OpenSSL will not verify a cert
$openssl s_client -connect <host>:443 ... Verify return code: 21 (unable to verify the first certificate)
However, if we figure out the location of the store
$ openssl version -d OPENSSLDIR: "/usr/lib/ssl" $ ll /usr/lib/ssl ... lrwxrwxrwx 1 root root 14 Sep 9 16:40 certs -> /etc/ssl/certs
And run the command again specifying what is apparently the default directory
$ openssl s_client -connect <host>:443 -CApath /etc/ssl/certs ... Verify return code: 0 (ok)
So is there some other way to check explicitly where OpenSSL is getting its root CA list, or some other edge case that may be being hit here which would cause this behavior?