/codes /openssl/openssl-verify-error-codes

OpenSSL verify error codes: 2, 10, 18, 19, 20, 21, 62

updated 2026-10-20

tool: OpenSSL
versions: OpenSSL 1.1.1, OpenSSL 3.x
os: any

When OpenSSL rejects a certificate it reports error N at D depth lookup: <reason>, where N is the X509_V_ERR_* code and D the position in the chain (0 is the server's own certificate). The codes you will meet most are 10 (expired), 18 (self-signed), 19 (self-signed in chain), 20 (issuer not found) and 62 (host name mismatch).

Common codes

Code	Constant	Message	Usual fix
2	X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT	unable to get issuer certificate	add the missing intermediate
9	X509_V_ERR_CERT_NOT_YET_VALID	certificate is not yet valid	check the system clock
10	X509_V_ERR_CERT_HAS_EXPIRED	certificate has expired	renew the certificate
18	X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT	self-signed certificate	trust it explicitly or use a CA-signed one
19	X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN	self-signed certificate in certificate chain	add the private root CA to the trust store
20	X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY	unable to get local issuer certificate	add the CA, or send the full chain
21	X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE	unable to verify the first certificate	the server must send its intermediates
62	X509_V_ERR_HOSTNAME_MISMATCH	hostname mismatch	certificate SAN must contain the host name

See 18, 10 and 20 happen

bash

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout ca.key -out ca.pem -subj "/CN=Test CA" -days 30 2>/dev/null
openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout leaf.key -out leaf.csr -subj "/CN=app.example.test" 2>/dev/null
openssl x509 -req -in leaf.csr -CA ca.pem -CAkey ca.key -out expired.pem -not_before 20200101000000Z -not_after 20200201000000Z 2>/dev/null
openssl x509 -req -in leaf.csr -CA ca.pem -CAkey ca.key -out leaf.pem -days 10 2>/dev/null
openssl verify ca.pem 2>&1 | grep '^error 18'
openssl verify -CAfile ca.pem expired.pem 2>&1 | grep '^error 10'
openssl verify leaf.pem 2>&1 | grep '^error 20'
openssl verify -CAfile ca.pem leaf.pem

Output

error 18 at 0 depth lookup: self-signed certificate
error 10 at 0 depth lookup: certificate has expired
error 20 at 0 depth lookup: unable to get local issuer certificate
leaf.pem: OK

openssl verify exits with status 2 when verification fails. -not_before / -not_after (used above to create an expired certificate) need OpenSSL 3.4 or later.

Sources

errors · opensslunable to get local issuer certificate (OpenSSL verify error 20)OpenSSL error 20, unable to get local issuer certificate, means the issuing CA is missing from the trust store or the chain. Add the CA or intermediate.commands · opensslopenssl req -x509: create a self-signed certificateCreate a self-signed certificate and key in one step with openssl req -x509 -newkey ec -nodes -keyout key.pem -out cert.pem -days 365, plus -subj and SAN.glossary · opensslWhat is a certificate chain (chain of trust)?A certificate chain links a server leaf certificate through intermediate CAs to a trusted root. Clients verify each signature up to a root in their trust store.

Common codes

See 18, 10 and 20 happen

Sources

Related pages