There is a known OpenSSL bug where s_client doesn't check the default certificate store when you don't pass the -CApath
or -CAfile
argument. OpenSSL on Ubuntu 14.04 suffers from this bug as I'll demonstrate:
Version:
ubuntu@puppetmaster:/etc/ssl$ openssl version
OpenSSL 1.0.1f 6 Jan 2014
Fails to use the default store when I don't pass the `-ca:
ubuntu@puppetmaster:/etc/ssl$ openssl s_client -quiet -connect gmail.com:443
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
Now I pass null as the -CApath
and it works:
ubuntu@puppetmaster:/etc/ssl$ openssl s_client -quiet -connect gmail.com:443 -CApath /dev/null
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = mail.google.com
verify return:1
Unfortunately I don't think a list of affected OpenSSL versions exists. Only way to know is to test it.
GTE_CyberTrust_Global_Root.pem
an intermediate CA? If so, it may be that your webserver is failing to serve that intermediate CA cert along with your site cert. This shortcoming on the part of your webserver could cause compatibility issues with some computers. On the other hand, if theGTE_CyberTrust_Global_Root.pem
is a top-level root certificate then it should be working by default.openssl
is not configured with any top-level root certs? Have you triedgoogle.com:443
?