I've been following this tutorial to create a Root CA, intermediate CA, and server certificate.
I can verify:
- the intermediate certificate with the root certificate
- the server certificate with the intermediate certificate
But I can't verify the bundle intermediate cert + server cert with the root certificate.
In other words:
# verify intermediate cert with root cert: OK openssl verify -CAfile root/certs/ca.cert.pem intermediate/certs/intermediate.cert.pem # verify server cert with intermediate cert: OK openssl verify -CAfile intermediate/certs/intermediate.cert.pem intermediate/certs/my.domain.cert.pem # create bundle intermediate cert + server cert cat intermediate/certs/my.domain.cert.pem intermediate/certs/intermediate.cert.pem > certs/my.domain.bundle.pem # checking bundle with the root cert: NOT OK openssl verify -CAfile root/certs/ca.cert.pem intermediate/certs/my.domain.bundle.pem # NOT OK
That confuses me because I thought I would deploy the Root CA certificate on clients, and have the server use the bundle intermediate cert + server cert.
Does that mean I should only deploy the intermediate cert on clients, and have the server use only the server cert?