I tried to run the following shell command:

openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem

where publickey_imcert_chain.cert is a chain of:

  • servercert.pem (public key signed by imcert.pem)
  • imcert.pem (intermediate certificate signed by rootcert.pem)

I put them together using:

cat publickey.pem imcert.pem > publickey_imcert_chain.pem 
  • rootcert.pem is the self signed root CA certificate

Now I get the reply message:

error 20 at 0 depth lookup:unable to get local issuer certificate

And now my questions:

  • Can OpenSSL verify a Public Key intermediate CA certificate chain with a root CA certificate?
  • And is this even a legitimate constellation of certificates, if I put the first an the second certificate in a chain?
  • Error 20 at 0 depth means OpenSSL cannot find the certificate that signed the first Certificate, right?
  • But which would be the first certificate here? Would this be my public key or would it be the chain of the public key and the IM cert?

2 Answers 2


First, the syntax is wrong. It should be:

openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem

CAfile is rootcert.pem...

Next that's definitely not the way openssl verify works. You must concatenate all intermediate signing certificates up to the root one in a bundle and use that bundle to verify the servercert.pem one:

cat imcert.pem rootcert.pem > verificator.bundle
openssl verify -CAfile verificator.bundle servercert.pem

You will find more references and examples in that SO question.

  • Oh sorry, I did the Syntax right but wrote it down wrong here. Jul 6, 2017 at 17:11
  • I tried the other constellation with the imcert_rootcert.pem multiple times before, and this worked, of course. But anyway, should a RADIUS Server like FreeRADIUS be able to verify a client certificate as valid, if it has the root CA and receives the clientcert_imcert_chain.pem from the client? Jul 6, 2017 at 17:25

I found another good answer to my question in Stack Overflow. Here is the link:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.