I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers.

When I did the "openssl s_client -connect :443" it shows the error message that "Self Signed Certificate is in the Certificate of Chain".

I believe this could be due to the Root CA is self signed, as Root CA self signed its own issued certificate. And the certificate of Chain contains the concatenate of the Root and Intermediate CA certificate.

If I remove the Root CA certificate from the certificate chain file, it shows another error "unable to get local issuer certificate".

I did a "openssl verify -CAfile ", it shows ok.

I tested with a client PC to access the server with the cert installed, but only able to connect using normal port 80 but not the SSL/TLS port 443 (The site can't be reached).

I am not sure what did I miss out? and how do I troublesome? Any advice?

closed as off-topic by Steffen Ullrich, MechMK1, Xander, multithr3at3d, A. Hersean Jul 26 at 13:54

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, Xander, multithr3at3d
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Did you add your root CA to your trust store? And the port is something completely unrelated to your certificate and security in general. – Nic Hartley Jul 21 at 4:46
  • 1
    "The site can't be reached"- this has nothing to do with certificates. It means that either the server is not up (unlikely), listens only on localhost and is thus not accessible from outside (maybe), that there is some firewall on the servers host or in between which is restricting access (typical problem) or that you've tried to reach the wrong server (typo, invalid DNS configuration ...). – Steffen Ullrich Jul 21 at 4:47
  • I added the Root CA into both Intermediate and Trusted Root CA certificate store. The site with 443 still unable to reach. But i can do port 80 hhtp access and ssh/sftp. I do not think is network issue. I discovered there is an old SSL cert push down from internal domain controller which maybe an issue. When go to google from direct server it states a secure connection could not be established and caused by this SSL in the network. Any idea how to fix it? – JT Lai Jul 23 at 1:43

The first error was because s_client doesn't like to see the root CA in sent in the TLS connection. The second error is because s_client doesn't trust the root CA.

To solve this second error, run s_client with the -CAfile option and specify the root CA.

  • Thanks. I tried it with root CA specifiy in -CAfile, no error. So on client PC i tried importing Root CA to pc certificate store at Intermediate CA and Trusted Root CA, this site cannot be reached. I am not sure what i missed out? – JT Lai Jul 23 at 1:26
  • See Steffen's comment on your question. "Site cannot be reached" indicates that the problem is a network issue, not a certificate issue. – ztk Jul 23 at 1:37
  • Hi Steffen, you are right. I discovered my firewall blocking the access. I probably need a beer. Thank you for your help – JT Lai Jul 24 at 10:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.