Certificates can only be verified using intermediate and root certificates in one file


Zbyszekkxy

The server sends two certificates during the SSL handshake, the domain certificate and the signed intermediate certificate DigiCert Global Root CA. I can verify the intermediate certificate

# openssl verify intermediate.pem
cert2.pem: OK

but not a domain certificate

# openssl verify -CAfile intermediate.pem domain.pem
cert1.pem: C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
error 2 at 1 depth lookup:unable to get issuer certificate

DigiCert SHA2 Secure Server CAis an intermediate certificate. Validation works when I connect both the intermediate and root certificates

# openssl verify -CAfile combined.pem cert1.pem
cert1.pem: OK

The root certificate exists in /etc/ssl/certs/ca-bundle.crt. The problem only occurs on docker containers (based on centos 7), it works fine on the host. Due to this validation issue, the SSL handshake fails and the connection to the server is dropped. What can I do to fix this problem?

Steffen Ullrich
# openssl verify -CAfile intermediate.pem domain.pem
cert1.pem: C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
error 2 at 1 depth lookup:unable to get issuer certificate

openssl expects a chain of trust to be established before the root certificate is trusted. The intermediate certificate may be trusted, but not the root certificate (not self-signed). This means that by default, if the root certificate is not provided, the verification will fail.

-partial_chainIn newer versions there is an option to verify success when it ends with a trusted certificate even if it openssl verifyis not a root certificate . There is a similar option X509_V_FLAG_PARTIAL_CHAINin the OpenSSL library . But this needs to be explicitly enabled by the application, i.e. disabled by default.

The root certificate is located in /etc/ssl/certs/ca-bundle.crt. The problem only occurs on docker containers (based on centos 7), it works fine on the host. Due to this validation issue, the SSL handshake fails and the connection to the server is dropped. What can I do to fix this problem?

Unfortunately, it's not clear if the root certificate is also a) the root certificate in the docker container, b) the type of application contained in the container and the code used to validate the certificate, and c) the server application correctly provides all intermediate The certificate is as it should be. In other words: what you see openssl verifymay have nothing to do with your experience with an unknown app.

Related


Obtain root and intermediate certificates from end entities

uprising: Still new to cryptography, I stumble across something simple every day. Today is just one of those days. I want to validate smime messages in Java using the bouncy castle library, I think I almost got it, but the current problem is the construction o

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Obtain root and intermediate certificates from end entities

uprising: Still new to cryptography, I stumble across something simple every day. Today is just one of those days. I want to validate smime messages in Java using the bouncy castle library, I think I almost got it, but the current problem is the construction o

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Disable certificates in root using PowerShell

Adam Use Windows Server Core. I want to disable certificates in store root folder. I have the certificate thumbprint that I want to disable, and according to the image below, I can do this through the Windows UI. But I want to do it through Powershell. I can't

Install intermediate CA certificates

Harvey I have a Kubernetes cluster hosting my own docker registry built with the following docs : https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/registry and https://github.com/kubernetes/kubernetes /blob/master/cluster/addons/registry/tls

Are intermediate certificates cached in Firefox?

Kit Sunde If someone visits Site A with a GoDaddy-issued certificate that also provides an intermediate certificate between GoDaddy and its CA, then Firefox will cache that intermediate certificate and compare it with a site that also has a GoDaddy-issued cert

Are intermediate certificates cached in Firefox?

Kit Sunde If someone visits Site A with a GoDaddy-issued certificate that also provides an intermediate certificate between GoDaddy and its CA, then Firefox will cache that intermediate certificate and compare it with a site that also has a GoDaddy-issued cert

Does Android only work on CA Root certificates?

Jeevan Roy dsouza I have created self signed certificate and installed in server. To enable https in android, ca root certificate is required. Android doesn't work with self-signed certificate? galbenheim The documentation at http://developer.android.com/train

Does Android only work on CA Root certificates?

Jeevan Roy dsouza I have created self signed certificate and installed in server. To enable https in android, ca root certificate is required. Android doesn't work with self-signed certificate? galbenheim The documentation at http://developer.android.com/train

Using NFe Web Services After Updating Intermediate Certificates

Clayton Strow I get back the error: The underlying connection was closed: Could not establish trust relationship for SSL/TLS secure channel. How to install new certificate chain in azure? I have tried including new strings in the pfx file without success. When

Combine certificates and keys in DER format into one file

ky Using PEM catdoes the job just fine: cat key.pem cert.pem >cert+key.pem Extraction works fine openssl pkey -text -noout -in cert+key.pem # OK openssl x509 -text -noout -in cert+key.pem # OK But using DER doesn't work properly. cat cert.der key.der >cert

Combine certificates and keys in DER format into one file

ky Using PEM catdoes the job just fine: cat key.pem cert.pem >cert+key.pem Extraction works fine openssl pkey -text -noout -in cert+key.pem # OK openssl x509 -text -noout -in cert+key.pem # OK But using DER doesn't work properly. cat cert.der key.der >cert

Combine certificates and keys in DER format into one file

ky Using PEM catdoes the job just fine: cat key.pem cert.pem >cert+key.pem Extraction works fine openssl pkey -text -noout -in cert+key.pem # OK openssl x509 -text -noout -in cert+key.pem # OK But using DER doesn't work properly. cat cert.der key.der >cert

Combine certificates and keys in DER format into one file

ky Using PEM catdoes the job just fine: cat key.pem cert.pem >cert+key.pem Extraction works fine openssl pkey -text -noout -in cert+key.pem # OK openssl x509 -text -noout -in cert+key.pem # OK But using DER doesn't work properly. cat cert.der key.der >cert

Combine certificates and keys in DER format into one file

ky Using PEM catdoes the job just fine: cat key.pem cert.pem >cert+key.pem Extraction works fine openssl pkey -text -noout -in cert+key.pem # OK openssl x509 -text -noout -in cert+key.pem # OK But using DER doesn't work properly. cat cert.der key.der >cert