title: How to fix "SSL certificate problem: self signed certificate in certificate chain" error?
body: <p>I have a Linux-based Docker container, where if I do:</p>
  
  <pre><code>curl https://google.com
  </code></pre>
  
  <p>...then I get an error:</p>
  
  <blockquote>
    <p>curl: (60) SSL certificate problem: self signed certificate in certificate chain
    More details here: <a href="https://curl.haxx.se/docs/sslcerts.html" rel="noreferrer">https://curl.haxx.se/docs/sslcerts.html</a></p>
  </blockquote>
  
  <p>The same happens for any URL - it's not Google that's at fault.</p>
  
  <p>The link referenced above suggests various solutions, none of which seem appropriate apart from perhaps the last one, which suggests updating the certificate store. But there are no instructions on how to do that (or at least, none that make sense to me).</p>
  
  <p>Is that the right thing to do, and if so how?</p>
  
  <hr>
  
  <p><strong>UPDATE</strong>: as requested, here's the result of:</p>
  
  <pre><code>openssl s_client -showcerts -connect www.google.com:443
  
  CONNECTED(00000003)
  depth=3 DC = com, DC = forestroot, CN = SHA256RootCA
  verify error:num=19:self signed certificate in certificate chain
  ---
  Certificate chain
   0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com
     i:/CN=ssl-decrypt
  -----BEGIN CERTIFICATE-----
  MIIDXzCCAkegAwIBAgIIXIk3p8xOX/kwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UE
  AxMLc3NsLWRlY3J5cHQwHhcNMTgxMjE5MDgxNzAwWhcNMTkwMzEzMDgxNzAwWjBo
  ...
  tq0VAGIoj4+YhO6bktTq3alCRoLstJuuxjVdb1wRkH4YRi0I6ZAB1Cw+M8Lg+2eQ
  KuEo
  -----END CERTIFICATE-----
   1 s:/CN=ssl-decrypt
     i:/DC=com/DC=bgs/CN=SHA256IssueCA
  -----BEGIN CERTIFICATE-----
  MIIGzDCCBLSgAwIBAgITEQAADvB9T7mSaacwDQABAAAO8DANBgkqhkiG9w0BAQsF
  ADBCMRMwEQYKCZImiZPyLGQBGRYDY29tMRMwEQYKCZImiZPyLGQBGRYDYmdzMRYw
  ...
  1z9f/nkj2XTRyGeACoy0qRd5uXJHp1iGM27l3RFDR9OjrfPV56pOBUYWAlc9Nn+1
  Vr3qUZrcCkROrmYisVF4jg==
  -----END CERTIFICATE-----
   2 s:/DC=com/DC=MyCompanyServer/CN=SHA256IssueCA
     i:/DC=com/DC=MyCompanyServer/CN=SHA256RootCA
  -----BEGIN CERTIFICATE-----
  MIIH4zCCBcugAwIBAgITOQAAAAOa4wv9nnK0uQAAAAAAAzANBgkqhkiG9w0BAQsF
  ADBIMRMwEQYKCZImiZPyLGQBGRYDY29tMRowGAYKCZImiZPyLGQBGRYKZm9yZXN0
  ...
  IomErcbcymIWBmN75PVMsk9EMyqDP394jG8+IOK+lVUVX4pxzhdd7eYbqTAwDE1X
  bNWcZZkt/w==
  -----END CERTIFICATE-----
   3 s:/DC=com/DC=MyCompanyServer/CN=SHA256RootCA
     i:/DC=com/DC=MyCompanyServer/CN=SHA256RootCA
  -----BEGIN CERTIFICATE-----
  MIIFgzCCA2ugAwIBAgIQULxmYXGJ1aFIlIyCHA4NIzANBgkqhkiG9w0BAQsFADBI
  MRMwEQYKCZImiZPyLGQBGRYDY29tMRowGAYKCZImiZPyLGQBGRYKZm9yZXN0cm9v
  ...
  jQBLY0/KIjHywv66GhtVWpexgQcXrLxQP2VHW7eXpsylvwkNU5XNQYzHTB7u+w5C
  VunfRLt/7mVWyURcwkOre38tVSByKR4=
  -----END CERTIFICATE-----
  ---
  Server certificate
  subject=/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com
  issuer=/CN=ssl-decrypt
  ---
  No client certificate CA names sent
  Peer signing digest: SHA256
  Server Temp Key: ECDH, P-256, 256 bits
  ---
  SSL handshake has read 6556 bytes and written 302 bytes
  Verification error: self signed certificate in certificate chain
  ---
  New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
  Server public key is 2048 bit
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : ECDHE-RSA-AES128-GCM-SHA256
      Session-ID: 723D9976F985887CA5F256EE3C2E7B44B9C98A6B440AAF4E19564AE101F78D00
      Session-ID-ctx:
      Master-Key: C3D8759A753C1D269FF9C00854E59B8C10ABC1E94AFE9F0166486A649FE295ACE1AF5E5BEDB0129E557E781BC860D2FA
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1548690163
      Timeout   : 7200 (sec)
      Verify return code: 19 (self signed certificate in certificate chain)
      Extended master secret: yes
  ---
  read:errno=0
  </code></pre>
  
  <p>What I gather from this is that there's certificate in this chain belonging to the company I'm working for (which I've renamed MyCompanyServer), and I imagine that's the issue.</p>
  
  <p>Am I right in thinking that I need to install some sort of key for that certificate? This is all greek to me, so apologies for the newbie questions.</p>