I m trying to install a root certificate in my cent OS box. I did the following

  1. Enable the dynamic CA configuration feature: update-ca-trust force-enable

  2. Add it as a new file to /etc/pki/ca-trust/source/anchors/ cp foo.crt /etc/pki/ca-trust/source/anchors/

  3. Use command: update-ca-trust extract Then I m running below command to verify the certificate.

openssl s_client -connect my_AD_server_IP:636 -CApath /etc/ssl/certs

Bur getting below error(This is part of the error)

Verify return code: 20 (unable to get local issuer certificate)


Did you confirm that your cert made it into the /etc/pki/tls/certs/ca-bundle.crt file?

The certs are transformed before they make it into that file, so you can't just look for a string that matches your cert.

Here's a quick awk script to dump the subject fields from each cert in that certificate file so you can look for yours:

awk -v cmd='openssl x509 -noout -subject' \
       '/BEGIN/{close(cmd)};{print | cmd}' \
< /etc/pki/tls/certs/ca-bundle.crt

(I found that awk script here)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.