title: OpenSSL unable to get local issuer Cert Return Code 20
body: <p>Whenever I try to connect to Google (or any other site) using OpenSSL with the following command:</p>
  <pre><code>s_client -connect google.com:443 -showcerts
  </code></pre>
  <p>I get the following error:</p>
  <blockquote>
  <p>.....</p>
  <p>Verify return code: 20 (unable to get local issuer certificate)</p>
  </blockquote>
  <p>I do have the right CA installed. I also tried Exporting the CA and using it with -CAfile,
  but I still get the same error.</p>
  <p>I exported the CAs as PKCS#12 using certmgr.msc.
  Afterwards I converted them to a .pem file using:</p>
  <pre><code>OpenSSL&gt; pkcs12 -in D:/Certs/RootCertsNewu.pfx -clcerts -nokeys -out D:/Certs/Roo
  tCertsNew.pem
  </code></pre>
  <p>Using that I tried to connect againt:</p>
  <pre><code>OpenSSL&gt; s_client -connect google.com:443 -CAfile D:\Certs\RootCertsNew.pem
  </code></pre>
  <p>But I got the same response as before.
  I also read, that this could have something to do with the Intermediate CA, so I created a .pem file with the CA and the intermediate CA. That didn't work either. Can someone help me?</p>
  <p>Also somehow the verification progress seems to start with GeoTrust, not Equifax, as supposed.</p>
  <pre><code>OpenSSL&gt; s_client -connect google.com:443 -showcerts -CAfile D:\Certs\google-ca.
  pem
  Loading 'screen' into random state - done
  CONNECTED(0000017C)
  depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
  verify error:num=20:unable to get local issuer certificate
  verify return:0
  ---
  </code></pre>