Validating a certificate chain without x509v3 Subject Key IDs

Question

I work for a hosting company and we do not currently offer certificate signing services, so we have to accept 3rd-party certificates from non-technical clients. I am trying to build a tool to verify that the keys, certificates, and intermediates provided are correct and comprise a complete chain back to a root cert.

My current solution is:

1. Check that the modulus of the Private Key matches that of the Certificate.
2. Match the Subject Key IDs up the chain until I hit a Root Certfiicate.

However, I've bumped into some ancient root certs that do not have key IDs, or x509v3 fields at all. What's the proper way to check the chain without using v3 extensions? Match up the Issuer CN with the Subject CN and then... ?

Answer 1

Turns out I did a bunch of work reinventing the wheel.

openssl verify -CAfile CA_bundle.crt somedomain.crt