Tools

“Unable to Get Local Issuer Certificate” Error when using "openssl s_client -connect <url>:443 -showcerts" command in Serv-U

When connecting to Serv-U using the OpenSSL command openssl s_client -connect <url>:443 -showcerts, the error “unable to get local issuer certificate” may occur. This indicates that Serv-U is not presenting a complete and trusted SSL certificate chain during the TLS handshake.

First published date

1/27/2026 12:22 PM

Last published date

1/27/2026 4:24 PM

Overview

The OpenSSL -showcerts option displays all certificates presented by the server during the SSL/TLS handshake. For certificate validation to succeed, Serv-U must present the server certificate along with all required intermediate Certificate Authority (CA) certificates. If the certificate chain is incomplete or not correctly recognized by Serv-U, OpenSSL cannot establish a trusted chain to the issuing CA and returns the error.

Product section

Serv-U Managed File Transfer & Serv-U FTP Server

Cause

This issue is caused by an incomplete or improperly configured SSL certificate chain in Serv-U. Although a valid signed server certificate may be configured, missing or unconfigured intermediate CA certificates prevent OpenSSL from validating the certificate chain when using the -showcerts option.

Error:

Resolution

  • Configure the full certificate chain in the CA option in Serv-U, ensuring it matches the chain configured in the Certificate Path.
  • Re-test the connection using
    openssl s_client -connect <url>:443 -showcerts
    to confirm the error is resolved.

Once the full certificate chain is properly configured and recognized by Serv-U, OpenSSL successfully displays the certificate chain without returning the error.