9

Lets say I start with a certificate.

Using openssl I can print it out like this:

openssl x509 -in cert.pem -text -noout

And I'll get some output such as Validity, Issuer and Subject along with Authority Key Identifier and Subject Key Identifier.

How do I use these fields to work out the next certificate in the chain?

And then once I obtain the next certificate, work out what that next certificate should be etc.

Basically I'm wanting to work out the full chain and get things in the right order for the EC2 load balancer. Since Network Solutions don't seem to just give you a bundle that works. They give you individual certs and I've tried and tried lots of different orderings for EC2 and still haven't gotten it to work. My last bet is to try openssl and work this out manually rather than guessing.

Improve this question

2 Answers 2

Reset to default
8

The X509v3 Authority Key Identifier in the openssl output for the child key will match the X509v3 Subject Key Identifier for the signing key.

For example, for this site's SSL cert and its parent certificate:

# openssl x509 -text -noout -in subject.pem
...
        Subject: C=US, ST=NY, L=New York, O=Stack Exchange, Inc., CN=*.stackexchange.com
...
            X509v3 Authority Key Identifier:
                keyid:51:68:FF:90:AF:02:07:75:3C:CC:D9:65:64:62:A2:12:B8:59:72:3B
            X509v3 Subject Key Identifier:
                5A:C1:42:63:C2:62:13:B3:9D:94:84:AA:32:1E:17:CB:6D:A3:86:7B

# openssl x509 -text -noout -in parent.pem
...
        Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
...
            X509v3 Subject Key Identifier:
                51:68:FF:90:AF:02:07:75:3C:CC:D9:65:64:62:A2:12:B8:59:72:3B
            X509v3 Authority Key Identifier:
                keyid:B1:3E:C3:69:03:F8:BF:47:01:D4:98:26:1A:08:02:EF:63:64:2B:C3

51:68:FF:90:AF:02:07:75:3C:CC:D9:65:64:62:A2:12:B8:59:72:3B is what establishes on the child cert what cert signed it, you should be able to use that to find the correct authority certificates.

Improve this answer
4
  • Thanks, that's exactly right. I worked it out just before you posted. I found I had extra certs that weren't required in the chain. EC2 doesn't allow anything extra to be in the cert chain.
    – hookenz
    Nov 20, 2014 at 23:30
  • I think you made a small mistake in your answer @shane-madden You wrote Authority Key Identifier instead of Subject Key Identifier. I hope it's correct now, otherwise feel free to blame me :)
    – sebix
    Nov 23, 2014 at 20:11
  • @sebix Oh, yup, thanks a lot for the fix -- and I misread the diff and rolled your change back, then realized that you had it right and rolled back the rollback, heh.
    – Shane Madden
    Nov 23, 2014 at 20:17
  • my certificate don't have subject key identifier and authority key identifier
    – Necktwi
    Jul 10, 2017 at 5:45
1

It is important to note that the intermediate certificates are not specific to your domain or certificate. So, every certificate issued that is like yours, has the exact same intermediate certificates.

You can think of them a bit like the routing number on your checks. The routing number is needed, but really says more about your bank than it does about you. Your account number, or your certificate in this case, is what is unique to you.

Because of the generic nature of the intermediate certificates there are websites like this one:

https://www.ssl2buy.com/wiki/ssl-intermediate-and-root-ca-bundle

That have all of the intermediate certificates pre-bundled (and in the correct order) for different certificate issuers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .