Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a certificate from rapidssl. I run this command:

openssl s_client -showcerts -connect

I get this error:

verify error:num=19:self signed certificate in certificate chain

Here is what I have in my postfix, and what I have done:

smtpd_tls_key_file = /etc/postfix/ssl/ (this is the private key)

smtpd_tls_cert_file = /etc/postfix/ssl/ (this is the public key given to me by rapidssl)

smtpd_tls_CAfile = /etc/postfix/ssl/combo.csr.key This key has both the intermediate keys ON TOP, and the ROOT KEY on the bottom.

Here is the Intermediate keys. And here is the root CERT.

How can I use this RapidSSL Certificate?

share|improve this question

Your test is wrong. You have not given openssl any trusted CAs.

Your CApath may vary, but you'll need to issue something like this:

openssl s_client -showcerts -connect smtp.domain.tld:465 -CApath /etc/ssl/certs


I gather from your comment that you don't get it, so let's try this again without even bothering with smtp shall we? This will ensure that your mailserver at least trusts itself.

openssl verify -CAfile /etc/postfix/ssl/combo.csr.key /etc/postfix/ssl/

Also, because you don't redact well, I can tell you that your servers certs are fine as far as TLS is concered.

$ openssl s_client -connect -CApath /etc/ssl/certs/
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = "GeoTrust, Inc.", CN = RapidSSL CA
verify return:1
depth=0 serialNumber = MVOZF4NDnc-opzbqaWlvgmGVoNEC8Zrv, OU = GT40129440, OU = See (c)12, OU = Domain Control Validated - RapidSSL(R), CN =
verify return:1
Certificate chain
 0 s:/serialNumber=MVOZF4NDnc-opzbqaWlvgmGVoNEC8Zrv/OU=GT40129440/OU=See (c)12/OU=Domain Control Validated - RapidSSL(R)/
   i:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
 1 s:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
 3 s:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
Server certificate
subject=/serialNumber=MVOZF4NDnc-opzbqaWlvgmGVoNEC8Zrv/OU=GT40129440/OU=See (c)12/OU=Domain Control Validated - RapidSSL(R)/
issuer=/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
No client certificate CA names sent
SSL handshake has read 4879 bytes and written 409 bytes
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 02AC15DBA8798D4D93453CA5A3E4E5AB00EDBF94DD3A438E55E8C5BAECC5C4CE
    Master-Key: 1CB30B2974C794CDF8608F1D2819FBFA9C7DC6A4BE4F9F69B6369A5F05DDBB21F1830D952B7D72C6E747A764DBB1D2FE
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket:
    0000 - 98 6f 77 64 69 04 ed 23-98 96 7a 10 38 45 1c 90   .owdi..#..z.8E..
    0010 - 4a 37 c2 5c 9c 43 06 9d-d7 69 65 b1 07 d2 27 40   J7.\'@
    0020 - 34 81 91 46 ce 0d d1 02-b0 e2 95 79 85 39 42 f8   4..F.......y.9B.
    0030 - b5 e9 ac a0 fa d9 bf d0-25 0d f4 71 f5 1e ff 42   ........%..q...B
    0040 - 44 1b 6f d0 87 27 46 78-05 ce ce 4d 4b 59 88 d9   D.o..'Fx...MKY..
    0050 - e1 42 b2 43 40 2c 22 7b-ca 72 86 d1 e8 bd dd 3d   .B.C@,"{.r.....=
    0060 - e3 5b 8b fa a9 54 47 8c-91 e2 96 e6 a1 6b 17 ea   .[...TG......k..
    0070 - a1 1b fc 9f 49 8f 11 e8-fa b2 59 d6 2a 77 66 5b   ....I.....Y.*wf[
    0080 - 88 25 d7 12 e6 08 7d 64-d4 4d 60 cc ea f3 f9 d2   .%....}d.M`.....
    0090 - 12 c6 b8 95 b0 66 21 e3-2d d2 2f e9 f1 96 cc 35   .....f!.-./....5
    00a0 - a6 3a 7c 2f 8f 71 24 91-30 b5 fc 2f d0 e6 a1 f4   .:|/.q$.0../....

    Compression: 1 (zlib compression)
    Start Time: 1347395676
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
221 2.0.0 Bye
share|improve this answer
but if its a mail server, then the mail server should provide the CA as well.... This is the issue with rapidssl if I understand, that a lot of the mail clients don't have the new one.... – technobuddha Sep 11 '12 at 20:18
openssl s_client -showcerts -CApath /etc/postfix/ssl/ROOT.Equifax_Secure_Certificate_Authority.cer -connect localhost:465 depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority verify return:1 depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA verify return:1 depth=1 C = US, O = "GeoTrust, Inc.", CN = RapidSSL CA verify return:1 depth=0 serialNumber = MVOZF4NDnc-opzbqaWlvgmGVoNEC8Zrv, OU = GT40129440, OU = See (c)12, OU = Domain Control Validated - RapidSSL(R), CN = verify return:1 – technobuddha Sep 11 '12 at 20:18
I'll work on my skills. thanks for the input. so, from what your saying, the openssl client side is doing everything its meant to do, and the return result is fine. although I thought verify return:1 meant an error? – technobuddha Sep 11 '12 at 20:41
openssl verify codes are not process exit codes. a value of 1 means continue processing – 84104 Sep 11 '12 at 20:45
ok so then i guess i'm doing the testing wrong. How does one verify that the client is able to get all the certs needed? for some reason, NONE of the client I use will work with TLS, they all hang. and i think it has to do with the fact they don't have the root certificate. so I don't know what order they should be placed into a .pem file? how do I go about testing that it works? – technobuddha Sep 16 '12 at 18:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.