1

I am trying to figure out how to use OpenSSL to verify a certificate that has been signed by an intermediate CA which I have signed with my root CA. I tried concatenating the certificate with the intermediate and root certificates as I saw suggested in some places, but I still get an "unable to get local issuer certificate" error. What should I do?

For reference, the command I am using is as follows:

cat my_cert.crt intermediate_ca.crt root_ca.crt > cert_chain.crt

My certificates, when concatenated, look like:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Which I believe is the correct format. The error I get is:
openssl verify -CAfile cacert.crt
cert_chain.crt: C = US, ST = State, O = Company, OU = Unit, CN = Common Name

Improve this question
4
  • 1
    Yes? What is the command you are using to concatenate?
    – noleti
    Aug 5, 2014 at 5:40
  • cat my_cert.crt intermediate_ca.crt root_ca.crt > cert_chain.crt
    – Yas
    Aug 5, 2014 at 6:09
  • Your certificates seem to be in DER format, do they start with a BEGIN line? If not, convert them to .pem based on this: stackoverflow.com/questions/991758/… and then try the concatenation with the .pem files. If that does not work, please post error messages or more information in your question.
    – noleti
    Aug 5, 2014 at 6:43
  • I've edited the post as I couldn't get it to format properly in a comment.
    – Yas
    Aug 5, 2014 at 16:26

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .