title: Fetchmail and Server certificate verification error: unable to get local issuer certificate
body: <p>ok, this familiar question, not sure what I am missing to still get the local issuer certificate as when I ran the check with openssl I got success.  I was under the impression all I needed was the Global CA certificate (the openssl shows that it is all valid and acceptable)</p>
  
  <p>Thanks!</p>
  
  <p>running fetchmail with:</p>
  
  <pre><code>fetchmail -v -v -d 473 --syslog --nobounce --sslcertpath /home/bloggs/certs -f /home/bloggs/fetchmailrc
  </code></pre>
  
  <p>/home/bloggs/certs contains</p>
  
  <pre><code>lrwxrwxrwx   1           10 Aug  8 12:57 3513523f.0 -&gt; CAROOT.pem
  -rw-------   1          1338 Aug  8 08:51 CAROOT.pem
  </code></pre>
  
  <p>With openssl:</p>
  
  <pre><code>/usr/local/ssl/bin/openssl s_client -CApath /home/bloggs/certs -connect outlook.office365.com:995
  </code></pre>
  
  <p>outputs this:</p>
  
  <pre><code>CONNECTED(00000003)
  depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
  verify return:1
  depth=1 C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
  verify return:1
  depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = outlook.com
  verify return:1
  ---
  Certificate chain
   0 s:/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=outlook.com
     i:/C=US/O=DigiCert Inc/CN=DigiCert Cloud Services CA-1
   1 s:/C=US/O=DigiCert Inc/CN=DigiCert Cloud Services CA-1
     i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
  ---
  Server certificate
  -----BEGIN CERTIFICATE-----
  ...snip...
  etc, etc, etc
  ...snip...  
  Key-Arg   : None
  PSK identity: None
  PSK identity hint: None
  SRP username: None
  Start Time: 1533743966
  Timeout   : 300 (sec)
  Verify return code: 0 (ok)
  ---
  </code></pre>
  
  <p>However, Fetchmail writes this to the mail log</p>
  
  <pre><code>Old UID list from outlook.office365.com: &lt;empty&gt;
  Scratch list of UIDs: &lt;empty&gt;
  6.3.26 querying outlook.office365.com (protocol POP3) at Wed Aug 08 13:03:16 2018:poll started
  Trying to connect to 180.163.18.8/995...connected.
  Certificate chain, from root to peer, starting at depth 1:
  Issuer Organization: DigiCert Inc
  Issuer CommonName: DigiCert Global Root CA
  Subject CommonName: DigiCert Cloud Services CA-1
  Server certificate verification error: unable to get local issuer     certificate
  Broken certification chain at: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
  This could mean that the server did not provide the intermediate CA's certificate(s), which is nothing fetchmail could do anything about.  For details, please see the README.SSL-SERVER document that ships with fetchmail.
  This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page.
  Certificate at depth 1:
  Issuer Organization: DigiCert Inc
  Issuer CommonName: DigiCert Global Root CA
  Subject CommonName: DigiCert Cloud Services CA-1
  Server certificate verification error: certificate not trusted
  Server certificate:
  Issuer Organization: DigiCert Inc
  Issuer CommonName: DigiCert Cloud Services CA-1
  Subject CommonName: outlook.com
  Subject Alternative Name: *.clo.footprintdns.com
  </code></pre>