title: Self-Signed certificate: openssl 21 (unable to verify the first certificate)
body: <p>I have created a self-signed certificate in <code>azure</code>.</p>
  <p>The certificate is installed on an ubuntu machine.
  Process:</p>
  <pre><code>sudo -s
  cp &lt;cert&gt; /usr/share/ca-certificates
  dpkg-reconfigure ca-certificates
  </code></pre>
  <p><code>dpkg-reconfigure</code> shows gui.</p>
  <p><a href="https://i.stack.imgur.com/2gakU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2gakU.png" alt="enter image description here" /></a></p>
  <p>I select yes to trust the certificate. On the next page, I see a list of certificates. I select my certificate (by pressing <code>space</code> key) and press <code>ok</code> (<code>tab</code> -&gt; <code>enter</code>)</p>
  <p>The certificate is added successfully.</p>
  <p>But when I run <code>openssl s_client -showcerts -connect &lt;server&gt;:&lt;port&gt;</code>, I get <code>Verify return code: 21 (unable to verify the first certificate)</code></p>
  <p>I have tested this localhost (mac OS X). It works after I set <code>Always Trust</code> for <code>When using this certificate</code> under <code>Trust</code> section of the certificate. (Certificate locally is created directly using openssl commands)</p>
  <pre><code>openssl req  -new  -newkey rsa:2048  -nodes  -keyout localhost.key  -out localhost.csr
  openssl  x509  -req  -days 365  -in localhost.csr  -signkey localhost.key  -out localhost.crt
  </code></pre>
  <p>I'm running a Golang server where this certificate is used with the key vai <code>http.ListenAndServeTLS</code> function.</p>
  <p>The process on mac is really simply. Just drag and drop the certificate in the <code>Keychain Access</code> and trust the certificate.</p>
  <p>This is a major blocker for me. I would really appreciate the help.</p>