I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server:
Somehow setting up the correct certificates is more tricky than expected... :(
When I test the message with openssl s_client:
openssl s_client -connect 123.456.789.0:666 -CAfile test.crt -debug
I get the error message
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority verify error:num=20:unable to get local issuer certificate verify return:0
error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate:s3_pkt.c:1257:SSL alert number 42 140685406562208:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
Here is the certificate chain:
Certificate chain 0 s:myself i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
I am trying to get the system to recognize these certificates as correct for hours now but to no avail...
What i have tried until now:
- various variations of adding the certificate of COMODO to the list of trusted certificates by using update-ca-trust.
- adding the certificates to the list of trusted certificates in /etc/ssl/certs
- creating pem files in a folder and adding them with -CApath.
- The problem with google is that most tutorials discuss this from the point of view of a server admin, but I don't have access to the server.
The operating system is Fedora.
Is there a structured way to tackle this issue?
Edit: the certificate was created as follows:
openssl req -new -x509 -sha256 -days 365 -key mykey.key -out test.crt