# WSL SSL certificate problem: unable to get local issuer certificat **URL:** \ **Category:** Ziti Overlay\ **Created:** [August 13, 2025, 5:55pm UTC](https://openziti.discourse.group/t/wsl-ssl-certificate-problem-unable-to-get-local-issuer-certificat/5001 "2025-08-13T17:55:59Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\ **Post date:** [August 13, 2025, 5:55pm UTC](https://openziti.discourse.group/t/wsl-ssl-certificate-problem-unable-to-get-local-issuer-certificat/5001/1 "2025-08-13T17:55:59Z")
Hey, I have set up Openziti for my homelab with: - Controller/Public Edge Router on the cloud - A SFF running in my home 24/7 with docker (running few containers like Gitea, etc) I’ve successfully managed to configure Ziti Desktop Edge to access my services. For example I can access `[https://git.lan.example.com](https://git.lan.example.com)` from my browser on Windows. But for some reason when I try to `curl [https://git.lan.example.com`](https://git.lan.example.com%60) on WSL I get this error: `curl: (60) SSL certificate problem: unable to get local issuer certificate` `curl [https://git.lan.example.com](https://git.lan.example.com) -k` works perfectly. Any Idea of what I’m missing ? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [August 13, 2025, 6:03pm UTC](https://openziti.discourse.group/t/wsl-ssl-certificate-problem-unable-to-get-local-issuer-certificat/5001/2 "2025-08-13T18:03:23Z")
> [@brandi](#): > > `curl https://git.lan.example.com -k` works perfectly. A more concrete example would be useful but this is a simple certificate issue. Whatever is responding to "[git.lan.example.com](http://git.lan.example.com)" is returning a certificate that is not valid for "[git.lan.example.com](http://git.lan.example.com)". This is common with intrusion detection that does MITM type of activitiy. It's also possible your WSL ca certs are out of date compared to your windows machine. I'd ask GPT or some other LLM this one. Based on what you've shared so far, this doesn't strike me as any sort of OpenZiti problem ---
**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\ **Post date:** [August 13, 2025, 6:24pm UTC](https://openziti.discourse.group/t/wsl-ssl-certificate-problem-unable-to-get-local-issuer-certificat/5001/3 "2025-08-13T18:24:53Z")
The certificate is a Let’s encrypt generated one. When I try to get the certificate using open ssl, It’s not finding any: ```auto ❯ openssl s_client -connect git.lan.example.com:443 -showcerts | grep -E "(BEGIN|END) CERTIFICATE" depth=0 CN = git.lan.example.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = git.lan.example.com verify error:num=21:unable to verify the first certificate verify return:1 -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- ``` I guess that’s not really an Openziti issue, but something might be wrong on my WSL. I’ve already tried gpt and looked into this [Intercept DNS names are not resolving in WSL](https://openziti.discourse.group/t/intercept-dns-names-are-not-resolving-in-wsl/3923) But nothing worked so far 😕 ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [August 13, 2025, 6:28pm UTC](https://openziti.discourse.group/t/wsl-ssl-certificate-problem-unable-to-get-local-issuer-certificat/5001/4 "2025-08-13T18:28:02Z")
Like I said, based on what you're showing/telling me this doesn't seem to me to be an OpenZiti issue. OpenZiti won't modify your packets at all. It's possible you've misconfigured your offload or port. I'd double check your configuration and make sure you're going to the proper server. My expectation is that your os ca certs are out of date. Use an LLM/GPT to find out how to update your WSL instance. Good luck! 🙂 ---
**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\ **Post date:** [August 13, 2025, 6:47pm UTC](https://openziti.discourse.group/t/wsl-ssl-certificate-problem-unable-to-get-local-issuer-certificat/5001/5 "2025-08-13T18:47:15Z")
You’re right. After some back and forth with gpt, I was missing this cert `[https://letsencrypt.org/certs/2024/e6.pem\`](https://letsencrypt.org/certs/2024/e6.pem%5C%60)