Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at the example on this page:

$ openssl verify -verbose -CAfile cacert.pem  server.crt
server.crt: OK

What I'm using as my cacert.pem is my (professionally signed) root certificate concatenated with my intermediate certificate.

What's not clear to me is what server.crt is or where I'm supposed to get it.

share|improve this question
When you get a certificate signed, you give the CA a certificate signing request file (usually with a .csr extension) and they give you back a certificate file and optionally an intermediate certificate. They often both have .crt extensions. Does this describe your experience? It would be very unusual for a CA to send you their root certificate as these are distributed with operating systems and browsers and are not needed when configuring a web server. – Ladadadada Mar 16 '14 at 15:23
What do you mean "my (professionally signed) root certificate"? You need the Certificate Authority's (Verisign, etc.) root certificate, as cacert.pem, and your SSL certificate as server.crt. The command verifies that server.crt was correctly signed by the certificate authority. – TessellatingHeckler Mar 16 '14 at 15:25
@Ladadadada Yes, that describes my experience. I think my "root" label is probably wrong. In the DreamHost UI the thing I was referring to as the root certificate is simply labeled "Certificate." – Jason Swett Mar 16 '14 at 15:26
@TessellatingHeckler Okay, I think we've revealed a hole in my understanding. My certificate vendor is DreamHost, and they provide in my "panel" area three things: Certificate, Private Key and Intermediate Certificate. Would any of these things be the "root certificate"? Would any of them be "my" certificate? – Jason Swett Mar 16 '14 at 15:29
Certificate is probably your SSL certificate, specific to your server e.g and keeps encryption to your server unique. Dreamhost will have a root certificate which is shared with everyone which is used for digital signing authenticity to verify your unique certificate came from a 'trusted' big company. I can't quickly find out what name that would have. That root combined with the Intermediate Certificate would be cacert.pem. Private Key is the password that keeps your certificate secret, and is outside the SSL chain. – TessellatingHeckler Mar 16 '14 at 15:35
up vote 3 down vote accepted

server.crt is your trusted server certificate, delivered once the request has been signed by a Certification Authority.

So, you are supposed to get this file when you have send a signing request (csr) to your CA. Then, once signed, they will send you back a trusted crt certificate.

share|improve this answer
Okay, I think I understand. In my DreamHost panel they show me three values: Certificate, Private Key and Intermediate Certificate. DreamHost also emailed me my certificate with a value that exactly matches the value under Certificate in the panel UI. So this value would be the trusted server certificate, the server.crt? – Jason Swett Mar 16 '14 at 15:34
And if so, what does that make cacert.pem? – Jason Swett Mar 16 '14 at 15:34
You are right. So cacert.pem is the bundle of trusted root CA used to verify the authenticity of your signed certificate (including intermediate certificates). Have a look in here… or here… – krisFR Mar 16 '14 at 15:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.