Certificate Verification Error: unable to get local issuer certificate

Steps to reproduce the problem:

1. on CentOS 7, install all dependencies
2. install mitmproxy from source code https://github.com/mitmproxy/mitmproxy.git, commit: 8be0d78eaa104996474041bf709ea8aeb7f3637d
3. setup proxy server on mobile, install mitmproxy certificate from mitm.it
4. open https://baidu.com in browser

What is the expected behavior?

browser works

What went wrong?

browser shows an error message:

502 Bad Gateway. Certificate Verification Error for www.baidu.com: unable to get local issuer certificate (errno: 20, depth: 2)

Here is the log for https://www.baidu.com

111.206.14.134:57025: GET https://www.baidu.com/
 << Certificate Verification Error for www.baidu.com: unable to get local issuer certificate (errno: 20, depth: 2)

https://baidu.com or https://google.com doesn’t work, but some https sites like github.com works. Here is the log for https://github.com

111.206.15.132:52912: CONNECT github.com:443
  << Cannot establish TLS with client (sni: github.com): TlsException("(-1, 'Unexpected EOF')",)

Any other comments? What have you tried so far?

1. I tried to update the certificates on centos by yum install ca-certificates, doesn’t work.
2. I tried to verify the certificate by openssl on this centos server, it looks good

$ openssl s_client -quiet -connect www.baidu.com:443
depth=3 C = US, O = "VeriSign, Inc.", OU = Class 3 Public Primary Certification Authority
verify return:1
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify return:1
depth=1 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = Terms of use at https://www.verisign.com/rpa (c)10, CN = VeriSign Class 3 Secure Server CA - G3
verify return:1
depth=0 C = CN, ST = Beijing, L = Beijing, O = "BeiJing Baidu Netcom Science Technology Co., Ltd", OU = service operation department, CN = baidu.com
verify return:1

1. I tried to deploy same version on my Macbook laptop, it works.

---

Mitmproxy Version: 0.18, commit: 8be0d78eaa104996474041bf709ea8aeb7f3637d Operating System: CentOS 7

[kennytm]

If you don’t care about security, you may run mitmproxy --insecure (or mitmweb --insecure) to skip verification.

[arleytm]

If you don’t care about security, you may run mitmproxy --insecure (or mitmweb --insecure) to skip verification.

The --insecure option was deprecated. Use --ssl-insecure instead.