I have 3 certificates:
- root_ca.pem (self signed cert CA)
- issuing_ca.pem (Intermediate CA signed by root ca)
- user.pem (user cert signed by intermediate ca)
If I try to validate the chain with openssl
openssl verify -verbose -CAfile <(cat issuing_ca.pem root_ca.pem) user.pem
user.pem: CN = My Intermediate CA, ST = Virginia, C = US, O = "Corp.", OU = TEST error 2 at 1 depth lookup:unable to get issuer certificate
I have verified all the cert one by one with
openssl x509 -in xxx.pem -text
And they all match (each cert is correctly signed by the parent).
How can I debug what is the issue?
EDIT: I'll leave the post even though the issue was because the issuing_ca was not actually been signed by the provided root_ca.. (For the record I didn't create these certs myself I have just been provided with them and was certified that issuing_ca was signed by the provided root_ca)