# Unable to get local issuer certificate

**URL:** <https://forum.ansible.com/t/unable-to-get-local-issuer-certificate/34913>\
**Category:** Ansible Project\
**Tags:** rhel, awx\
**Created:** [April 3, 2021, 8:55pm UTC](https://forum.ansible.com/t/unable-to-get-local-issuer-certificate/34913 "2021-04-03T20:55:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aram](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Aram](https://forum.ansible.com/u/Aram)\
**Post date:** [April 3, 2021, 8:55pm UTC](https://forum.ansible.com/t/unable-to-get-local-issuer-certificate/34913/1 "2021-04-03T20:55:53Z")

</div>

Hi,

I’m running Tower 3.8.2 and Ansible 2.9.18 on RHEL 8 VM. Along side of GitLab 13.10.2 on another VM.

Both instances have a Hashicorp Vault hosted CA and cert applied (GitLab, has a nginx reverse proxy in front of it which is SSL terminated).

However, when adding a new project and add in the git repo where the role is defined (pointing to the local gitlab instance, I run into SSL cert issues.

**“cmd”: “/usr/bin/git clone --origin origin [https://gitlab.basement.lab/ansible/update-and-reboot.git](https://gitlab.basement.lab/ansible/update-and-reboot.git) /var/lib/awx/projects/\_14\_\_update\_and\_reboot”,**

results in:

**‘[https://gitlab.basement.lab/ansible/update-and-reboot.git/](https://gitlab.basement.lab/ansible/update-and-reboot.git/)’: SSL certificate problem: unable to get local issuer certificate\n"**

I have added my ca\_chain.pem to /etc/pki/ca-trust/source/anchors/ and ran the update-ca-trust … the ca\_chain.pem does show in /etc/pki/ca-trust/extracted/openssl.

Is there another step or place where I need to include the CA chain to get git accept the certification WITHOUT having to turn off SSL verification? If I need to turn off SSL I rather do it as a last resort.

Thanks.