I have 3 certificates:

  • root_ca.pem (self signed cert CA)
  • issuing_ca.pem (Intermediate CA signed by root ca)
  • user.pem (user cert signed by intermediate ca)

If I try to validate the chain with openssl

openssl verify -verbose -CAfile <(cat issuing_ca.pem root_ca.pem) user.pem

I get:

user.pem: CN = My Intermediate CA, ST = Virginia, C = US, O = "Corp.", OU = TEST
error 2 at 1 depth lookup:unable to get issuer certificate

I have verified all the cert one by one with

openssl x509 -in xxx.pem -text

And they all match (each cert is correctly signed by the parent).

How can I debug what is the issue?

EDIT: I'll leave the post even though the issue was because the issuing_ca was not actually been signed by the provided root_ca.. (For the record I didn't create these certs myself I have just been provided with them and was certified that issuing_ca was signed by the provided root_ca)

closed as off-topic by schroeder May 22 at 7:03

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • (0) is it issuing_ca.pem or .pen? (1) Does intermediate have AuthorityKeyID (AKI) and if so does it correctly match root? (2) Does root have BasicConstraints and if so does it have CA:TRUE? (3) Does root have Key Usage and if so does it have Certificate Sign? (4) If you have 1.1.0 up, try each step separately: verify -CAfile imed -partial_chain user and verify -CAfile root imed – dave_thompson_085 May 19 at 3:29
  • Yep, I saw one of your comment (specially the keyUsage one) in an other SO post and had already checked all these stuff. verify -CAfile root imed was what convinced me something that something was not right with the root – Marco May 19 at 4:06
  • I'm voting to close this question as off-topic because it was a technical error – schroeder May 22 at 7:03

Browse other questions tagged or ask your own question.