I am receiving the following error on my HPUX/Apache server:
Certificate Verification: Error (20): unable to get local issuer certificate
When I look at my root certificates, I have the DoD Root CA-2 Root certificate included on the server.
My site certificate has the chain of DoD Root CA-2 -> DoD CA-28 -> Certificate.
when I do the following, I do receive an error:
-bash-4.3$ openssl s_client -connect mysite:443 -showcerts
CONNECTED(00000003)
depth=0 /C=US/O=U.S. Government/OU=DoD/OU=PKI/OU=USN/CN=mysite
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=US/O=U.S. Government/OU=DoD/OU=PKI/OU=USN/CN=mysite
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=US/O=U.S. Government/OU=DoD/OU=PKI/OU=USN/CN=mysite
verify error:num=21:unable to verify the first certificate
verify return:1
20509:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1102:SSL alert number 40
20509:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:182:
Other than the error and confirmation from the openssl
command above, my site works most of the time (I do have a lack of memory that is causing me issues).
Do I need the DoD CA-28 certificate in my root store on my server?