I have a website, which has a signed certificate file (website.crt) from a certificate authority (CA).

How do I make sure exactly, that this certificate is valid?

I know, that browsers do it automatically, but I want to do it by hand, with tools like openssl, so I can learn about the process, and understand what browser do exactly.

Let's assume, that I have one root certificate on my computer, and that there are other intermediate authorities. Also, for the sake of accuracy, it uses x.509 version 3 standard.


1 Answer 1


Copy all CA certificates in PEM format including root into a single file. Certificate can be mostly in one of these two formats: PEM format is text, DER is binary. If it is in DER - can convert this way:

openssl x509 -in <certificate in DER> -inform DER -out <certificate in PEM> -outform PEM

Then concatenate all CA certificates in PEM format into a single file:

cat cert1.cer >> all_certs.cer
cat cert2.cer >> all_certs.cer

Then validate your certificate against this certificate chain:

openssl verify -CAfile all_certs.cer <your certificate>
  • (1) that cp syntax doesn't work on Unix (and cp doesn't exist on Windows) (2) commandline verify doesn't check revocation by default, and only has options for CRL not OCSP which is now more common in browsers (except Chrome which uses Google-chosen checks) (3) verify also doesn't check 'purpose' (EKU) or hostname by default -- or policies, but I don't know if browsers do those Feb 10, 2019 at 4:06
  • (1) mistake, replaced cp with cat in my answer. Thanks for correction. On Windows you can accumulate CA certificates in a notepad. (2) yes, command verify checks only whether the whole certificate chain is trusted. what else do you need to check? Please list and I will add it (3) you are right, you need to check it manually
    – Oleg
    Feb 10, 2019 at 8:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .