# Mender client rejects the server certificate of mTLS ambassador with Error: "certificate signed by unknown authority, openssl verify rc: 20" **URL:** \ **Category:** General Discussions\ **Tags:** mtls, ambassador\ **Created:** [November 18, 2022, 9:10am UTC](https://hub.mender.io/t/mender-client-rejects-the-server-certificate-of-mtls-ambassador-with-error-certificate-signed-by-unknown-authority-openssl-verify-rc-20/5420 "2022-11-18T09:10:15Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![shaomai](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@shaomai](https://hub.mender.io/u/shaomai)\ **Post date:** [November 18, 2022, 9:10am UTC](https://hub.mender.io/t/mender-client-rejects-the-server-certificate-of-mtls-ambassador-with-error-certificate-signed-by-unknown-authority-openssl-verify-rc-20/5420/1 "2022-11-18T09:10:15Z")
Hello everyone, I am testing the mTLS feature with following use case: 1. using [https://hosted.mender.io](https://hosted.mender.io) as mender server 2. hosting mTLS ambassador locally in virtual machine with ip address `192.168.3.30` and domain name [my-server.com](http://my-server.com) 3. mender-client running on raspberrypi4 and can connect to [my-server.com](http://my-server.com) with `ping my-server.com` and have internet access. The mTLS ambassador connects with [https://hosted.mender.io](https://hosted.mender.io) successfully with the credentials of the hosted mender. I followed the section [mutual-tls-authentication](https://docs.mender.io/3.4/server-integration/mutual-tls-authentication) creates CA certificate, server certificate with `commenName` [my-servver.com](http://my-servver.com) and device certificate. The server certificate and device certificate are signed by the CA certificate. After starting the mender client, I got the following error: ```auto raspberrypi mender[23544]: time="2022-11-17T23:25:25+01:00" level=error msg="Failure occurred while executing authorization request: Method: Post, URL: https://my-server.com/api/devices/v1/authentication/auth_requests" raspberrypi mender[23544]: time="2022-11-17T23:25:25+01:00" level=error msg="Failed to authorize with \"https://my-server.com\": Unknown url.Error type: certificate signed by unknown authority, openssl verify rc: 20 server cert file:" ``` It seems that client device rejects the server certificate. I checked the [Troubleshooting](https://docs.mender.io/3.4/troubleshoot/mender-client) section of mender client and did the following things: 1. add server certificate of mTLS ambassador to client by specifying “ServerCertificate” in `mender.conf` → still the same error but with server cert file path: 2. checking the public certificate of [my-server.com](http://my-server.com) and comparing it with `home/pi/server-cert.crt" by following commands: 3. I added ca-certificate which is used to sign the server and device certificates to the path of client `/usr/share/ca-certificates/` → still the same error. Here is my understanding of mender mTLS ambassador: The client device should connect to mTLS ambassador and they verify each other’s certificates. When the verification is successful, mTLS will preauthorize the device in the [https://hosted.mender.io](https://hosted.mender.io). My question is: 1. Is my understanding of mender mTLS wrong? 2. Which steps should I follow to debug this error? Thanks a lot for reading and answering my question! Best regards. ---
**Author:** ![nareshtech20](https://avatars.discourse-cdn.com/v4/letter/n/46a35a/32.png) [@nareshtech20](https://hub.mender.io/u/nareshtech20)\ **Post date:** [June 28, 2023, 6:16am UTC](https://hub.mender.io/t/mender-client-rejects-the-server-certificate-of-mtls-ambassador-with-error-certificate-signed-by-unknown-authority-openssl-verify-rc-20/5420/2 "2023-06-28T06:16:44Z")
facing same issue, what is the solution ? ---
**Author:** ![ebesas](https://avatars.discourse-cdn.com/v4/letter/e/bbe5ce/32.png) [@ebesas](https://hub.mender.io/u/ebesas)\ **Post date:** [April 18, 2024, 5:37am UTC](https://hub.mender.io/t/mender-client-rejects-the-server-certificate-of-mtls-ambassador-with-error-certificate-signed-by-unknown-authority-openssl-verify-rc-20/5420/3 "2024-04-18T05:37:19Z")
Hi, I am currently experiencing the same issue. I specified the server certificate in mender conf and confirmed that the certs in the server and the one in the device are the same, based on the instructions from the [Troubleshooting](https://docs.mender.io/troubleshoot/mender-client#certificate-signed-by-unknown-authority) Is there a resolution to this? Cheers! ---
**Author:** ![ebesas](https://avatars.discourse-cdn.com/v4/letter/e/bbe5ce/32.png) [@ebesas](https://hub.mender.io/u/ebesas)\ **Post date:** [April 23, 2024, 10:46pm UTC](https://hub.mender.io/t/mender-client-rejects-the-server-certificate-of-mtls-ambassador-with-error-certificate-signed-by-unknown-authority-openssl-verify-rc-20/5420/4 "2024-04-23T22:46:30Z")
I was able to make this work. It seems that the `mender-client` in the device also verifies the integrity of the server certificate. In the `ServerCertificate` parameter in mender.conf, I placed the location of the `ca.crt` instead and it worked. Even though that’s the case, I emailed Mender support to verify this workflow. ---
**Author:** ![ebesas](https://avatars.discourse-cdn.com/v4/letter/e/bbe5ce/32.png) [@ebesas](https://hub.mender.io/u/ebesas)\ **Post date:** [April 26, 2024, 12:50am UTC](https://hub.mender.io/t/mender-client-rejects-the-server-certificate-of-mtls-ambassador-with-error-certificate-signed-by-unknown-authority-openssl-verify-rc-20/5420/5 "2024-04-26T00:50:44Z")
I have confirmed with Mender support that this approach is valid. It is either: 1. Specify the self-signed certificate of the CA in `mender.conf` in the device to verify the server/mTLS proxy or, 2. Add the server certificate to the list of trusted certificates on the system: ```auto scp -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -P 8822 ca.crt root@$CONTAINER_IP:/usr/local/share/ca-certificates/mender/ca.crt ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p 8822 root@$CONTAINER_IP update-ca-certificates ```