I am having the following certificate chain:

Self-signed Certificate --> Intermediate --> Client cert, Server cert. I have application for ssl communication and also verify peer setting. I try to test this chain with openssl s_client command and I get Verify return code: 19 (self signed certificate in certificate chain). The server sends the whole chain in the handshake.

I tried to test this with Bundle.pem which contains the self-signed and the intermediate certificates and also with the Self-signed.pem but the result is the same.

openssl s_client -msg -connect localhost:1500 -CAfile Self-signed.pem/Bundle.pem -cert Client.crt -key Client.key

Then I issued another intermediate certificate and from that one I issued new server certificate

openssl s_client -msg -connect localhost:1500 -CAfile Bundle2.pem -cert Client.crt -key Client.key

Bundle2.pem contains the second intermediate certificate and the self-signed certificate and this works fine. Also the server now does not send the whole chain of certificates, its how the application is designed.

Can someone explain why this is a issue, why I cannot make successful verification if server and client have the same intermediate certificate?

1 Answer 1


Solved this by adding basicConstraints=CA:TRUE in openssl.conf to the imtermediate certificate when issuing

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.