I tried to run the following shell command:
openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem
publickey_imcert_chain.cert is a chain of:
- servercert.pem (public key signed by imcert.pem)
- imcert.pem (intermediate certificate signed by rootcert.pem)
I put them together using:
cat publickey.pem imcert.pem > publickey_imcert_chain.pem
- rootcert.pem is the self signed root CA certificate
Now I get the reply message:
error 20 at 0 depth lookup:unable to get local issuer certificate
And now my questions:
- Can OpenSSL verify a Public Key intermediate CA certificate chain with a root CA certificate?
- And is this even a legitimate constellation of certificates, if I put the first an the second certificate in a chain?
- Error 20 at 0 depth means OpenSSL cannot find the certificate that signed the first Certificate, right?
- But which would be the first certificate here? Would this be my public key or would it be the chain of the public key and the IM cert?