SSL: CERTIFICATE_VERIFY_FAILED - certificate verify failed: unable to get local issuer certificate

Troubleshooting
1

CMK version: 2.4.0p23**.**
OS version:17.7.16

Error message:

Version: 2.4.0p17, OS: linux, Update error: HTTPSConnectionPool(host=‘xxx’, port=443): Max retries exceeded with url: /prod/check_mk/deploy_agent.py (Caused by SSLError(SSLCertVerificationError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)’)))WARN, Last update: 2026-03-09 13:41:07, Agent plug-ins: 2, Local checks: 0

Hello forum,

We exchanged the CheckMK website certificate via Webconf/Web Access.

This all worked without any problems and the site is now delivered with the new certificate. Unfortunately, since then I have received this message from two agents:

Version: 2.4.0p17, OS: linux, Update error: HTTPSConnectionPool(host=‘xxx’, port=443): Max retries exceeded with url: /prod/check_mk/deploy_agent.py (Caused by SSLError(SSLCertVerificationError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)’)))WARN, Last update: 2026-03-09 13:41:07, Agent plug-ins: 2, Local checks: 0

I have already attached the certificate under Setup/General/Global settings/Trusted certificate authorities for SSL and under Agent updater (Linux, Windows, Solaris).

Unfortunately, so far without success, the error message remains. I’ve also looked here in the feed and also here Changing a CA SSL certificate for the Agent Bakery - Checkmk Knowledge Base - Checkmk Knowledge Base

Unfortunately so far without success. Can you help me?

2

The agent updater is not able to verify the new server certificate.

Has the certificate authority also changed?

If so you would have had to deploy the new CA certificate before changing the server certificate.

Can you revert to the old server certificate? Then change the updater configuration to include the new CA certificate and let the bakery deploy the new packages. Only after all hosts have an updated agent change the server certificate.

Make sure that any intermediate certificates are also configured on the server. The chain has to be verifiable by the agent updater on the host.

If that is not possible because the old server certificate is not valid any more then add the new CA certificate to the updater configuration, bake new agent packages and run cmk-update-agent -x on each host.