How to fix SSL unable to verify the first certificate

Fix_SSL_unable_to_verify_the_first_certificate.md

Open an ssl connection to site

openssl s_client -connect client-cert-missing.badssl.com:443

returns

.
.
.
---
Certificate chain
 0 s:/C=US/ST=California/L=San Francisco/O=BadSSL Fallback. Unknown subdomain or no SNI./CN=badssl-fallback-unknown-subdomain-or-no-sni
   i:/C=US/ST=California/L=San Francisco/O=BadSSL/CN=BadSSL Intermediate Certificate Authority
---
.
.
.
Verify return code: 21 (unable to verify the first certificate)

Even though the intermediate certificate is missing, browsers can still show no problems with https://client-cert-missing.badssl.com: but tools like curl, java.... will report that they're unable to find valid certification path to requested target.

To fix, you have two options

• find and add the intermediate certificate that https://client-cert-missing.badssl.com use to your keystore

  # add to ubuntu keystore
  sudo cp COMODORSADomainValidationSecureServerCA.crt /usr/local/share/ca-certificates/COMODORSADomainValidationSecureServerCA.crt
  sudo update-ca-certificates
  # add to java keystore
  sudo keytool -importcert -alias COMODORSADomainValidationSecureServerCA -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -file COMODORSADomainValidationSecureServerCA.crt

• Or update your webserver to send the full chain of certificates not just the leaf chain

  https://nginx.org/en/docs/http/configuring_https_servers.html

  Some browsers may complain about a certificate signed by a well-known certificate authority, while other browsers may accept the certificate without issues. This occurs because the issuing authority has signed the server certificate using an intermediate certificate that is not present in the certificate base of well-known trusted certificate authorities which is distributed with a particular browser. In this case the authority provides a bundle of chained certificates which should be concatenated to the signed server certificate. The server certificate must appear before the chained certificates in the combined file:

      $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt
  

  The resulting file should be used in the ssl_certificate directive:

      server {
          listen              443 ssl;
          server_name         www.example.com;
          ssl_certificate     www.example.com.chained.crt;
          ssl_certificate_key www.example.com.key;
          ...
      }