1

I have server certificates for making SSL connection. So, whenever I execute

openssl s_client -engine gost -CApath /usr/local/share/ca-certificates/ -connect lk.egrz.ru:443 -servername lk.egrz.ru

I get

SSL-Session:
    Protocol  : TLSv1
    Cipher    : GOST2001-GOST89-GOST89
    Session-ID: 50AA2B055BC60403A82DBADAD8056656CB67BE639E4CC9CE605A020DE387A056
    Session-ID-ctx: 
    Master-Key: DC3812BFD75154DB7C5D0D456E5B5719E7733BF48CB2344186AD17B0166560A153CA5C9B3E3E1FBF4C453DD3114B561F
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1576144768
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
---

I believe that the error 21 (unable to verify the first certificate) means that I have no trusted cerificates on the client side.

The question is how do I import those into trusted certificates. Just like adding them in cacerts in Java.

Unfortunately, in all the tutorials the private key is specified. This is just a server certificate, I don't have it, obviously. Does mentioning -CApath in executing the command above add all the certs inside trusted?

If not, how do I specify all the certificates which the client trusts?

Thanks in advance

UPD

Here's my log with -debug enabled (command openssl s_client -engine gost -CApath /usr/local/share/ca-certificates/ -connect lk.egrz.ru:443 -servername lk.egrz.ru -debug):

engine "gost" set.
CONNECTED(00000003)
write to 0x557b72eec7b0 [0x557b72efd370] (322 bytes => 322 (0x142))
0000 - 16 03 01 01 3d 01 00 01-39 03 03 bc 22 4a 5e 5b   ....=...9..."J^[
0010 - 7d 8f 2b eb 4c 88 3f 22-87 fc a8 fc c2 03 e3 1c   }.+.L.?"........
0020 - c8 39 46 a8 a0 c0 b1 77-c9 52 37 20 78 50 bf cd   .9F....w.R7 xP..
0030 - 5a 97 dd 35 5a 56 af 40-fd 4f e8 db 57 b4 89 7d   Z..5ZV.@.O..W..}
0040 - cc 90 0d 34 3f 4d 92 5d-7c 43 da 6b 00 42 13 02   ...4?M.]|C.k.B..
0050 - 13 03 13 01 c0 2c c0 30-00 9f cc a9 cc a8 cc aa   .....,.0........
0060 - c0 2b c0 2f 00 9e c0 24-c0 28 00 6b c0 23 c0 27   .+./...$.(.k.#.'
0070 - 00 67 c0 0a c0 14 00 39-c0 09 c0 13 00 33 00 9d   .g.....9.....3..
0080 - 00 9c 00 3d 00 3c ff 85-00 81 00 35 00 2f 00 ff   ...=.<.....5./..
0090 - 01 00 00 ae 00 00 00 0f-00 0d 00 00 0a 6c 6b 2e   .............lk.
00a0 - 65 67 72 7a 2e 72 75 00-0b 00 04 03 00 01 02 00   egrz.ru.........
00b0 - 0a 00 0c 00 0a 00 1d 00-17 00 1e 00 19 00 18 00   ................
00c0 - 23 00 00 00 16 00 00 00-17 00 00 00 0d 00 36 00   #.............6.
00d0 - 34 04 03 05 03 06 03 08-07 08 08 08 09 08 0a 08   4...............
00e0 - 0b 08 04 08 05 08 06 04-01 05 01 06 01 03 03 02   ................
00f0 - 03 03 01 02 01 03 02 02-02 04 02 05 02 06 02 ee   ................
0100 - ee ef ef ed ed 00 2b 00-09 08 03 04 03 03 03 02   ......+.........
0110 - 03 01 00 2d 00 02 01 01-00 33 00 26 00 24 00 1d   ...-.....3.&.$..
0120 - 00 20 70 a3 71 dc 54 bc-fb 24 04 94 b6 e6 b0 d2   . p.q.T..$......
0130 - 69 e9 e3 8a 29 9a 4c cb-7b d0 27 53 bc 02 7e 3b   i...).L.{.'S..~;
0140 - 8b 5c                                             .\
read from 0x557b72eec7b0 [0x557b72ef4093] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 55                                    ....U
read from 0x557b72eec7b0 [0x557b72ef4098] (85 bytes => 85 (0x55))
0000 - 02 00 00 51 03 01 21 f9-b6 2b 38 ce 63 6b 19 8f   ...Q..!..+8.ck..
0010 - ff 52 58 ef 72 42 76 e0-aa 40 fe 69 9b ed b5 63   .RX.rBv..@.i...c
0020 - 33 3a 6e ca 0b 29 20 e9-ee 0a 42 26 2a d6 44 2b   3:n..) ...B&*.D+
0030 - d6 d4 38 dc d9 70 bc 79-bd bf 3b 20 c4 05 56 b1   ..8..p.y..; ..V.
0040 - e4 53 41 92 c3 41 3b 00-81 00 00 09 00 00 00 00   .SA..A;.........
0050 - ff 01 00 01 00                                    .....
read from 0x557b72eec7b0 [0x557b72ef4093] (5 bytes => 5 (0x5))
0000 - 16 03 01 07 83                                    .....
read from 0x557b72eec7b0 [0x557b72ef4098] (1923 bytes => 1923 (0x783))
0000 - 0b 00 07 7f 00 07 7c 00-07 79 30 82 07 75 30 82   ......|..y0..u0.
0010 - 07 24 a0 03 02 01 02 02-10 41 db 1c 01 51 a8 c8   .$.......A...Q..
0020 - 95 4f e0 cd 89 db ad 1c-0d 30 08 06 06 2a 85 03   .O.......0...*..
0030 - 02 02 03 30 82 01 62 31-25 30 23 06 09 2a 86 48   ...0..b1%0#..*.H
0040 - 86 f7 0d 01 09 01 16 16-53 75 70 70 6f 72 74 49   ........SupportI
0050 - 49 54 40 69 6e 66 6f 74-65 63 73 2e 72 75 31 61   IT@infotecs.ru1a
0060 - 30 5f 06 03 55 04 09 0c-58 d0 a1 d1 82 d0 b0 d1   0_..U...X.......
0070 - 80 d1 8b d0 b9 20 d0 9f-d0 b5 d1 82 d1 80 d0 be   ..... ..........
0080 - d0 b2 d1 81 d0 ba d0 be-2d d0 a0 d0 b0 d0 b7 d1   ........-.......
0090 - 83 d0 bc d0 be d0 b2 d1-81 d0 ba d0 b8 d0 b9 20   ............... 
00a0 - d0 bf d1 80 d0 be d0 b5-d0 b7 d0 b4 2c 20 d0 b4   ............, ..
00b0 - 2e 20 31 2f 32 33 2c 20-d1 81 d1 82 d1 80 2e 20   . 1/23, ....... 
00c0 - 31 31 18 30 16 06 05 2a-85 03 64 01 12 0d 31 30   11.0...*..d...10
00d0 - 32 37 37 33 39 31 31 33-30 34 39 31 1a 30 18 06   277391130491.0..
00e0 - 08 2a 85 03 03 81 03 01-01 12 0c 30 30 37 37 34   .*.........00774
00f0 - 33 30 32 30 35 36 30 31-0b 30 09 06 03 55 04 06   30205601.0...U..
0100 - 13 02 52 55 31 1c 30 1a-06 03 55 04 08 0c 13 37   ..RU1.0...U....7
0110 - 37 20 d0 b3 2e 20 d0 9c-d0 be d1 81 d0 ba d0 b2   7 ... ..........
0120 - d0 b0 31 15 30 13 06 03-55 04 07 0c 0c d0 9c d0   ..1.0...U.......
0130 - be d1 81 d0 ba d0 b2 d0-b0 31 40 30 3e 06 03 55   .........1@0>..U
0140 - 04 0a 0c 37 d0 9e d0 90-d0 9e 20 c2 ab d0 98 d0   ...7...... .....
0150 - bd d1 84 d0 be d0 a2 d0-b5 d0 9a d0 a1 20 d0 98   ............. ..
0160 - d0 bd d1 82 d0 b5 d1 80-d0 bd d0 b5 d1 82 20 d0   .............. .
0170 - a2 d1 80 d0 b0 d1 81 d1-82 c2 bb 31 1c 30 1a 06   ...........1.0..
0180 - 03 55 04 03 0c 13 d0 a3-d0 a6 20 d0 98 d0 98 d0   .U........ .....
0190 - a2 20 28 d0 9d d0 9a 31-29 30 1e 17 0d 31 37 31   . (....1)0...171
01a0 - 32 32 32 31 34 30 37 30-37 5a 17 0d 32 33 31 32   222140707Z..2312
01b0 - 32 32 31 34 32 37 30 37-5a 30 82 01 24 31 1a 30   22142707Z0..$1.0
01c0 - 18 06 09 2a 86 48 86 f7-0d 01 09 01 16 0b 69 6e   ...*.H........in
01d0 - 66 6f 40 67 67 65 2e 72-75 31 1a 30 18 06 08 2a   fo@gge.ru1.0...*
01e0 - 85 03 03 81 03 01 01 12-0c 30 30 37 37 30 37 30   .........0077070
01f0 - 38 32 30 37 31 31 18 30-16 06 05 2a 85 03 64 01   820711.0...*..d.
0200 - 12 0d 31 30 32 37 37 30-30 31 33 33 39 31 31 31   ..10277001339111
0210 - 36 30 34 06 03 55 04 0b-0c 2d d0 a3 d0 bf d1 80   604..U...-......
0220 - d0 b0 d0 b2 d0 bb d0 b5-d0 bd d0 b8 d0 b5 20 d0   .............. .
0230 - b1 d0 b5 d0 b7 d0 be d0-bf d0 b0 d1 81 d0 bd d0   ................
0240 - be d1 81 d1 82 d0 b8 31-41 30 3f 06 03 55 04 0a   .......1A0?..U..
0250 - 0c 38 d0 a4 d0 90 d0 a3-20 22 d0 93 d0 9b d0 90   .8...... "......
0260 - d0 92 d0 93 d0 9e d0 a1-d0 ad d0 9a d0 a1 d0 9f   ................
0270 - d0 95 d0 a0 d0 a2 d0 98-d0 97 d0 90 20 d0 a0 d0   ............ ...
0280 - 9e d0 a1 d0 a1 d0 98 d0-98 22 31 15 30 13 06 03   ........."1.0...
0290 - 55 04 07 0c 0c d0 9c d0-be d1 81 d0 ba d0 b2 d0   U...............
02a0 - b0 31 1c 30 1a 06 03 55-04 08 0c 13 37 37 20 d0   .1.0...U....77 .
02b0 - b3 2e 20 d0 9c d0 be d1-81 d0 ba d0 b2 d0 b0 31   .. ............1
02c0 - 0b 30 09 06 03 55 04 06-13 02 52 55 31 13 30 11   .0...U....RU1.0.
02d0 - 06 03 55 04 03 13 0a 6c-6b 2e 65 67 72 7a 2e 72   ..U....lk.egrz.r
02e0 - 75 30 63 30 1c 06 06 2a-85 03 02 02 13 30 12 06   u0c0...*.....0..
02f0 - 07 2a 85 03 02 02 24 00-06 07 2a 85 03 02 02 1e   .*....$...*.....
0300 - 01 03 43 00 04 40 76 f2-38 08 af 42 6c ab 0f 06   ..C..@v.8..Bl...
0310 - 8c 6e 69 2d e1 95 41 cf-b1 3c 04 a8 3d 00 9b 4c   .ni-..A..<..=..L
0320 - 96 e8 2f 64 6f db ad 9f-ac 3e 78 02 4d 7f 14 13   ../do....>x.M...
0330 - 51 05 37 bd b9 42 12 11-64 2f f8 22 83 e2 8b 61   Q.7..B..d/."...a
0340 - 3b 25 27 a6 41 cc a3 82-03 ec 30 82 03 e8 30 1d   ;%'.A.....0...0.
0350 - 06 03 55 1d 0e 04 16 04-14 59 61 59 81 20 ef a4   ..U......YaY. ..
0360 - 5d 11 57 8f 63 5c e3 91-18 c0 c5 8e 7d 30 2b 06   ].W.c\......}0+.
0370 - 03 55 1d 10 04 24 30 22-80 0f 32 30 31 37 31 32   .U...$0"..201712
0380 - 32 32 31 34 31 37 30 37-5a 81 0f 32 30 32 30 31   22141707Z..20201
0390 - 32 32 32 31 34 30 37 30-37 5a 30 13 06 03 55 1d   222140707Z0...U.
03a0 - 25 04 0c 30 0a 06 08 2b-06 01 05 05 07 03 01 30   %..0...+.......0
03b0 - 0e 06 03 55 1d 0f 01 01-ff 04 04 03 02 04 f0 30   ...U...........0
03c0 - 71 06 03 55 1d 1f 04 6a-30 68 30 32 a0 30 a0 2e   q..U...j0h02.0..
03d0 - 86 2c 68 74 74 70 3a 2f-2f 75 63 31 2e 69 69 74   .,http://uc1.iit
03e0 - 72 75 73 74 2e 72 75 2f-75 63 2f 43 41 2d 49 49   rust.ru/uc/CA-II
03f0 - 54 2d 4e 4b 31 2d 32 30-31 36 2e 63 72 6c 30 32   T-NK1-2016.crl02
0400 - a0 30 a0 2e 86 2c 68 74-74 70 3a 2f 2f 75 63 32   .0...,http://uc2
0410 - 2e 69 69 74 72 75 73 74-2e 72 75 2f 75 63 2f 43   .iitrust.ru/uc/C
0420 - 41 2d 49 49 54 2d 4e 4b-31 2d 32 30 31 36 2e 63   A-IIT-NK1-2016.c
0430 - 72 6c 30 82 01 a3 06 03-55 1d 23 04 82 01 9a 30   rl0.....U.#....0
0440 - 82 01 96 80 14 08 7d c7-96 fa 36 fd 2d 7e e4 47   ......}...6.-~.G
0450 - 60 e2 8d 84 7e 47 35 3b-62 a1 82 01 6a a4 82 01   `...~G5;b...j...
0460 - 66 30 82 01 62 31 25 30-23 06 09 2a 86 48 86 f7   f0..b1%0#..*.H..
0470 - 0d 01 09 01 16 16 53 75-70 70 6f 72 74 49 49 54   ......SupportIIT
0480 - 40 69 6e 66 6f 74 65 63-73 2e 72 75 31 61 30 5f   @infotecs.ru1a0_
0490 - 06 03 55 04 09 0c 58 d0-a1 d1 82 d0 b0 d1 80 d1   ..U...X.........
04a0 - 8b d0 b9 20 d0 9f d0 b5-d1 82 d1 80 d0 be d0 b2   ... ............
04b0 - d1 81 d0 ba d0 be 2d d0-a0 d0 b0 d0 b7 d1 83 d0   ......-.........
04c0 - bc d0 be d0 b2 d1 81 d0-ba d0 b8 d0 b9 20 d0 bf   ............. ..
04d0 - d1 80 d0 be d0 b5 d0 b7-d0 b4 2c 20 d0 b4 2e 20   .........., ... 
04e0 - 31 2f 32 33 2c 20 d1 81-d1 82 d1 80 2e 20 31 31   1/23, ....... 11
04f0 - 18 30 16 06 05 2a 85 03-64 01 12 0d 31 30 32 37   .0...*..d...1027
0500 - 37 33 39 31 31 33 30 34-39 31 1a 30 18 06 08 2a   7391130491.0...*
0510 - 85 03 03 81 03 01 01 12-0c 30 30 37 37 34 33 30   .........0077430
0520 - 32 30 35 36 30 31 0b 30-09 06 03 55 04 06 13 02   205601.0...U....
0530 - 52 55 31 1c 30 1a 06 03-55 04 08 0c 13 37 37 20   RU1.0...U....77 
0540 - d0 b3 2e 20 d0 9c d0 be-d1 81 d0 ba d0 b2 d0 b0   ... ............
0550 - 31 15 30 13 06 03 55 04-07 0c 0c d0 9c d0 be d1   1.0...U.........
0560 - 81 d0 ba d0 b2 d0 b0 31-40 30 3e 06 03 55 04 0a   .......1@0>..U..
0570 - 0c 37 d0 9e d0 90 d0 9e-20 c2 ab d0 98 d0 bd d1   .7...... .......
0580 - 84 d0 be d0 a2 d0 b5 d0-9a d0 a1 20 d0 98 d0 bd   ........... ....
0590 - d1 82 d0 b5 d1 80 d0 bd-d0 b5 d1 82 20 d0 a2 d1   ............ ...
05a0 - 80 d0 b0 d1 81 d1 82 c2-bb 31 1c 30 1a 06 03 55   .........1.0...U
05b0 - 04 03 0c 13 d0 a3 d0 a6-20 d0 98 d0 98 d0 a2 20   ........ ...... 
05c0 - 28 d0 9d d0 9a 31 29 82-10 d1 c8 13 01 67 a6 06   (....1)......g..
05d0 - a4 4e f5 77 58 a8 da 79-53 30 48 06 08 2b 06 01   .N.wX..yS0H..+..
05e0 - 05 05 07 01 01 04 3c 30-3a 30 38 06 08 2b 06 01   ......<0:08..+..
05f0 - 05 05 07 30 02 86 2c 68-74 74 70 3a 2f 2f 75 63   ...0..,http://uc
0600 - 31 2e 69 69 74 72 75 73-74 2e 72 75 2f 75 63 2f   1.iitrust.ru/uc/
0610 - 43 41 2d 49 49 54 2d 4e-4b 31 2d 32 30 31 36 2e   CA-IIT-NK1-2016.
0620 - 63 65 72 30 2f 06 03 55-1d 20 04 28 30 26 30 06   cer0/..U. .(0&0.
0630 - 06 04 55 1d 20 00 30 08-06 06 2a 85 03 64 71 01   ..U. .0...*..dq.
0640 - 30 08 06 06 2a 85 03 64-71 02 30 08 06 06 2a 85   0...*..dq.0...*.
0650 - 03 64 71 03 30 57 06 05-2a 85 03 64 6f 04 4e 0c   .dq.0W..*..do.N.
0660 - 4c d0 9f d1 80 d0 be d0-b3 d1 80 d0 b0 d0 bc d0   L...............
0670 - bc d0 bd d0 be 2d d0 b0-d0 bf d0 bf d0 b0 d1 80   .....-..........
0680 - d0 b0 d1 82 d0 bd d1 8b-d0 b9 20 d0 ba d0 be d0   .......... .....
0690 - bc d0 bf d0 bb d0 b5 d0-ba 63 20 56 69 50 4e 65   .........c ViPNe
06a0 - 74 20 48 53 4d 20 31 20-28 4b 42 32 29 30 81 86   t HSM 1 (KB2)0..
06b0 - 06 05 2a 85 03 64 70 04-7d 30 7b 0c 4c d0 9f d1   ..*..dp.}0{.L...
06c0 - 80 d0 be d0 b3 d1 80 d0-b0 d0 bc d0 bc d0 bd d0   ................
06d0 - be 2d d0 b0 d0 bf d0 bf-d0 b0 d1 80 d0 b0 d1 82   .-..............
06e0 - d0 bd d1 8b d0 b9 20 d0-ba d0 be d0 bc d0 bf d0   ...... .........
06f0 - bb d0 b5 d0 ba 63 20 56-69 50 4e 65 74 20 48 53   .....c ViPNet HS
0700 - 4d 20 31 20 28 4b 42 32-29 0c 25 d0 9f d0 9a 20   M 1 (KB2).%.... 
0710 - 22 56 69 50 4e 65 74 20-43 65 72 74 69 66 69 63   "ViPNet Certific
0720 - 61 74 69 6f 6e 20 41 75-74 68 6f 72 69 74 79 22   ation Authority"
0730 - 0c 01 2d 0c 01 2d 30 08-06 06 2a 85 03 02 02 03   ..-..-0...*.....
0740 - 03 41 00 bb ec 5e 14 df-d9 68 35 9d 2a 6e c7 03   .A...^...h5.*n..
0750 - e0 e7 da 45 13 0a 09 cd-23 76 6a a9 89 bc 94 01   ...E....#vj.....
0760 - ef 2b b3 c1 e5 ab 5b 17-90 c5 6a cc 8e 59 03 26   .+....[...j..Y.&
0770 - 8f 62 1e 83 20 28 5f 79-05 e2 2f f9 2b cc 27 12   .b.. (_y../.+.'.
0780 - da 6e 25                                          .n%
depth=0 emailAddress = info@gge.ru, INN = 007707082071, OGRN = 1027700133911, OU = \D0\A3\D0\BF\D1\80\D0\B0\D0\B2\D0\BB\D0\B5\D0\BD\D0\B8\D0\B5 \D0\B1\D0\B5\D0\B7\D0\BE\D0\BF\D0\B0\D1\81\D0\BD\D0\BE\D1\81\D1\82\D0\B8, O = \D0\A4\D0\90\D0\A3 \"\D0\93\D0\9B\D0\90\D0\92\D0\93\D0\9E\D0\A1\D0\AD\D0\9A\D0\A1\D0\9F\D0\95\D0\A0\D0\A2\D0\98\D0\97\D0\90 \D0\A0\D0\9E\D0\A1\D0\A1\D0\98\D0\98\", L = \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, ST = 77 \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, C = RU, CN = lk.egrz.ru
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 emailAddress = info@gge.ru, INN = 007707082071, OGRN = 1027700133911, OU = \D0\A3\D0\BF\D1\80\D0\B0\D0\B2\D0\BB\D0\B5\D0\BD\D0\B8\D0\B5 \D0\B1\D0\B5\D0\B7\D0\BE\D0\BF\D0\B0\D1\81\D0\BD\D0\BE\D1\81\D1\82\D0\B8, O = \D0\A4\D0\90\D0\A3 \"\D0\93\D0\9B\D0\90\D0\92\D0\93\D0\9E\D0\A1\D0\AD\D0\9A\D0\A1\D0\9F\D0\95\D0\A0\D0\A2\D0\98\D0\97\D0\90 \D0\A0\D0\9E\D0\A1\D0\A1\D0\98\D0\98\", L = \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, ST = 77 \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, C = RU, CN = lk.egrz.ru
verify error:num=21:unable to verify the first certificate
verify return:1
read from 0x557b72eec7b0 [0x557b72ef4093] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 04                                    .....
read from 0x557b72eec7b0 [0x557b72ef4098] (4 bytes => 4 (0x4))
0000 - 0e 00 00 00                                       ....
write to 0x557b72eec7b0 [0x557b72efd370] (210 bytes => 210 (0xD2))
0000 - 16 03 01 00 ae 10 00 00-aa 30 81 a7 30 81 a4 30   .........0..0..0
0010 - 28 04 20 81 a7 c0 d3 41-2f 18 96 af d4 bd 26 42   (. ....A/.....&B
0020 - 88 0e fe 83 8f d1 50 35-f6 c1 cb 67 b7 3b 5c e6   ......P5...g.;\.
0030 - 5b 45 90 04 04 f0 f6 bb-47 a0 78 06 07 2a 85 03   [E......G.x..*..
0040 - 02 02 1f 01 a0 63 30 1c-06 06 2a 85 03 02 02 13   .....c0...*.....
0050 - 30 12 06 07 2a 85 03 02-02 24 00 06 07 2a 85 03   0...*....$...*..
0060 - 02 02 1e 01 03 43 00 04-40 1d e9 1e cd 1a 84 12   .....C..@.......
0070 - 2c 00 38 39 bb cc 31 e9-d5 4c 9d 58 d6 fc 35 23   ,.89..1..L.X..5#
0080 - ba f4 0a 8d ce f2 42 7d-7b d0 b2 76 61 90 ac 9c   ......B}{..va...
0090 - 42 4c 4f a3 d7 53 96 9c-38 12 80 d1 1c 07 28 88   BLO..S..8.....(.
00a0 - ab f6 84 9c 14 21 70 92-8a 04 08 5f 2e e3 06 68   .....!p...._...h
00b0 - e3 01 fa 14 03 01 00 01-01 16 03 01 00 14 bc 01   ................
00c0 - b2 b4 d2 d0 f6 da c0 d2-f7 90 3d 96 f3 00 60 06   ..........=...`.
00d0 - 43 6f                                             Co
read from 0x557b72eec7b0 [0x557b72ef4093] (5 bytes => 5 (0x5))
0000 - 14 03 01 00 01                                    .....
read from 0x557b72eec7b0 [0x557b72ef4098] (1 bytes => 1 (0x1))
0000 - 01                                                .
read from 0x557b72eec7b0 [0x557b72ef4093] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 14                                    .....
read from 0x557b72eec7b0 [0x557b72ef4098] (20 bytes => 20 (0x14))
0000 - 93 b4 4c cd ea c3 44 89-de b5 57 08 1f 51 88 16   ..L...D...W..Q..
0010 - 56 ce 7d b3                                       V.}.
---
Certificate chain
 0 s:emailAddress = info@gge.ru, INN = 007707082071, OGRN = 1027700133911, OU = \D0\A3\D0\BF\D1\80\D0\B0\D0\B2\D0\BB\D0\B5\D0\BD\D0\B8\D0\B5 \D0\B1\D0\B5\D0\B7\D0\BE\D0\BF\D0\B0\D1\81\D0\BD\D0\BE\D1\81\D1\82\D0\B8, O = \D0\A4\D0\90\D0\A3 \"\D0\93\D0\9B\D0\90\D0\92\D0\93\D0\9E\D0\A1\D0\AD\D0\9A\D0\A1\D0\9F\D0\95\D0\A0\D0\A2\D0\98\D0\97\D0\90 \D0\A0\D0\9E\D0\A1\D0\A1\D0\98\D0\98\", L = \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, ST = 77 \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, C = RU, CN = lk.egrz.ru
   i:emailAddress = SupportIIT@infotecs.ru, street = "\D0\A1\D1\82\D0\B0\D1\80\D1\8B\D0\B9 \D0\9F\D0\B5\D1\82\D1\80\D0\BE\D0\B2\D1\81\D0\BA\D0\BE-\D0\A0\D0\B0\D0\B7\D1\83\D0\BC\D0\BE\D0\B2\D1\81\D0\BA\D0\B8\D0\B9 \D0\BF\D1\80\D0\BE\D0\B5\D0\B7\D0\B4, \D0\B4. 1/23, \D1\81\D1\82\D1\80. 1", OGRN = 1027739113049, INN = 007743020560, C = RU, ST = 77 \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, L = \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, O = \D0\9E\D0\90\D0\9E \C2\AB\D0\98\D0\BD\D1\84\D0\BE\D0\A2\D0\B5\D0\9A\D0\A1 \D0\98\D0\BD\D1\82\D0\B5\D1\80\D0\BD\D0\B5\D1\82 \D0\A2\D1\80\D0\B0\D1\81\D1\82\C2\BB, CN = \D0\A3\D0\A6 \D0\98\D0\98\D0\A2 (\D0\9D\D0\9A1)
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHdTCCBySgAwIBAgIQQdscAVGoyJVP4M2J260cDTAIBgYqhQMCAgMwggFiMSUw
IwYJKoZIhvcNAQkBFhZTdXBwb3J0SUlUQGluZm90ZWNzLnJ1MWEwXwYDVQQJDFjQ
odGC0LDRgNGL0Lkg0J/QtdGC0YDQvtCy0YHQutC+LdCg0LDQt9GD0LzQvtCy0YHQ
utC40Lkg0L/RgNC+0LXQt9C0LCDQtC4gMS8yMywg0YHRgtGALiAxMRgwFgYFKoUD
ZAESDTEwMjc3MzkxMTMwNDkxGjAYBggqhQMDgQMBARIMMDA3NzQzMDIwNTYwMQsw
CQYDVQQGEwJSVTEcMBoGA1UECAwTNzcg0LMuINCc0L7RgdC60LLQsDEVMBMGA1UE
BwwM0JzQvtGB0LrQstCwMUAwPgYDVQQKDDfQntCQ0J4gwqvQmNC90YTQvtCi0LXQ
mtChINCY0L3RgtC10YDQvdC10YIg0KLRgNCw0YHRgsK7MRwwGgYDVQQDDBPQo9Cm
INCY0JjQoiAo0J3QmjEpMB4XDTE3MTIyMjE0MDcwN1oXDTIzMTIyMjE0MjcwN1ow
ggEkMRowGAYJKoZIhvcNAQkBFgtpbmZvQGdnZS5ydTEaMBgGCCqFAwOBAwEBEgww
MDc3MDcwODIwNzExGDAWBgUqhQNkARINMTAyNzcwMDEzMzkxMTE2MDQGA1UECwwt
0KPQv9GA0LDQstC70LXQvdC40LUg0LHQtdC30L7Qv9Cw0YHQvdC+0YHRgtC4MUEw
PwYDVQQKDDjQpNCQ0KMgItCT0JvQkNCS0JPQntCh0K3QmtCh0J/QldCg0KLQmNCX
0JAg0KDQntCh0KHQmNCYIjEVMBMGA1UEBwwM0JzQvtGB0LrQstCwMRwwGgYDVQQI
DBM3NyDQsy4g0JzQvtGB0LrQstCwMQswCQYDVQQGEwJSVTETMBEGA1UEAxMKbGsu
ZWdyei5ydTBjMBwGBiqFAwICEzASBgcqhQMCAiQABgcqhQMCAh4BA0MABEB28jgI
r0Jsqw8GjG5pLeGVQc+xPASoPQCbTJboL2Rv262frD54Ak1/FBNRBTe9uUISEWQv
+CKD4othOyUnpkHMo4ID7DCCA+gwHQYDVR0OBBYEFFlhWYEg76RdEVePY1zjkRjA
xY59MCsGA1UdEAQkMCKADzIwMTcxMjIyMTQxNzA3WoEPMjAyMDEyMjIxNDA3MDda
MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIE8DBxBgNVHR8EajBo
MDKgMKAuhixodHRwOi8vdWMxLmlpdHJ1c3QucnUvdWMvQ0EtSUlULU5LMS0yMDE2
LmNybDAyoDCgLoYsaHR0cDovL3VjMi5paXRydXN0LnJ1L3VjL0NBLUlJVC1OSzEt
MjAxNi5jcmwwggGjBgNVHSMEggGaMIIBloAUCH3Hlvo2/S1+5Edg4o2Efkc1O2Kh
ggFqpIIBZjCCAWIxJTAjBgkqhkiG9w0BCQEWFlN1cHBvcnRJSVRAaW5mb3RlY3Mu
cnUxYTBfBgNVBAkMWNCh0YLQsNGA0YvQuSDQn9C10YLRgNC+0LLRgdC60L4t0KDQ
sNC30YPQvNC+0LLRgdC60LjQuSDQv9GA0L7QtdC30LQsINC0LiAxLzIzLCDRgdGC
0YAuIDExGDAWBgUqhQNkARINMTAyNzczOTExMzA0OTEaMBgGCCqFAwOBAwEBEgww
MDc3NDMwMjA1NjAxCzAJBgNVBAYTAlJVMRwwGgYDVQQIDBM3NyDQsy4g0JzQvtGB
0LrQstCwMRUwEwYDVQQHDAzQnNC+0YHQutCy0LAxQDA+BgNVBAoMN9Ce0JDQniDC
q9CY0L3RhNC+0KLQtdCa0KEg0JjQvdGC0LXRgNC90LXRgiDQotGA0LDRgdGCwrsx
HDAaBgNVBAMME9Cj0KYg0JjQmNCiICjQndCaMSmCENHIEwFnpgakTvV3WKjaeVMw
SAYIKwYBBQUHAQEEPDA6MDgGCCsGAQUFBzAChixodHRwOi8vdWMxLmlpdHJ1c3Qu
cnUvdWMvQ0EtSUlULU5LMS0yMDE2LmNlcjAvBgNVHSAEKDAmMAYGBFUdIAAwCAYG
KoUDZHEBMAgGBiqFA2RxAjAIBgYqhQNkcQMwVwYFKoUDZG8ETgxM0J/RgNC+0LPR
gNCw0LzQvNC90L4t0LDQv9C/0LDRgNCw0YLQvdGL0Lkg0LrQvtC80L/Qu9C10Lpj
IFZpUE5ldCBIU00gMSAoS0IyKTCBhgYFKoUDZHAEfTB7DEzQn9GA0L7Qs9GA0LDQ
vNC80L3Qvi3QsNC/0L/QsNGA0LDRgtC90YvQuSDQutC+0LzQv9C70LXQumMgVmlQ
TmV0IEhTTSAxIChLQjIpDCXQn9CaICJWaVBOZXQgQ2VydGlmaWNhdGlvbiBBdXRo
b3JpdHkiDAEtDAEtMAgGBiqFAwICAwNBALvsXhTf2Wg1nSpuxwPg59pFEwoJzSN2
aqmJvJQB7yuzweWrWxeQxWrMjlkDJo9iHoMgKF95BeIv+SvMJxLabiU=
-----END CERTIFICATE-----
subject=emailAddress = info@gge.ru, INN = 007707082071, OGRN = 1027700133911, OU = \D0\A3\D0\BF\D1\80\D0\B0\D0\B2\D0\BB\D0\B5\D0\BD\D0\B8\D0\B5 \D0\B1\D0\B5\D0\B7\D0\BE\D0\BF\D0\B0\D1\81\D0\BD\D0\BE\D1\81\D1\82\D0\B8, O = \D0\A4\D0\90\D0\A3 \"\D0\93\D0\9B\D0\90\D0\92\D0\93\D0\9E\D0\A1\D0\AD\D0\9A\D0\A1\D0\9F\D0\95\D0\A0\D0\A2\D0\98\D0\97\D0\90 \D0\A0\D0\9E\D0\A1\D0\A1\D0\98\D0\98\", L = \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, ST = 77 \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, C = RU, CN = lk.egrz.ru

issuer=emailAddress = SupportIIT@infotecs.ru, street = "\D0\A1\D1\82\D0\B0\D1\80\D1\8B\D0\B9 \D0\9F\D0\B5\D1\82\D1\80\D0\BE\D0\B2\D1\81\D0\BA\D0\BE-\D0\A0\D0\B0\D0\B7\D1\83\D0\BC\D0\BE\D0\B2\D1\81\D0\BA\D0\B8\D0\B9 \D0\BF\D1\80\D0\BE\D0\B5\D0\B7\D0\B4, \D0\B4. 1/23, \D1\81\D1\82\D1\80. 1", OGRN = 1027739113049, INN = 007743020560, C = RU, ST = 77 \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, L = \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, O = \D0\9E\D0\90\D0\9E \C2\AB\D0\98\D0\BD\D1\84\D0\BE\D0\A2\D0\B5\D0\9A\D0\A1 \D0\98\D0\BD\D1\82\D0\B5\D1\80\D0\BD\D0\B5\D1\82 \D0\A2\D1\80\D0\B0\D1\81\D1\82\C2\BB, CN = \D0\A3\D0\A6 \D0\98\D0\98\D0\A2 (\D0\9D\D0\9A1)

---
No client certificate CA names sent
---
SSL handshake has read 2058 bytes and written 532 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.0, Cipher is GOST2001-GOST89-GOST89
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : GOST2001-GOST89-GOST89
    Session-ID: E9EE0A42262AD6442BD6D438DCD970BC79BDBF3B20C40556B1E4534192C3413B
    Session-ID-ctx: 
    Master-Key: B50D6DE3F1CA679B314AE45BCA335427052177D03B3EF26C100BE588E1942F573A53F35E64DD233A053A198E6EE9A51C
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1576148987
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
---
2

OpenSSL can take CA certificates from a file and or/directory. There are standard locations build into the library but an application can also specify alternative locations. With s_client this can be done using the -CApath directory and -CAfile file arguments.

A certificate file (-CAfile) contains a list of CA certificates in PEM format. A certificate directory (-CApath) contains the separate files inside a single directory and links to these files based on the subject - see openssl rehash on how to create the necessary links.

  • Thank you very much! I've added these two to my /etc/ssl/certs/ca-certificates.crt as base64 certs and now it works like charm. I have only one question left. How to make sure that the connection is ok? I mean send a request and print a response – Rus9Mus9 Dec 12 '19 at 12:19
  • Verify return code: 0 (ok) Does it mean yet that now I can send HTTP requests and not be let down by SSL? – Rus9Mus9 Dec 12 '19 at 12:20
  • Well, I've integrated it with cURL, send a request and it works like charm! Thank you – Rus9Mus9 Dec 12 '19 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.