I am having trouble with OpenSSL complaining about not being able to validate locally issued certificate where I have the CA chain as well. I have the locally issued cert in (PEM and CRT) in addition to the local CA chain certificate (CER,PEM,CRT). The root and issuer are the same server. Comparing text on both certs, both match on "issuer:" field on both. This is RedHat Linux server.
I am getting error "verify error:num=20:unable to get local issuer certificate" and "Verify return code: 21 (unable to verify the first certificate)".
I am not sure what to look for anymore.
I did add the Issuer CA cert to linux certs using
cerutil certutil -d /etc/pki/nssdb -A -t "C,," -n DomainA1-Server1CA -i /root/DomainA1-Server1CA.cer
certutil -d /etc/pki/nssdb -Land I can see the cert there:
Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI DomainA1-Server1CA C,,
openssl s_client -connect ServerA2:443 -CAfile /root/certs/DomainA1-Server1CA.cer, tried with (.CRT and .PEM), got the two errors above.
openssl s_client -connect ServerA2:443 -CApath /root/certs, tried with (.CRT and .PEM), got the two errors above.
openssl s_client -connect ServerA2:443, got the two errors above.
Issued Cert snippet
Data: Version: 3 (0x2) Serial Number: 54:a9:50:a3:00:01:00:00:14:47 Signature Algorithm: sha1WithRSAEncryption Issuer: DC=com, DC=domainA1, CN=DomainA1-Server1CA Validity Not Before: April 5 16:45:48 2017 GMT Not After : April 5 16:45:48 2019 GMT Subject: C=US, ST=NY, L=CityA, O=CompanyNAME, OU=IT, CN=ServerB1.DomainA1.com
CA Chain Cert
Data: Version: 3 (0x2) Serial Number: 19:11:eb:af:4c:d5:a9:94:49:ka:2f:41:f2:e1:09:g2 Signature Algorithm: sha256WithRSAEncryption Issuer: DC=com, DC=domainA1, CN=DomainA1-Server1CA Validity Not Before: Aug 15 18:41:45 2015 GMT Not After : Aug 15 18:41:45 2025 GMT Subject: DC=com, DC=domainA1, CN=DomainA1-Server1CA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) ...C.A X509v3 Key Usage: Digital Signature, Certificate Sign, CRL Sign X509v3 Basic Constraints: critical CA:TRUE X509v3 Subject Key Identifier: