1

First of all, I know there are plenty of related questions but it seems like most of them are due to the lack of issuer certificates on the server.

I have been following this guide to enable client authentication with SSL, but I am stuck at getting Apache to accept the client certificate. Upon closer inspection, Apache logs are filled with Certificate Verification: Error (20): unable to get local issuer certificate messages.

I am using a certificate that a CA has given me and my private key as CA.

In order to further diagnose the issue, I ran openssl verify -CAfile ca.cert client_signed.crt and get the same error.

I decide to redo all steps. However, doing everything from the command line still returns the same error

$ openssl x509 -req -days 360 -in client.csr -CA ca.cert -CAkey ca.key -CAcreateserial -out client_signed.crt
Signature ok
subject= ...
Getting CA Private Key
Enter pass phrase for server.key:
[I type in the password and press ENTER]
$ openssl verify -CAfile ca.cert client_signed.crt
[ .. ]
error 20 at 0 depth lookup:unable to get local issuer certificate
$ ls ca.cert
ca.cert

In order to fully diagnose the issue, I decide to generate and self sign a certificate to be used as CA in order to sign the client certificate. To my surprise, this worked flawlessly. This is actually the first step in the tutorial that I have linked.

So apparently, the issue is related to my certificate. I am suspecting there must be something related to the Chain of Trust since I don't have the certificate of the CA who signed my own certificate. I attempted to download them from their website but I can't even verify my own certificate.

$ ls /path/to/downloaded/files/
acrn.cer  ancca.crt  CorreoUruguayoCA.crt  CorreoUruguayoRootCA.crt
$ openssl verify -CApath /path/to/downloaded/files/ my.cert
error 20 at 0 depth lookup:unable to get local issuer certificate

Any help will be greatly appreciated.

Edit: Using the "View File" utility on Ubuntu indicates that my certificate has been Verified by: Correo Uruguayo - CA. I am not sure why openssl is failing to verify it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.