I am having trouble with OpenSSL complaining about not being able to validate locally issued certificate where I have the CA chain as well. I have the locally issued cert in (PEM and CRT) in addition to the local CA chain certificate (CER,PEM,CRT). The root and issuer are the same server. Comparing text on both certs, both match on "issuer:" field on both. This is RedHat Linux server.

I am getting error "verify error:num=20:unable to get local issuer certificate" and "Verify return code: 21 (unable to verify the first certificate)".

I am not sure what to look for anymore.

Troubleshooting steps

  • I did add the Issuer CA cert to linux certs using cerutil certutil -d /etc/pki/nssdb -A -t "C,," -n DomainA1-Server1CA -i /root/DomainA1-Server1CA.cer

  • Ran certutil -d /etc/pki/nssdb -L and I can see the cert there:

    Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI DomainA1-Server1CA C,,

  • Ran openssl s_client -connect ServerA2:443 -CAfile /root/certs/DomainA1-Server1CA.cer, tried with (.CRT and .PEM), got the two errors above.

  • Ran openssl s_client -connect ServerA2:443 -CApath /root/certs, tried with (.CRT and .PEM), got the two errors above.

  • Ran openssl s_client -connect ServerA2:443, got the two errors above.

Issued Cert snippet

    Version: 3 (0x2)
    Serial Number:
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: DC=com, DC=domainA1, CN=DomainA1-Server1CA
    Not Before: April  5 16:45:48 2017 GMT
    Not After : April  5 16:45:48 2019 GMT
    Subject: C=US, ST=NY, L=CityA, O=CompanyNAME, OU=IT,

CA Chain Cert

    Data: Version: 3 (0x2) 
    Serial Number: 19:11:eb:af:4c:d5:a9:94:49:ka:2f:41:f2:e1:09:g2 
    Signature Algorithm: sha256WithRSAEncryption 
    Issuer: DC=com, DC=domainA1, CN=DomainA1-Server1CA 
    Not Before: Aug 15 18:41:45 2015 GMT 
    Not After : Aug 15 18:41:45 2025 GMT Subject: DC=com, DC=domainA1,                 
    CN=DomainA1-Server1CA Subject Public Key Info: 
    Public Key Algorithm: rsaEncryption Public-Key: (2048 bit)

    X509v3 Key Usage:
        Digital Signature, Certificate Sign, CRL Sign
    X509v3 Basic Constraints: critical
    X509v3 Subject Key Identifier:
  • OpenSSL and NSS are completely separate pieces of software, and putting a cert in the NSS DB has no effect at all on OpenSSL or anything using OpenSSL. You don't give any clue what Linux distro or other build you are using; some have tools that coordinate the implemented trust stores (often OpenSSL, NSS, Java) but they differ widely. Note OpenSSL below 1.0.2 won't ever rely on a non-root anchor, and 1.0.2 won't by default, but that error wouldn't say 'first cert'. – dave_thompson_085 Apr 12 '17 at 4:45
  • @dave_thompson_085 This is redhat 6 server, openssl-1.0.2. The cert is used to for postfix mail delivery with TLS support which depends heavily on openssl. – JonLinux Apr 12 '17 at 11:36
  • I don't have RHEL, but CentOS 6 (which should be the same) has update-ca-trust which seems to be the official method for this. I don't bother and just specify my own files for (each of) the few OpenSSL-based programs where I need variant truststores; for me this doesn't include postfix, but its man page describes smtp{,d}_CA{file,path} items that look to me like other OpenSSL programs. – dave_thompson_085 Apr 15 '17 at 4:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.