3

I try

$ openssl s_client -connect www.google.com:443

but it openssl complains that the cert chain is invalid:

$ openssl s_client -connect www.google.com:443
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0

Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority

Why is this happening? The Equifax root cert is in my /etc/ssl/certs directory, and if I download the chain and use verify, openssl will verify the chain.

$ uname -a
Linux moxie 3.13.0-74-generic #118-Ubuntu SMP Thu Dec 17 22:52:02 UTC 2015 i686 i686 i686 GNU/Linux
$ openssl version
OpenSSL 1.0.1f 6 Jan 2014
$ openssl version -d
OPENSSLDIR: "/usr/lib/ssl"
Improve this question
1
  • 2
    There was an OpenSSL bug that made s_client wrongly fail to use the defaulted truststore while verify was correct, fixed in recent versions and RedHat; see superuser.com/a/904494/333316 – dave_thompson_085 Mar 17 '16 at 10:46
2

On OpenSSL 1.0.1f 

$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

$ openssl s_client -connect www.google.com:443
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---

On OpenSSL 1.0.2e

$ openssl version
OpenSSL 1.0.2e 3 Dec 2015

$ openssl s_client -connect www.google.com:443
CONNECTED(00000003)
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.google.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---

So looks like there is a change in behaviour from the version which you have. You could either specify the CApath explicitly or upgrade to a newer version.

Improve this answer
1

You need to explicitly specify the CA-path (at least on Ubuntu):

openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs/

Improve this answer
0

You need to read your error message, there's an answer :

unable to get local issuer certificate

the magic word is local. Point them to the folder where your root SSL certs are living, like that :

i# openssl s_client -verify on -CApath /etc/ssl/certs -connect  www.google.com:443
verify depth is 0
CONNECTED(00000003)
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = google.com
---- snip ---   
verify return:1
Start Time: 1458160977
Timeout   : 300 (sec)
Verify return code: 0 (ok)
---
^C
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.