I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers.

When I did the "openssl s_client -connect :443" it shows the error message that "Self Signed Certificate is in the Certificate of Chain".

I believe this could be due to the Root CA is self signed, as Root CA self signed its own issued certificate. And the certificate of Chain contains the concatenate of the Root and Intermediate CA certificate.

If I remove the Root CA certificate from the certificate chain file, it shows another error "unable to get local issuer certificate".

I did a "openssl verify -CAfile ", it shows ok.

I tested with a client PC to access the server with the cert installed, but only able to connect using normal port 80 but not the SSL/TLS port 443 (The site can't be reached).

I am not sure what did I miss out? and how do I troublesome? Any advice?

  • Did you add your root CA to your trust store? And the port is something completely unrelated to your certificate and security in general. – Fund Monica's Lawsuit Jul 21 '19 at 4:46
  • 1
    "The site can't be reached"- this has nothing to do with certificates. It means that either the server is not up (unlikely), listens only on localhost and is thus not accessible from outside (maybe), that there is some firewall on the servers host or in between which is restricting access (typical problem) or that you've tried to reach the wrong server (typo, invalid DNS configuration ...). – Steffen Ullrich Jul 21 '19 at 4:47
  • I added the Root CA into both Intermediate and Trusted Root CA certificate store. The site with 443 still unable to reach. But i can do port 80 hhtp access and ssh/sftp. I do not think is network issue. I discovered there is an old SSL cert push down from internal domain controller which maybe an issue. When go to google from direct server it states a secure connection could not be established and caused by this SSL in the network. Any idea how to fix it? – JT Lai Jul 23 '19 at 1:43

The first error was because s_client doesn't like to see the root CA in sent in the TLS connection. The second error is because s_client doesn't trust the root CA.

To solve this second error, run s_client with the -CAfile option and specify the root CA.

  • Thanks. I tried it with root CA specifiy in -CAfile, no error. So on client PC i tried importing Root CA to pc certificate store at Intermediate CA and Trusted Root CA, this site cannot be reached. I am not sure what i missed out? – JT Lai Jul 23 '19 at 1:26
  • See Steffen's comment on your question. "Site cannot be reached" indicates that the problem is a network issue, not a certificate issue. – ztk Jul 23 '19 at 1:37
  • Hi Steffen, you are right. I discovered my firewall blocking the access. I probably need a beer. Thank you for your help – JT Lai Jul 24 '19 at 10:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.