31

I have a certificate (for example this one) saved in a local file. Using openssl from the command line, how can I display the entire chain from this certificate to a root CA? I tried:

openssl verify -verbose -purpose sslserver -CApath /etc/ssl/certs InCommonServerCA.txt

and got this confusing output that only seems to show the leaf certificate:

InCommonServerCA.txt: C = US, O = Internet2, OU = InCommon, CN = InCommon Server CA
error 26 at 0 depth lookup:unsupported certificate purpose
OK

Any ideas?

2 Answers 2

16

For local certificates you can see the subject and direct issuer using:

openssl x509 -noout -subject -issuer -in test.crt
subject= /C=US/ST=Utah/L=SLC/O=My Organization/CN=my.server.com
issuer= /C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - SHA256 - G2

But that doesn't indicate if the certificate includes any intermediate certificates or the full chain of trust. The verify command you listed will fail if your system cannot validate the chain (example: you are missing an intermediate certificate or the root is not trusted), showing an error message like:

error 20 at 0 depth lookup:unable to get local issuer certificate

If you want to verify each entry in the file, you can use this script to show the chain of trust for a local certificate:

~ % ssl_chain.sh google.crt
 0: subject= /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
issuer= /C=US/O=Google Inc/CN=Google Internet Authority G2
 1: subject= /C=US/O=Google Inc/CN=Google Internet Authority G2
issuer= /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2: subject= /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
issuer= /C=US/O=Equifax/OU=Equifax Secure Certificate Authority

google.crt: OK
0
7

If you want to verify the chain and purpose, your openssl command is correct. The "OK" indicates the chain verifies. The error indicates there is an issue with that certificate being used for an sslserver purpose. It looks like your certificate is a CA cert, not a leaf cert.

What kind of chain info are you trying to display? You could look at the subject and issuer fields to show chaining. The verify command you used above proves that the one cert signed the other cert.

2
  • 3
    I guess I expected to see the whole chain in the output, i.e. all intermediate certs (none in this case) and finally the root CA cert. Instead, my current understanding is that I can only see that if I follow the chain by hand, open the certs one by one, and look at the issuer field.
    – cberzan
    Sep 12, 2013 at 16:15
  • 3
    If the certificates are in place on a server, you can use openssl as a client to display the chain. For example, to see the certificate chain that eTrade uses: openssl s_client -connect www.etrade.com:443 -showcerts. Also, if you have the root and intermediate certs in your trusted certs on Windows, you can double-click the cert file, then go to the "Certification Path" tab to see the chain. If the CA/intermediate certs are not trusted, you will only see the single cert in the path.
    – gtrig
    Sep 12, 2013 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.