I tried to run the following shell command:

openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem

where publickey_imcert_chain.cert is a chain of:

  • servercert.pem (public key signed by imcert.pem)
  • imcert.pem (intermediate certificate signed by rootcert.pem)

I put them together using:

cat publickey.pem imcert.pem > publickey_imcert_chain.pem 
  • rootcert.pem is the self signed root CA certificate

Now I get the reply message:

error 20 at 0 depth lookup:unable to get local issuer certificate

And now my questions:

  • Can OpenSSL verify a Public Key intermediate CA certificate chain with a root CA certificate?
  • And is this even a legitimate constellation of certificates, if I put the first an the second certificate in a chain?
  • Error 20 at 0 depth means OpenSSL cannot find the certificate that signed the first Certificate, right?
  • But which would be the first certificate here? Would this be my public key or would it be the chain of the public key and the IM cert?

2 Answers 2


First, the syntax is wrong. It should be:

openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem

CAfile is rootcert.pem...

Next that's definitely not the way openssl verify works. You must concatenate all intermediate signing certificates up to the root one in a bundle and use that bundle to verify the servercert.pem one:

cat imcert.pem rootcert.pem > verificator.bundle
openssl verify -CAfile verificator.bundle servercert.pem

You will find more references and examples in that SO question.

  • Oh sorry, I did the Syntax right but wrote it down wrong here. Commented Jul 6, 2017 at 17:11
  • I tried the other constellation with the imcert_rootcert.pem multiple times before, and this worked, of course. But anyway, should a RADIUS Server like FreeRADIUS be able to verify a client certificate as valid, if it has the root CA and receives the clientcert_imcert_chain.pem from the client? Commented Jul 6, 2017 at 17:25

I found another good answer to my question in Stack Overflow. Here is the link:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .