I am having the following certificate chain:
Self-signed Certificate --> Intermediate --> Client cert, Server cert. I have application for ssl communication and also verify peer setting. I try to test this chain with openssl s_client
command and I get Verify return code: 19 (self signed certificate in certificate chain)
. The server sends the whole chain in the handshake.
I tried to test this with Bundle.pem which contains the self-signed and the intermediate certificates and also with the Self-signed.pem but the result is the same.
openssl s_client -msg -connect localhost:1500 -CAfile Self-signed.pem/Bundle.pem -cert Client.crt -key Client.key
Then I issued another intermediate certificate and from that one I issued new server certificate
openssl s_client -msg -connect localhost:1500 -CAfile Bundle2.pem -cert Client.crt -key Client.key
Bundle2.pem contains the second intermediate certificate and the self-signed certificate and this works fine. Also the server now does not send the whole chain of certificates, its how the application is designed.
Can someone explain why this is a issue, why I cannot make successful verification if server and client have the same intermediate certificate?