I have 3 certificates:

  • root_ca.pem (self signed cert CA)
  • issuing_ca.pem (Intermediate CA signed by root ca)
  • user.pem (user cert signed by intermediate ca)

If I try to validate the chain with openssl

openssl verify -verbose -CAfile <(cat issuing_ca.pem root_ca.pem) user.pem

I get:

user.pem: CN = My Intermediate CA, ST = Virginia, C = US, O = "Corp.", OU = TEST
error 2 at 1 depth lookup:unable to get issuer certificate

I have verified all the cert one by one with

openssl x509 -in xxx.pem -text

And they all match (each cert is correctly signed by the parent).

How can I debug what is the issue?

EDIT: I'll leave the post even though the issue was because the issuing_ca was not actually been signed by the provided root_ca.. (For the record I didn't create these certs myself I have just been provided with them and was certified that issuing_ca was signed by the provided root_ca)

  • (0) is it issuing_ca.pem or .pen? (1) Does intermediate have AuthorityKeyID (AKI) and if so does it correctly match root? (2) Does root have BasicConstraints and if so does it have CA:TRUE? (3) Does root have Key Usage and if so does it have Certificate Sign? (4) If you have 1.1.0 up, try each step separately: verify -CAfile imed -partial_chain user and verify -CAfile root imed – dave_thompson_085 May 19 at 3:29
  • Yep, I saw one of your comment (specially the keyUsage one) in an other SO post and had already checked all these stuff. verify -CAfile root imed was what convinced me something that something was not right with the root – Marco May 19 at 4:06
  • I'm voting to close this question as off-topic because it was a technical error – schroeder May 22 at 7:03

Browse other questions tagged or ask your own question.