This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 38%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELX%3C/text%3E%3C/svg%3E)
通过curl尝试访问download.microsoft.com时openssl报错：
unable to get local issuer certificate (20)
经检查发现通过download.microsoft.com访问时证书返回包含
Certificate chain
0 s:C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=kingsoft.download.microsoft.com
i:C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 RSA CA OCSP 04
a:PKEY: RSA, 2048 (bit); sigalg: sha384WithRSAEncryption
v:NotBefore: May 4 01:23:12 2026 GMT; NotAfter: Oct 31 01:23:12 2026 GMT
1 s:C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 RSA CA OCSP 04
i:C=US, O=Microsoft Corporation, CN=Microsoft TLS RSA Root G2
a:PKEY: RSA, 4096 (bit); sigalg: sha384WithRSAEncryption
v:NotBefore: Aug 1 20:02:59 2025 GMT; NotAfter: Jun 3 20:02:59 2029 GMT
而访问正常的www.microsoft.com证书返回包含
Certificate chain
0 s:C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=www.microsoft.com
i:C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 RSA CA OCSP 04
a:PKEY: RSA, 2048 (bit); sigalg: sha384WithRSAEncryption
v:NotBefore: Jan 22 19:55:21 2026 GMT; NotAfter: Jan 17 19:55:21 2027 GMT
1 s:C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 RSA CA OCSP 04
i:C=US, O=Microsoft Corporation, CN=Microsoft TLS RSA Root G2
a:PKEY: RSA, 4096 (bit); sigalg: sha384WithRSAEncryption
v:NotBefore: Aug 1 20:02:59 2025 GMT; NotAfter: Jun 3 20:02:59 2029 GMT
2 s:C=US, O=Microsoft Corporation, CN=Microsoft TLS RSA Root G2
i:C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
a:PKEY: RSA, 4096 (bit); sigalg: sha384WithRSAEncryption
v:NotBefore: May 21 00:00:00 2025 GMT; NotAfter: Jun 19 23:59:59 2029 GMT
两种情况不一致 请问这是预期结果吗 或者是可以修复的问题？
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 16%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
Hi LY Xiang,
您遇到的证书不匹配是不同平台处理网络优化的预期结果。当您查询 download 子域时，您访问的是一个明确设计为在初始连接时省略根证书以优化访问速度的内容分发网络。Windows 能够无缝处理此情况，因为它利用原生机制自动寻找并检索缺失的 Microsoft TLS RSA Root G2 证书，从而补全证书链。相反，OpenSSL 严格依赖于通常命名为 cacert.pem 的静态本地文件，且缺乏通过互联网获取缺失组件的程序化能力；因此，当服务器未能提供通向受信任根证书的完整路径时，将立即触发错误 20。
这是一种有意的架构设计行为，意味着不存在待处理的后端服务器修复程序。为了在您的 OpenSSL 环境中规避此限制，您必须明确地将工具指向一个包含所需的 DigiCert 和 Microsoft 根证书颁发机构的本地证书包，进而手动完成 Windows 通常动态处理的证书链操作。
希望此解答为您提供了有效信息。如果是，请点击“接受答案”。如有任何疑问，请发表评论
VPHAN
