I have two SSL certificates:

  • One for snipsalonsoftware.com which is currently in place and working properly.
  • One for app.snipsalonsoftware.com which has been purchased but not yet installed.

What I'm trying to do right now is simply verify the validity of the snipsalonsoftware.com certificate so that, when I try to verify the app.snipsalonsoftware.com, I know that I'm getting a meaningful answer.

This is a professionally signed certificate from Comodo by way of DreamHost, not a self-signed certificate. How can I verify the trust chain using openssl or some other method?

Here's what I get right now when I try:

$ openssl verify domain.pem 
domain.pem: /OU=Domain Control Validated/OU=Provided by New Dream Network, LLC/OU=DreamHost Basic SSL/CN=snipsalonsoftware.com
error 20 at 0 depth lookup:unable to get local issuer certificate

But to me it's like duh, of course you can't get the local certificate - there isn't one. I don't get how I'm supposed to verify a professionally-signed certificate.


Generally what this means is that OpenSSL's default CA path doesn't contain the certificate that signed the one you're checking - usually an intermediate certificate.

You'll need to get a copy of the intermediate (most CAs will provide, or you can fetch it from an SSL connection whose trust is working), and point at it in your openssl command with -CAfile intermediate.pem.

| improve this answer | |
  • 4
    Note that if you use -CAfile intermediate.pem then you're telling openssl that the intermediate is fully trusted, which means you're not verifying the whole chain, just the last step. If this matters to you, you should use cat intermediate.pem yourcert.pem | openssl verify instead. – user193597 Mar 17 '14 at 0:44
  • @WumpusQ.Wumbley cat intermediate.pem garbage.pem | openssl verify also says OK, seems that only verifies intermediate is signed by your trust roots, and nothing about yourcert :-( – Beni Cherniavsky-Paskin Dec 13 '16 at 20:38
  • To verify the intermediate.pem you should run openssl verify intermediate.pem. Without -CApath or -CAfile parameter you will verify it with your system root certs. (In case of a problem with those I recommend using certifi.io/en/latest ) – Greg Dubicki Feb 28 '17 at 20:27
  • Late but since this revived @WumpusQ.Wumbley: OpenSSL releases below 1.1.0 in 2016 never accept a cert chain unless it reaches a locally-trusted root, so -CAfile intermediate is insufficient by itself but may help if the defaulted CApath contains its root (and any higher chain, less likely). 1.1.0 will accept a non-root as anchor only if you specify -partial_chain. The best solution is to provide the full chain in any combination of CAfile (usually more convenient) CApath (needs hashnames) and -untrusted but the root not in the last. – dave_thompson_085 Sep 18 '17 at 7:37

You should be able to download from your provider all the certificates that form the chain of trust from you signed certificate up to the signing Certificate Authority.

Then use openssl verify using those certs. Check both the -CAfile and the -CApath options of the verify(1) command to learn how.

| improve this answer | |

You can also use an online tool like SSL-Checker which graphically shows the trust chain your server is presenting and helps you to figure out which certificates are missing in the chain

| improve this answer | |

You have must cat all certs to final CA_Chain.crt:

:~$ cat RootCA.crt IntermediateCert1 IntermediateCert2 > CA_Chain.crt

:~$ openssl verify -CAfile CA_Chain.crt website.crt

(website.crt sign by IntermediateCert2)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.