wget: ERROR: cannot verify certificate: Unable to locally verify the issuer's authority

ERROR: cannot verify example.com's certificate, issued by 'CN=...': Unable to locally verify the issuer's authority. means wget (built with OpenSSL) could not find the certificate authority that issued the server's certificate among the CAs it trusts. The connection is refused before anything is downloaded, and wget exits with status 5 (SSL verification failure). Install or update the system CA bundle, or point wget at the right CA with --ca-certificate=FILE; the last line of the message suggests --no-check-certificate, which turns verification off.

The full output has three lines; the host and issuer vary:

ERROR: cannot verify example.com's certificate, issued by 'CN=Example Internal CA,O=Example':
  Unable to locally verify the issuer's authority.
To connect to example.com insecurely, use `--no-check-certificate'.

wget builds that use GnuTLS print different text for the same problem, for example ERROR: The certificate of 'example.com' is not trusted. and The certificate of 'example.com' doesn't have a known issuer.

See who issued the certificate

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'

If the issuer is your company's proxy or an internal CA, you need that CA's certificate. If the chain stops at an intermediate, the server is missing it.

Fixes

# Debian/Ubuntu: install or refresh the CA bundle
sudo apt-get install -y ca-certificates && sudo update-ca-certificates

# trust one internal CA for this download
wget --ca-certificate=/path/to/internal-ca.pem https://intranet.example.com/file

# add it to the system store permanently (Debian/Ubuntu)
sudo cp internal-ca.pem /usr/local/share/ca-certificates/internal-ca.crt
sudo update-ca-certificates

On Fedora and RHEL the store is managed with update-ca-trust and certificates go in /etc/pki/ca-trust/source/anchors/. To make wget always use a specific bundle, put ca_certificate = /path/to/bundle.pem in ~/.wgetrc.