Skip to content
Errors
Commands
Flags
Config
Cheat sheets
Changes
Compat
Codes
Compare
Glossary
Search
Ctrl K
Browse
Error Messages
Commands
Flags & Options
Config Reference
Cheat Sheets
Version Changes
Compatibility
Codes & Tables
X vs Y
Glossary
All tools
Home
Tools
OpenSSL
Networking & security
OpenSSL
TLS toolkit and crypto CLI.
Official documentation
Errors
1
Commands
1
Flags
1
Cheat sheets
1
Changes
1
Compat
1
Codes
1
Glossary
1
unable to get local issuer certificate (OpenSSL verify error 20)
OpenSSL error 20, unable to get local issuer certificate, means the issuing CA is missing from the trust store or the chain. Add the CA or intermediate.
All OpenSSL error messages
openssl req -x509: create a self-signed certificate
Create a self-signed certificate and key in one step with openssl req -x509 -newkey ec -nodes -keyout key.pem -out cert.pem -days 365, plus -subj and SAN.
All OpenSSL commands
openssl s_client -servername: test TLS with SNI
openssl s_client -connect host:443 -servername host sends SNI so the server returns the right certificate. Add -brief for a summary or -showcerts for the chain.
All OpenSSL flags & options
OpenSSL cheat sheet: keys, CSRs, certificates and TLS checks
OpenSSL cheat sheet: generate keys and CSRs, inspect certificates, check that key and certificate match, convert PEM, DER and PFX, verify chains and test TLS.
All OpenSSL cheat sheets
OpenSSL 3.x to 4.0: removed features and breaking changes
OpenSSL 4.0 removes engines, SSLv3, the SSLv2 Client Hello and c_rehash, makes ASN1_STRING opaque, adds const to many APIs, and changes hex dump output format.
All OpenSSL version changes
OpenSSL version support: LTS and end-of-life dates
OpenSSL support in October 2026: 3.5 is LTS until 2030-04-08, 4.0 until 2027-05-14, 3.6 until 2026-11-01, 3.4 until 2026-10-22; 3.0 and 1.1.1 have ended.
All OpenSSL compatibility
OpenSSL verify error codes: 2, 10, 18, 19, 20, 21, 62
OpenSSL X509 verify errors explained: 10 certificate has expired, 18 self-signed, 19 self-signed in chain, 20 unable to get local issuer, 62 hostname mismatch.
All OpenSSL codes & tables
What is a certificate chain (chain of trust)?
A certificate chain links a server leaf certificate through intermediate CAs to a trusted root. Clients verify each signature up to a root in their trust store.
All OpenSSL glossary
Esc