How to practice making self-signed certificates with intermediate CAs

Question

I am trying to learn how ssl chain of trust works with practical examples. I thought maybe openssl would be a good education tool. But I'm running into a few problems while practicing, and I'm at a lost on how to approach my education.

Below is an experiment where I'm trying to set up certificates for a Root CA, Intermediate CA and an End User (I still don't have a confident understanding of what these terms mean despite several hours of googling and watching YouTube videos, hence my desire to experiment below).

I created and ran a bash script like this:

# make certs for root ca
openssl genrsa -out root.key 2048
openssl req -x509 -sha256 -nodes -extensions v3_ca -key root.key -subj "/C=CA/ST=ON/O=HelloWorld/CN=root.example.com" -days 3650 -out root.crt

# make certs for intermediate ca
openssl genrsa -out intermediate.key 2048
openssl req -new -sha256 -nodes -key intermediate.key -subj "/C=CA/ST=ON/O=HelloWorld/CN=intermediate.example.com" -out intermediate.csr
openssl x509 -req -extensions v3_ca -in intermediate.csr -CA root.crt -CAkey root.key -CAcreateserial -out intermediate.crt -days 500 -sha256

# make certs for end user
openssl genrsa -out enduser.key 2048
openssl req -new -sha256 -nodes -key enduser.key -subj "/C=CA/ST=ON/O=HelloWorld/CN=enduser.example.com" -out enduser.csr
openssl x509 -req -in enduser.csr -CA intermediate.crt -CAkey intermediate.key -CAcreateserial -out enduser.crt -days 500 -sha256

Then I tried to verify the enduser.crt along with the certificate chain. But these commands all fail for various reasons:

>openssl verify -CAfile intermediate.crt enduser.crt
C = CA, ST = ON, O = HelloWorld, CN = intermediate.example.com
error 2 at 1 depth lookup: unable to get issuer certificate
error enduser.crt: verification failed

>openssl verify -CAfile <(cat intermediate.crt root.crt) enduser.crt
C = CA, ST = ON, O = HelloWorld, CN = intermediate.example.com
error 24 at 1 depth lookup: invalid CA certificate
error enduser.crt: verification failed

>openssl verify -CAfile <(cat root.crt intermediate.crt) enduser.crt
C = CA, ST = ON, O = HelloWorld, CN = intermediate.example.com
error 24 at 1 depth lookup: invalid CA certificate
error enduser.crt: verification failed

This command runs fine though

>openssl verify -CAfile root.crt intermediate.crt
intermediate.crt: OK

Have I completely misunderstood how intermediate CA work or how chain of trusts work?

Answer 1

openssl x509 -req -extensions v3_ca -in intermediate.csr -CA root.crt -CAkey root.key -CAcreateserial -out intermediate.crt -days 500 -sha256

With newer versions of openssl (3.0) you get here the warning:

Warning: ignoring -extensions option without -extfile

While this warning is missing from older openssl versions (i.e. 1.1.1) it still ignores the argument. This will result in the intermediate.crt not having basic constraints CA:true and thus it is not usable as a CA certificate.

Once this is fixed by adding -extfile /etc/ssl/openssl.conf (or wherever your config is) these work fine:

$ openssl verify -CAfile <(cat intermediate.crt root.crt) enduser.crt
enduser.crt: OK

$ openssl verify -CAfile <(cat root.crt intermediate.crt) enduser.crt
enduser.crt: OK

It is still failing to verify the enduser.crt solely by using the intermediate.crt though. This is because the intermediate certificate is not a self-signed root certificate, i.e. not the end of the trust chain. To treat such an intermediate certificate as acceptable end of trust chain one need to use the -partial_chain argument:

$ openssl verify -CAfile intermediate.crt -partial_chain enduser.crt
enduser.crt: OK