SGX remote registration reports "SSL certificate problem: unable to get local issuer certificate"

[equinoctial]

Shockingly I found the SGX remote registration starts to exhibit below error lately, this is the first time for me to hit this error which is seen on both of my two systems that used for SGX validation, could this be related to the ongoing TLS certificate chain update? If yes, could you please help shed lights on what can I do to get over this obstacle? It would be greatly appreciated if you can help prioritize since we have quite a tight validation window. Thanks a lot.

[root@591746 ~]# systemctl start mpa_registration_tool.service
[root@591746 ~]# tail -f /var/log/mpa_registration.log
[18-04-2026 01:23:37] INFO: Registration Flow - PLATFORM_ESTABLISHMENT or TCB_RECOVERY failed.
[18-04-2026 01:23:37] INFO: Finished Registration Agent Flow.
[18-04-2026 01:25:52] INFO: SGX Registration Agent version: 1.22.100.3
[18-04-2026 01:25:52] INFO: Starts Registration Agent Flow.
[18-04-2026 01:25:53] ERROR: curl_easy_perform failed with the error: 60
[18-04-2026 01:25:53] ERROR: Detailed curl error: SSL certificate problem: unable to get local issuer certificate
[18-04-2026 01:25:53] ERROR: Failed to send request to server, error: 10
[18-04-2026 01:25:53] ERROR: Failed to send request to server, error: 6
[18-04-2026 01:25:53] INFO: Registration Flow - PLATFORM_ESTABLISHMENT or TCB_RECOVERY failed.
[18-04-2026 01:25:53] INFO: Finished Registration Agent Flow.

[Getac1730]

Thank

[equinoctial · Accepted solution]

appreciate a warm-hearted person's prompt response, this issue turns out to be that my system doesn't have the appropriate root CA. I have verified that below solution can fix the problem, FYI for those people who stumbles across this issue. Thx.

curl -L -o "/tmp/Root Sectigo Public Server Authentication Root R46.crt" "https://support.sectigo.com/sfc/servlet.shepherd/version/download/068Uj00000aEa28"

cp "/tmp/Root Sectigo Public Server Authentication Root R46.crt" /etc/pki/ca-trust/source/anchors/
update-ca-trust extract

rm "/tmp/Root Sectigo Public Server Authentication Root R46.crt"