I am having the following certificate chain:

Self-signed Certificate --> Intermediate --> Client cert, Server cert. I have application for ssl communication and also verify peer setting. I try to test this chain with openssl s_client command and I get Verify return code: 19 (self signed certificate in certificate chain). The server sends the whole chain in the handshake.

I tried to test this with Bundle.pem which contains the self-signed and the intermediate certificates and also with the Self-signed.pem but the result is the same.

openssl s_client -msg -connect localhost:1500 -CAfile Self-signed.pem/Bundle.pem -cert Client.crt -key Client.key

Then I issued another intermediate certificate and from that one I issued new server certificate

openssl s_client -msg -connect localhost:1500 -CAfile Bundle2.pem -cert Client.crt -key Client.key

Bundle2.pem contains the second intermediate certificate and the self-signed certificate and this works fine. Also the server now does not send the whole chain of certificates, its how the application is designed.

Can someone explain why this is a issue, why I cannot make successful verification if server and client have the same intermediate certificate?

1 Answer 1


Solved this by adding basicConstraints=CA:TRUE in openssl.conf to the imtermediate certificate when issuing

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .