topic SGX remote registration reports "SSL certificate problem: unable to get local issuer certificate" in Intel® Software Guard Extensions (Intel® SGX)

SGX remote registration reports "SSL certificate problem: unable to get local issuer certificate"

equinoctial — Sat, 18 Apr 2026 13:58:09 GMT

Shockingly I found the SGX remote registration starts to exhibit below error lately, this is the first time for me to hit this error which is seen on both of my two systems that used for SGX validation, could this be related to the ongoing TLS certificate chain update? If yes, could you please help shed lights on what can I do to get over this obstacle? It would be greatly appreciated if you can help prioritize since we have quite a tight validation window. Thanks a lot.

[root@591746 ~]# systemctl start mpa_registration_tool.service
[root@591746 ~]# tail -f /var/log/mpa_registration.log
[18-04-2026 01:23:37] INFO: Registration Flow - PLATFORM_ESTABLISHMENT or TCB_RECOVERY failed.
[18-04-2026 01:23:37] INFO: Finished Registration Agent Flow.
[18-04-2026 01:25:52] INFO: SGX Registration Agent version: 1.22.100.3
[18-04-2026 01:25:52] INFO: Starts Registration Agent Flow.
[18-04-2026 01:25:53] ERROR: curl_easy_perform failed with the error: 60
[18-04-2026 01:25:53] ERROR: Detailed curl error: SSL certificate problem: unable to get local issuer certificate
[18-04-2026 01:25:53] ERROR: Failed to send request to server, error: 10
[18-04-2026 01:25:53] ERROR: Failed to send request to server, error: 6
[18-04-2026 01:25:53] INFO: Registration Flow - PLATFORM_ESTABLISHMENT or TCB_RECOVERY failed.
[18-04-2026 01:25:53] INFO: Finished Registration Agent Flow.

Re: SGX remote registration reports "SSL certificate problem: unable to get local issuer certif

Getac1730 — Sat, 18 Apr 2026 14:01:01 GMT

Thank

Re: SGX remote registration reports "SSL certificate problem: unable to get local issuer certif

equinoctial — Wed, 22 Apr 2026 01:31:20 GMT

appreciate a warm-hearted person's prompt response, this issue turns out to be that my system doesn't have the appropriate root CA. I have verified that below solution can fix the problem, FYI for those people who stumbles across this issue. Thx.

curl -L -o "/tmp/Root Sectigo Public Server Authentication Root R46.crt" "https://support.sectigo.com/sfc/servlet.shepherd/version/download/068Uj00000aEa28"

cp "/tmp/Root Sectigo Public Server Authentication Root R46.crt" /etc/pki/ca-trust/source/anchors/
update-ca-trust extract

rm "/tmp/Root Sectigo Public Server Authentication Root R46.crt"