2

I'm struggling with openssl since some days.

I've compiled openssl on an ARM device and when I run openssl s_client -connect google.com:443 the connection will fail with error 20: unable to get local issuer certificate.

If I run that command specifying -CAfile /etc/ssl/certs/ca-certificates.crt the connection will work and returns verify return code: 0 (ok). Another test that I've done is to run the command with -CApath /etc/ssl/certs/, in this case I will still got error 20

Since OPENSSLDIR is /usr/lib/ssl I've managed to link it to /etc/ssl/certs, now in the filesystem that directory looks like this:

ls -l /usr/lib/ssl
certs -> /etc/ssl/certs

I'm not figuring out what I'm missing and how to set the directory in which openssl has to look for certificates. Has someone had a similar issue?

Improve this question

1 Answer 1

Reset to default
2

The directory specified in CApath must have a special structure. From OpenSSL docs

If CApath is not NULL, it points to a directory containing CA certificates in PEM format. The files each contain one CA certificate. The files are looked up by the CA subject name hash value, which must hence be available. If more than one CA certificate with the same name hash value exist, the extension must be different (e.g. 9d66eef0.0, 9d66eef0.1 etc). The search is performed in the ordering of the extension number, regardless of other properties of the certificates. Use the c_rehash utility to create the necessary links

If I am not wrong, you could use a directory as CApath if:

  • It contains files in pem format containing an authority in each file.
  • You run c_rehash (or create manually the appropriate symbolic links) in it.
Improve this answer
1
  • I've done those steps, my problem is that openssl only works if I specify -CAfile, with -CApath or nothing I still get error 20. I need to set the directory in which openssl looks for certificates or instead discover that directory and link it to my certificates. openssl version -d returns OPENSSLDIR = /usr/lib/ssl so I've linked the certs directory in that location to /etc/ssl/certs
    – Marco
    Nov 17, 2017 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .