# GeoTrust Global CA not supported?

**URL:** <https://forums.suse.com/t/geotrust-global-ca-not-supported/2260>\
**Category:** Rancher 1.x\
**Created:** [March 31, 2016, 8:10pm UTC](https://forums.suse.com/t/geotrust-global-ca-not-supported/2260 "2016-03-31T20:10:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JD\_Trout](https://avatars.discourse-cdn.com/v4/letter/j/82dd89/32.png) [@JD\_Trout](https://forums.suse.com/u/JD_Trout)\
**Post date:** [March 31, 2016, 8:10pm UTC](https://forums.suse.com/t/geotrust-global-ca-not-supported/2260/1 "2016-03-31T20:10:30Z")

</div>

I setup a rancher server behind an AWS ELB with SSL. I followed the instructions on the basic-ssl-config page. Accessing rancher via the web browser works fine and looking in the console I even see a socket open, so I am fairly confident the config on the ELB is correct. The issue is when trying to add an agent I keep getting the following error:

`ERROR: https://rancher.myhost.com/v1 is not accessible`

Running a curl request gives me the following error:  
`SSL certificate problem: unable to get local issuer certificate`

If I run the same curl request with the --insecure option I get the proper response. What is odd to me is the root CA for my cert is GeoTrust Global CA, which is very common and included in the standard Ubuntu CA bundle.

`root@1817a11c1c05:/# ls /etc/ssl/certs | grep GeoTrust GeoTrust_Global_CA.pem`

I would also like to note that the cert is a wildcard cert and running the curl request from my Mac works without needing the --insecure option.

Any insight would be greatly appreciated.

Thanks!

---

<div class="post-metadata">

**Author:** ![vincent](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/vincent/32/7156_2.png) [@vincent](https://forums.suse.com/u/vincent)\
**Post date:** [March 31, 2016, 8:30pm UTC](https://forums.suse.com/t/geotrust-global-ca-not-supported/2260/2 "2016-03-31T20:30:56Z")

</div>

The agent image is also Ubuntu, so my guess would be your cert is signed by an intermediate cert that is not being sent. And that intermediate may happens to be in browser/Mac OS stores so it still validates there, but not be present in Ubuntu 14.04. You can go to a host and try:

```auto
docker run --entrypoint openssl rancher/agent:v0.11.0 s_client -CApath /etc/ssl/certs/ -connect rancher.myhost.com:443

```

---

<div class="post-metadata">

**Author:** ![JD\_Trout](https://avatars.discourse-cdn.com/v4/letter/j/82dd89/32.png) [@JD\_Trout](https://forums.suse.com/u/JD_Trout)\
**Post date:** [March 31, 2016, 8:56pm UTC](https://forums.suse.com/t/geotrust-global-ca-not-supported/2260/3 "2016-03-31T20:56:52Z")

</div>

Thanks for such a quick response.

Your right, looks like the issue is with rapidssl

`OU = See www.rapidssl.com/resources/cps (c)15, OU = Domain Control Validated - RapidSSL(R), CN = *.myhost.com verify error:num=20:unable to get local issuer certificate`

I tried to install the Intermediate cert on the container, but still received the error.

---

<div class="post-metadata">

**Author:** ![denise](https://avatars.discourse-cdn.com/v4/letter/d/82dd89/32.png) [@denise](https://forums.suse.com/u/denise)\
**Post date:** [March 31, 2016, 9:29pm UTC](https://forums.suse.com/t/geotrust-global-ca-not-supported/2260/4 "2016-03-31T21:29:39Z")

</div>