First of all, I know there are plenty of related questions but it seems like most of them are due to the lack of issuer certificates on the server.
I have been following this guide to enable client authentication with SSL, but I am stuck at getting Apache to accept the client certificate. Upon closer inspection, Apache logs are filled with
Certificate Verification: Error (20): unable to get local issuer certificate messages.
I am using a certificate that a CA has given me and my private key as CA.
In order to further diagnose the issue, I ran
openssl verify -CAfile ca.cert client_signed.crt and get the same error.
I decide to redo all steps. However, doing everything from the command line still returns the same error
$ openssl x509 -req -days 360 -in client.csr -CA ca.cert -CAkey ca.key -CAcreateserial -out client_signed.crt Signature ok subject= ... Getting CA Private Key Enter pass phrase for server.key: [I type in the password and press ENTER] $ openssl verify -CAfile ca.cert client_signed.crt [ .. ] error 20 at 0 depth lookup:unable to get local issuer certificate $ ls ca.cert ca.cert
In order to fully diagnose the issue, I decide to generate and self sign a certificate to be used as CA in order to sign the client certificate. To my surprise, this worked flawlessly. This is actually the first step in the tutorial that I have linked.
So apparently, the issue is related to my certificate. I am suspecting there must be something related to the Chain of Trust since I don't have the certificate of the CA who signed my own certificate. I attempted to download them from their website but I can't even verify my own certificate.
$ ls /path/to/downloaded/files/ acrn.cer ancca.crt CorreoUruguayoCA.crt CorreoUruguayoRootCA.crt $ openssl verify -CApath /path/to/downloaded/files/ my.cert error 20 at 0 depth lookup:unable to get local issuer certificate
Any help will be greatly appreciated.
Edit: Using the "View File" utility on Ubuntu indicates that my certificate has been
Verified by: Correo Uruguayo - CA. I am not sure why openssl is failing to verify it.