Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a valid certificate installed on a server and when using the -CApath option with OpenSSL, the certificate chain is valid. However if I don't provide the -CApath option I receive this:

19:self signed certificate in certificate chain

When I try Google's HTTPS port without -CApath, OpenSSL returns:

20:unable to get local issuer certificate

What's the difference between the two?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

They're very similar errors. They both indicate that the trust chain didn't end on a trusted certificate. The difference is that the former error occurs when the chain ends on an intermediate certificate and the latter occurs when the chain ends on a root certificate.

20 is the expected error if the root certificate is unknown. The trust chain ends on an intermediate certificate and you can't get the issuer's certificate.

19 will occur if the server, for some reason, sends the self-signed root certificate in the chain. A client won't use a root certificate unless they trust it, and if they trust it, they already have it -- so there's no point in sending it. But no harm either. It just changes the error message.

So I would conclude that on your server, you have the root certificate configured as a chain certificate. So your server is serving that root certificate to clients. This is unnecessary but, so far as I know, harmless.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.