OpenSSL "verify -untrusted" - Specify Untrusted Certificate

Q

How to specify those intermediate CA certificates that form the signing chain for the server certificate for OpenSSl "verify" command? I have the certificate chain from the server saved in a file.

✍: FYIcenter.com

A

If you have the server certificate chain saved in a file, you can provide it to the OpenSSL "verify" command using the "-untrusted" option as shown below:

C:\Users\fyicenter>\local\openssl-win32\bin\openssl.exe

OpenSSL> verify -untrusted twitter_chain.pem twitter.pem
twitter.pem: C = US, O = DigiCert Inc, OU = www.digicert.com, 
   CN = DigiCert SHA2 Extended Validation Server CA
error 20 at 1 depth lookup:unable to get local issuer certificate
error in verify

The certification validation failed again with the same error: "unable to get local issuer certificate". But this time, it failed "at 1 depth lookup" instead of "at 0 depth lookup" as shown in the previous tutorial.

This tells us that the validation failed on locating the certificate of the issuer appeared on the intermediate CA certificate. To find out this issuer, we need to look at the content of the certificate chain file, "twitter_chain.pem".

C:\Users\fyicenter>type twitter_chain.pem

CONNECTED(0000017C)
---
Certificate chain
 0 s:/businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=...
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
-----BEGIN CERTIFICATE-----
MIIHnTCCBoWgAwIBAgIQB3a13cqDpLnKWY9ddx+eRjANBgkqhkiG9w0BAQsFADB1
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMTQwMgYDVQQDEytEaWdpQ2VydCBTSEEyIEV4dGVuZGVk
...
-----END CERTIFICATE-----
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-----BEGIN CERTIFICATE-----
MIIEtjCCA56gAwIBAgIQDHmpRLCMEZUgkmFf4msdgzANBgkqhkiG9w0BAQsFADBs
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
,,,
-----END CERTIFICATE-----
---
Server certificate
...

Looking the content of the certificate chain, we know that the issuer at 1 depth is "DigiCert High Assurance EV Root CA", which is a root CA.

⇒ Download Root CA Certificate

⇐ OpenSSL "verify" - Verify or Validate Certificate

⇑ OpenSSL "verify" Command

⇑⇑ OpenSSL Tutorials

2012-07-24, 15760👍, 0💬

💬 2021-11-19 ts.gil.com.pk: openssl req -new -newkey rsa:2048 -nodes -sha256 -out ts_gil_com_pk.csr -keyout ts_gil_com_pk.key -subj "/CN=ts.gil.com.pk/C=US"

OpenSSL "s_client -connect" - Show Server Certificate Chain
How to show all certificates in the server certificate chain using the OpenSSL "s_client -connect" command? I know the server uses multiple intermediate CA certificates. You can get all certificates in the server certificate chain if use "s_client -connect" with the "-showcerts" option as shown belo... 2012-07-24, 16274👍, 0💬

OpenSSL "verify -untrusted" - Specify Untrusted Certificate
How to specify those intermediate CA certificates that form the signing chain for the server certificate for OpenSSl "verify" command? I have the certificate chain from the server saved in a file. If you have the server certificate chain saved in a file, you can provide it to the OpenSSL "verify" co... 2012-07-24, 15761👍, 0💬

OpenSSL "verify -CAfile" - Specify Root CA Certificate
How to specify the root CA certificates that close the signing chain for the server certificate for OpenSSl "verify" command? I have downloaded the root CA certificate in a file. If you have the root CA certificate downloaded in a file, you can provide it to the OpenSSL "verify" command using the "-... 2012-07-24, 12009👍, 0💬

Download Root CA Certificate
How to download the certificate from a root CA? I need to the root CA certificate to close the certification validation chain. If you know the CN (Common Name) of the root CA, for example "DigiCert High Assurance EV Root CA", you can search and download it our certificate database at certificate.fyi... 2012-07-24, 10834👍, 0💬

OpenSSL "verify" - Verify or Validate Certificate
How to verify or validate a certificate using OpenSSL "verify" command? I got a certificate from the Web site server and want to see if it is valid. If you have a certificate stored in a file, you can try to validate it or verify it with the OpenSSL "verify" command as shown below: C:\Users\fyicente... 2012-07-24, 10053👍, 0💬

OpenSSL "verify" Command Options
What can I use OpenSSL "verify" command for? What are options supported by the "verify" command? OpenSSL "verify" command is a utility to verify certificates. Here are options supported by the "verify" command: C:\Users\fyicenter>\loc al\openssl\openssl.exeOpenSSL> verify -h usage: ver... 2012-07-24, 7660👍, 0💬

What Is JKS (Java KeyStore) File
What is a JKS (Java KeyStore) file? I heard that it used to provide CA certificates to Java applications. A Java Keystore file is a specially formatted file used to store cryptographic keys and certificates. A Java KeyStore file can be used to store 3 types of entries: 1. PrivateKeyEntry - This type... 2012-07-24, 7030👍, 0💬

Example of X.509 Certificate Data Structure
Can you show me an example of X.509 certificate data structure? Here is an example of X.509 Version 3 certificate data structure: Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: md5WithRSAEncryption Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, O... 2012-07-24, 5343👍, 0💬

OpenSSL Verify Operation Steps
How does the OpenSSL verify operation work? What are the steps used by OpenSSL to verify a certificate? The OpenSSL verify operation uses the same functions as the internal SSL and S/MIME verification, therefore this description applies to these verify operations too. There is one crucial difference... 2012-07-24, 5307👍, 0💬

All rights in the contents of this web site are reserved by the individual author. fyicenter.com does not guarantee the truthfulness, accuracy, or reliability of any contents.