3

Tried following openssl command to show the certificate chain,but the ROOT certificate 'depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign' is not shown in the output...Why?

openssl s_client -connect www.google.com:443 -showcerts -verify 5
verify depth is 5
CONNECTED(00000003)
depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = US, O = Google Trust Services, CN = Google Internet Authority G3
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com
   i:/C=US/O=Google Trust Services/CN=Google Internet Authority G3
-----BEGIN CERTIFICATE-----
MIIEijCCA3KgAwIBAgIQbMi2/H2Kg35uZWK5LXuz9zANBgkqhkiG9w0BAQsFADBU
MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMSUw
IwYDVQQDExxHb29nbGUgSW50ZXJuZXQgQXV0aG9yaXR5IEczMB4XDTE5MDcyOTE4
NDQ0OFoXDTE5MTAyMTE4MjMwMFowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNh
bGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNVBAoMCkdvb2ds
ZSBMTEMxFzAVBgNVBAMMDnd3dy5nb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEA7hUSD19WedKBwsARSaa+Ij0aPBIB4S1geVSTPwXeh0zD
a+FMzpjXEbUMInxTyXcl9ChCm7BFuak39dz9d08/+xsJt7hxzagPMTLcWY23wL52
+Mn3Jk4zoJbPm9bqnxpMUkD0cd9Y1fFnp+pHIaHQjQ9ZRHlc5bxemJl2tThUaXIQ
T/OEyIwu6RbT19PWYUqkU93IYxiroXoln+Rvq82boMSG7LQlPVjkfVpxrP7BrUxX
ILr6L6/UATrjTo5UDCZCTPMvPErtvH/4L1skH+fou+EFa5JidiqZM+fEoKjGZvzf
Isbe4zMasK5nWQ8s2C10GW6DzYtMD66/2sXc2pW46QIDAQABo4IBQjCCAT4wEwYD
VR0lBAwwCgYIKwYBBQUHAwEwGQYDVR0RBBIwEIIOd3d3Lmdvb2dsZS5jb20waAYI
KwYBBQUHAQEEXDBaMC0GCCsGAQUFBzAChiFodHRwOi8vcGtpLmdvb2cvZ3NyMi9H
VFNHSUFHMy5jcnQwKQYIKwYBBQUHMAGGHWh0dHA6Ly9vY3NwLnBraS5nb29nL0dU
U0dJQUczMB0GA1UdDgQWBBTyRStKq0oAeHnjcN+n2GGjhBQmMTAMBgNVHRMBAf8E
AjAAMB8GA1UdIwQYMBaAFHfCuFCaZ3Z2sS3ChtCDoH6mfrpLMCEGA1UdIAQaMBgw
DAYKKwYBBAHWeQIFAzAIBgZngQwBAgIwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDov
L2NybC5wa2kuZ29vZy9HVFNHSUFHMy5jcmwwDQYJKoZIhvcNAQELBQADggEBAAZT
T6K2H6DLtkUpBDh2f3gjVh2SNKr21znx1NWlJwsiFAgvOUjpgu5u84JsHRbd+ykH
7b/nQMxEBIIb+kVbk4H2RfnBFEYIGRpE8XZ0PZCRP/JaQ4WNg8cXnwIguYSSrdeR
ssrRBL+9i7CBZ9L+S6RW5UqUYelT/mowagPWVHQ7ei2G6lFzXWGuar0lFjF9MeJG
aRPbUhBWlG1I9g+RIYgJObftkrSuFxFtnu/9Q38PDaILPewcjk5aKujBZCYskNIF
LbxBicJi1xBWF5b4AVmDF1y28GywVoiXfZTS1Z+Qg0hfoSTk/lNKmuvLitQSP1+7
8H55h0/RgKkaY8UImAo=
-----END CERTIFICATE-----
 1 s:/C=US/O=Google Trust Services/CN=Google Internet Authority G3
   i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign
-----BEGIN CERTIFICATE-----
MIIEXDCCA0SgAwIBAgINAeOpMBz8cgY4P5pTHTANBgkqhkiG9w0BAQsFADBMMSAw
HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEGA1UEChMKR2xvYmFs
U2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjAeFw0xNzA2MTUwMDAwNDJaFw0yMTEy
MTUwMDAwNDJaMFQxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVHb29nbGUgVHJ1c3Qg
U2VydmljZXMxJTAjBgNVBAMTHEdvb2dsZSBJbnRlcm5ldCBBdXRob3JpdHkgRzMw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKUkvqHv/OJGuo2nIYaNVW
XQ5IWi01CXZaz6TIHLGp/lOJ+600/4hbn7vn6AAB3DVzdQOts7G5pH0rJnnOFUAK
71G4nzKMfHCGUksW/mona+Y2emJQ2N+aicwJKetPKRSIgAuPOB6Aahh8Hb2XO3h9
RUk2T0HNouB2VzxoMXlkyW7XUR5mw6JkLHnA52XDVoRTWkNty5oCINLvGmnRsJ1z
ouAqYGVQMc/7sy+/EYhALrVJEA8KbtyX+r8snwU5C1hUrwaW6MWOARa8qBpNQcWT
kaIeoYvy/sGIJEmjR0vFEwHdp1cSaWIr6/4g72n7OqXwfinu7ZYW97EfoOSQJeAz
AgMBAAGjggEzMIIBLzAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUH
AwEGCCsGAQUFBwMCMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFHfCuFCa
Z3Z2sS3ChtCDoH6mfrpLMB8GA1UdIwQYMBaAFJviB1dnHB7AagbeWbSaLd/cGYYu
MDUGCCsGAQUFBwEBBCkwJzAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AucGtpLmdv
b2cvZ3NyMjAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLnBraS5nb29nL2dz
cjIvZ3NyMi5jcmwwPwYDVR0gBDgwNjA0BgZngQwBAgIwKjAoBggrBgEFBQcCARYc
aHR0cHM6Ly9wa2kuZ29vZy9yZXBvc2l0b3J5LzANBgkqhkiG9w0BAQsFAAOCAQEA
HLeJluRT7bvs26gyAZ8so81trUISd7O45skDUmAge1cnxhG1P2cNmSxbWsoiCt2e
ux9LSD+PAj2LIYRFHW31/6xoic1k4tbWXkDCjir37xTTNqRAMPUyFRWSdvt+nlPq
wnb8Oa2I/maSJukcxDjNSfpDh/Bd1lZNgdd/8cLdsE3+wypufJ9uXO1iQpnh9zbu
FIwsIONGl1p3A8CgxkqI/UAih3JaGOqcpcdaCIzkBaR9uYQ1X4k2Vg5APRLouzVy
7a8IVk6wuy6pm+T7HT4LY8ibS5FEZlfAFLSW8NwsVz9SBK2Vqn1N0PIMn5xA6NZV
c7o835DLAFshEWfC7TIe3g==
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com
issuer=/C=US/O=Google Trust Services/CN=Google Internet Authority G3
---
No client certificate CA names sent
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 2994 bytes and written 373 bytes
Improve this question
1

1 Answer 1

Reset to default
3

You are having the wrong assumption on what -showcerts does or what the server should sent. From the documentation:

-showcerts
Displays the server certificate list as sent by the server: it only consists of certificates the server has sent (in the order the server has sent them). It is not a verified chain.

Since the root certificate should not be sent by the server (it has to exist locally as trust anchor) the output when connecting to a properly configured server should only consist of the leaf certificate and the chain certificate(s). And this is what you actually get.

Improve this answer
3
  • Do you mean that openssl output could show depth upto 3(0,1,2) and show the chain till depth 2(0,1)? ``` depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = Google Internet Authority G3 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 ```
    – Redhat
    Commented Aug 27, 2019 at 4:24
  • @Redhat: One thing is information about the verified chain and the root is obviously part of it. The other (-showcerts) is information about the certificates sent by the server where root should not be part of. The certificates sent by the server are only part of the verified chain.
    – Steffen Ullrich
    Commented Aug 27, 2019 at 4:30
  • What I see in wireshark from a tcpdump capture is that all certificates in the chain are sent, inclusive the root certificate.
    – ericj
    Commented Apr 15, 2021 at 8:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .