue when using an OpenSSL alternative.

answered Sep 9, 2021 at 10:33

Any solutions?

Hi Ace Suares,

This problem is common, you need to ask to your provider for the:

• Root CA
• Intermediate CA

A new ones, if your SSL has more than 3 months, probably the root and the Intermediate CA changed, contact with your SSL provider and ask them for a new ones, mix both in a file called commercial_ca.crt and try again, really, this problem is always the same.

Best regards

That tends to be the error if you don’t have a complete chain in your cert. If it helps these are the steps I use to deploy our wildcard cert (comodo this time):

cat ComodoRSAca_ROOT.crt ComodoRSAca_inter1.crt ComodoRSAOrgValidationca_inter2.crt > ca_bundle.crt
sudo cp ca_bundle.crt /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt
sudo /opt/zimbra/bin/zmcertmgr verifycrt comm ./star.domain.com.key ./star.domain.com.crt
sudo cp star.domain.com /opt/zimbra/ssl/zimbra/commercial/commercial.key
sudo /opt/zimbra/bin/zmcertmgr deploycrt comm star.domain.com.crt ca_bundle.crt
sudo /opt/zimbra/bin/zmcertmgr viewdeployedcrt

-Aaron

Thanks for the answer. The intermediate CA I am using is https://search.thawte.com/library/VERISIGN/ALL_OTHER/thawte%20ca/SSL_CA_Bundle.pem, and Thawte also says to download these two: https://search.thawte.com/support/ssl-digital-certificates/index?page=content&id=AR1373&actp=LIST&viewlocale=en_US

So, the last two are the Root CA’s if I understand correctly, and the first is the intermediate CA… ?

And then what to do with it? Combine them all i one file? I have no clue.

The certifcate (key + crt + SSL_CA_Bundle.pem) works fine on Apache but not on Zimbra. Where do I put the Root CA’s?

FINALLY! Thawte sent me tow new CA’s (the ‘root’ and the ‘secondaryca_g2’ and I combined them in a file (first the secondary then the root) and the resulting intermediate works.

——BEGIN CERTIFICATE——

MIIEsjCCA5qgAwIBAgIQFofWiG3iMAaFIz2/Eb9llzANBgkqhkiG9w0BAQsFADCB

qTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf

{snip}

A3nIuUxnYQSgiyf/WQDrVX/GtzM1LV5OrLjqEsXo97mrvnSSLLfZTcqELxzC8HJ8

sjFuz4DliAc2UXu6Ya9tjSNbNKOVvKIxf/L157fo78S1JzLp955pxyvovrsMqufq

YBLqJop4

——END CERTIFICATE——

——BEGIN CERTIFICATE——

MIIEIDCCAwigAwIBAgIQNE7VVyDV7exJ9C/ON9srbTANBgkqhkiG9w0BAQUFADCB

qTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf

{snip}

LHbTY5xZ3Y+m4Q6gLkH3LpVHz7z9M/P2C2F+fpErgUfCJzDupxBdN49cOSvkBPB7

jVaMaA==

——END CERTIFICATE——

Hello. I have a problem

In our company we have zimbra zcs 8.5.0 server.

A few months ago I installed commercial certificate. Now certificate expired and we buy the new, but I have the error: error 2 at 3 depth lookup:unable to get issuer certificate.

Amazing is that when I was verify this command cert is: openssl verify -CAfile ca_bundle.crt usdk.crt

usdk.crt: OK

when I use: /opt/zimbra/openssl/bin/openssl verify -CAfile ca_bundle.crt usdk.crt

error 2 at 3 depth lookup:unable to get issuer certificate

Where is problem? In zimbra openssl or in certs.

i created a PEM certificate from a PFX certificate and wanted to verify it.
However i ran into this issue, try to find some answers, but i didnt and therefore i dont know how to fix it.
could you please advice?
thank you very much.

C:OpenSSL-Win32bin>set OPENSSL_CONF=C:OpenSSL-Win32binopenssl.cfg

C:OpenSSL-Win32bin>openssl
OpenSSL> verify C:mycert.pem
C:mycert.pem: C = CZ, ST = Sprava zakladnich registru, L = "Obec=Praha,Ulice=Na Vapence,PSC=13000", O = 72054506, OU = 4333, CN = tstcawilly.szr.local
error 20 at 0 depth lookup:unable to get local issuer certificate
error in verify
OpenSSL>
OpenSSL> verify -CAfile C:mycert.pem C:mycert.pem
C:mycert.pem: C = CZ, ST = Sprava zakladnich registru, L = "Obec=Praha,Ulice=Na Vapence,PSC=13000", O = 72054506, OU = 4333, CN = tstcawilly.szr.local
error 20 at 0 depth lookup:unable to get local issuer certificate
error in verify
OpenSSL>

I also had problems using the openssl verify command properly. So I also got the error:
«error 20 at 0 depth lookup:unable to get local issuer certificate»

Here is a short explanation how to use the openssl verify command correctly if you have a certificate chain with multiple intermediate certificates (more than 2 certificates).

Lets imagine we have following certificate chain:
my_root_ca.crt > my_intermediate_ca1.crt > my_intermediate_ca2.crt > leaf_cert.crt

openssl verify -CAfile my_root_ca.crt -untrusted all_my_intermediate_ca.crt leaf_cert.crt

my_root_ca.crt: This is the root certificate (self-signed)

all_my_intermediate_ca.crt: This file must include both intermediate certificates (my_intermediate_ca1.crt & my_intermediate_ca2.crt)

leaf_cert.crt: This is the actual certificate that gets verified.

So this would also work if you have more than two intermediate certificates. But you must include them all in one file.

answered Sep 9, 2021 at 10:08

I discovered two potential issues you might face.

Potential issue 1.
The intermediate certificates might give you an issue.

When verifying our new QSeal certificate (in PEM format) against multiple intermediate certificates, I used option -untrusted for each intermediate certificate.
Here follows an example on MacOS / Linux.

openssl verify -verbose -CAfile ./quovadis_root_ca1g3.pem -untrusted ./quovadis_quovadisenterprisetrustca1g3.pem -untrusted ./quovadis_quovadiseuissuingcertificationauthorityg4.pem ./qseal_new.crt

Output is now

./qseal_new.crt: OK

Potential issue 2.
I get keeping this issue when using LibreSSL, even when fixing the intermediate certificate issue. Switching to OpenSSL solved it. I am aware that you use Windows, but others might encounter this issue when using an OpenSSL alternative.

answered Sep 9, 2021 at 10:33