I try
$ openssl s_client -connect www.google.com:443
but it openssl complains that the cert chain is invalid:
$ openssl s_client -connect www.google.com:443
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
Certificate chain
0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
i:/C=US/O=Google Inc/CN=Google Internet Authority G2
1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
Why is this happening? The Equifax root cert is in my /etc/ssl/certs directory, and if I download the chain and use verify
, openssl will verify the chain.
$ uname -a
Linux moxie 3.13.0-74-generic #118-Ubuntu SMP Thu Dec 17 22:52:02 UTC 2015 i686 i686 i686 GNU/Linux
$ openssl version
OpenSSL 1.0.1f 6 Jan 2014
$ openssl version -d
OPENSSLDIR: "/usr/lib/ssl"
s_client
wrongly fail to use the defaulted truststore whileverify
was correct, fixed in recent versions and RedHat; see superuser.com/a/904494/333316 – dave_thompson_085 Mar 17 '16 at 10:46