openssl verify error: unable to get local issuer certificate

Question

I have a test certificate chain that I generated and it fails the openssl verify command:

openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem

The output I get from the command is :

C = US, ST = CA, O = service, CN = service Test Cert
error 20 at 0 depth lookup: unable to get local issuer certificate

To me, this implies that openssl can verify the immediate cert, but not the server cert. Included below is the ca certificate, intermediate certificate and server certificate. Can anyone spot what the problem is?

The ca cert:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:c9:17:45:72:1b:05:4e:26:28:dc:18:18:27:c2:3a:9e:54:32:6e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = CA, O = service, CN = service CA
        Validity
            Not Before: Sep 18 23:08:08 2020 GMT
            Not After : Aug 25 23:08:08 2120 GMT
        Subject: C = US, ST = CA, O = service, CN = service CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:e9:d4:de:bf:2d:84:2e:e7:90:fc:fd:0f:b8:ed:
                    d9:a5:c2:c3:12:c1:f0:b3:39:68:ea:bc:29:89:a7:
                    dd:c5:4e:c3:e6:a7:fe:12:91:4e:68:57:75:19:63:
                    6d:4a:f4:59:f1:5d:8a:c3:13:e8:54:2c:fa:5d:2c:
                    cb:6d:cc:b0:f1:d5:8c:c8:ce:74:9f:5a:af:a3:34:
                    ae:76:b4:e4:72:98:a2:f9:c0:be:e7:d9:40:e8:b4:
                    fc:53:a6:5b:ae:f5:73:25:f6:1d:6f:f2:89:4f:89:
                    03:cc:2e:a5:7a:05:fa:c7:57:e2:88:ac:6a:0e:5a:
                    b3:3c:1a:6d:c6:a1:11:c9:86:b2:03:c8:5e:11:fc:
                    03:3b:90:db:e4:46:21:52:cb:22:bd:da:cf:ef:cd:
                    e8:38:88:98:ce:66:1a:a7:32:49:3f:73:0b:d6:a5:
                    db:33:c7:f1:85:a7:49:10:53:a7:6c:7c:92:12:6d:
                    25:ca:09:fd:1f:33:4a:d6:f5:d4:52:11:99:5b:20:
                    0f:23:62:d7:d1:b7:a3:08:01:2b:3a:f8:c1:3b:b3:
                    89:0a:dd:3f:a8:c1:83:d0:78:f7:69:56:f7:52:47:
                    b4:1e:1a:29:4d:f7:28:a6:64:45:8c:1e:e4:a8:ec:
                    51:9f:bd:12:d3:f0:bc:ae:31:60:bd:5e:df:34:ed:
                    95:4d:b3:57:48:e6:7d:85:c6:36:e1:ba:c8:3a:b4:
                    ac:33:77:09:a7:60:d2:14:66:3a:12:3f:da:0c:d8:
                    22:70:5a:72:6a:4f:b5:50:85:4f:62:f2:00:35:97:
                    c9:ba:f9:25:86:1e:ca:f2:c0:34:63:d5:bb:38:d4:
                    54:1a:e1:d3:98:4b:bb:82:25:da:36:8d:42:39:8d:
                    6c:6a:4e:ed:ca:f4:52:11:b4:8e:2a:06:05:6d:f1:
                    18:d3:77:04:39:e5:7c:42:f5:65:0e:29:d7:2b:7f:
                    7f:e0:56:bd:db:68:c7:26:0f:d8:f3:db:fb:18:6d:
                    b0:08:9b:49:53:07:b8:fd:54:71:68:40:6b:b5:67:
                    f3:25:59:68:85:66:e3:b0:ed:ed:49:e6:98:43:d7:
                    be:d4:df:64:52:ea:62:b6:e5:83:00:a9:f9:3e:3d:
                    4c:b6:a2:e9:b0:c9:1b:bc:1b:02:1c:9f:a3:76:af:
                    5f:da:f7:61:3f:19:16:a5:19:be:35:7d:67:85:60:
                    4f:df:f4:ae:cd:fb:32:75:3f:b3:7b:3c:8d:80:d0:
                    42:2d:77:f5:e2:c0:aa:9e:b6:e7:07:7a:98:48:bf:
                    7c:a9:97:f2:8e:4e:32:40:e3:7a:e7:c9:f8:35:4d:
                    0e:5d:1d:62:fc:2c:db:b1:c6:73:c7:57:ef:f1:7d:
                    42:ad:d1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                0E:03:13:DC:2F:CC:CC:5C:04:2F:57:82:5D:76:8D:62:FE:07:CD:46
            X509v3 Authority Key Identifier: 
                keyid:0E:03:13:DC:2F:CC:CC:5C:04:2F:57:82:5D:76:8D:62:FE:07:CD:46

            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
         e8:20:6b:59:d3:cb:2b:ab:d5:50:56:c0:48:26:9a:2d:e1:92:
         bc:bb:1b:43:13:63:47:ba:5e:b7:6d:3f:ce:b1:ef:17:51:2f:
         5a:48:87:f3:03:1f:23:d0:54:0d:cd:f1:81:46:72:ba:3d:15:
         99:1f:4a:ea:e5:37:76:ad:38:af:96:1e:77:7d:86:e4:01:a3:
         6a:bd:9f:b0:db:ed:9e:63:f3:f5:ac:c9:e2:90:3d:70:1c:4d:
         7e:7f:03:a7:77:5e:c3:c7:ee:9f:b0:2e:08:8f:82:b0:83:75:
         52:35:e9:0c:cb:92:1d:45:19:ca:0d:cc:30:6b:65:be:0f:bb:
         11:13:52:28:04:00:da:84:e1:6c:6f:c5:b5:75:c4:5b:bb:1d:
         5f:bb:7d:73:f4:48:01:e5:6c:8e:bf:0c:cf:d9:bc:09:30:4e:
         92:dd:13:a3:0a:c6:1a:ad:99:5e:e1:b5:44:47:45:91:20:59:
         b1:92:73:1b:45:51:5b:a3:4d:dd:6e:52:32:15:e0:c2:f6:4c:
         02:1c:60:bf:4b:79:85:86:c2:d5:de:88:56:93:83:36:fa:00:
         29:c8:4e:df:dc:06:2a:80:0c:47:ca:57:ef:49:8a:29:10:18:
         36:57:62:91:52:01:59:bf:07:f0:c1:7d:09:84:37:b8:f6:47:
         e3:5e:c2:50:f0:54:8e:50:11:87:2a:b9:7c:4f:51:e0:4f:ff:
         ef:5d:6d:dd:e2:a2:e2:df:d7:88:f2:d0:0a:8c:9b:b5:5a:d5:
         f8:9b:2a:45:69:96:f7:7a:4d:cf:63:a6:91:d2:bd:93:5c:37:
         63:a1:84:d0:c9:f9:9e:bf:7c:4f:f4:37:15:bb:ad:0a:20:1e:
         00:9a:78:cf:bf:2c:57:85:36:9d:61:63:83:ab:59:9a:bb:55:
         9b:4c:f9:1c:0f:28:32:68:75:b0:c9:b9:ea:ab:e4:29:6b:42:
         6c:3d:88:03:05:e2:6b:2a:e3:c2:92:e2:a5:55:74:9f:86:f4:
         df:01:d5:03:12:5f:43:4d:f7:06:31:b8:fb:1f:37:67:6c:16:
         a3:7f:24:4c:87:0a:93:79:73:31:8e:05:79:56:da:91:19:69:
         fc:7f:34:b1:a8:bd:01:9f:1f:31:5d:98:3a:bd:4c:9a:d6:3f:
         2d:a1:9a:36:82:7d:a1:77:fe:aa:0a:8d:c6:10:1c:d8:93:5b:
         a1:1e:18:05:52:b8:12:2e:44:69:db:66:b5:96:66:03:c8:8c:
         06:90:41:5b:41:65:24:f8:90:7c:64:4c:a1:c5:24:22:95:3f:
         24:5a:f5:69:d1:fd:c7:e6:c0:72:39:67:c9:5f:71:d1:bc:97:
         a5:80:50:a1:a8:09:9b:4f

The intermediate cert:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:cd:bd:21:8c:44:d7:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = CA, O = service, CN = service CA
        Validity
            Not Before: Sep 18 23:13:24 2020 GMT
            Not After : Aug 25 23:13:24 2120 GMT
        Subject: C = US, ST = CA, O = service
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:be:38:0a:82:a2:c9:bd:a0:e7:75:74:b7:a8:fa:
                    4d:03:e8:68:75:87:0e:94:ff:a3:8a:de:c3:c0:8d:
                    34:38:be:36:b2:01:16:d1:79:a4:f6:ed:a4:19:3c:
                    08:15:6d:62:40:f0:8f:a3:49:01:d3:03:13:c5:2c:
                    17:ae:e6:49:a7:32:36:6a:c3:18:6c:da:64:54:6c:
                    4c:04:14:fd:e2:9f:4e:25:c9:e5:8d:e6:82:62:c1:
                    1e:d9:67:5c:9b:dd:f4:8b:19:76:c3:d3:23:1b:76:
                    ae:ee:26:b0:98:02:fe:47:a7:06:d3:a5:69:91:39:
                    53:1f:d6:fa:f9:8d:4c:41:43:3d:f6:33:e6:ca:a1:
                    eb:da:0e:77:39:cc:34:78:bd:96:72:75:0b:b1:f3:
                    85:40:e3:71:4c:b4:0f:68:a1:6b:74:07:09:74:1f:
                    a0:cb:ac:80:f3:a2:7b:08:04:9d:3e:3c:8f:a8:43:
                    2a:a5:ec:46:8a:c5:30:4d:7d:9b:8b:c6:b9:af:b2:
                    7d:13:99:a6:5d:2a:4b:55:21:ee:6e:b6:5f:9f:55:
                    2e:a1:97:2b:f0:ac:e8:f7:d2:40:6d:7c:84:bc:e9:
                    31:8b:d2:31:1f:eb:23:76:e3:74:d9:b3:c1:b3:a3:
                    ec:61:04:e2:ce:9b:00:4d:f8:2d:22:e8:eb:88:a6:
                    56:e9:12:ea:16:bb:2d:e2:70:87:cb:c3:0f:6d:8f:
                    d9:a0:f8:ac:31:a2:00:df:e6:85:75:42:f2:a4:6b:
                    f3:0c:97:ac:8a:f6:85:4a:69:e3:68:89:57:2c:d5:
                    1d:60:d1:92:ae:1d:53:7d:71:6c:db:23:ff:cf:45:
                    12:1f:97:39:88:ae:33:b6:60:78:75:7f:21:ef:3d:
                    9e:be:fc:bc:e7:ef:d2:20:8c:80:21:6c:ca:4a:45:
                    67:ef:2f:0c:2d:b6:9b:aa:46:ae:5e:7c:55:d6:39:
                    f5:de:a3:1e:da:4d:b5:06:16:9f:50:79:c3:10:71:
                    d2:e8:0f:1d:dd:2e:47:20:6f:93:cc:eb:21:ff:40:
                    eb:44:2c:43:9e:85:de:29:89:0b:a7:51:fb:84:7c:
                    33:cb:7c:e1:69:ba:b0:34:00:56:f8:f2:62:8c:bd:
                    bb:87:b8:ac:b5:d3:e4:83:05:1c:68:c8:ed:57:5a:
                    84:0d:01:98:80:73:04:b7:ce:6f:a6:54:5f:69:da:
                    d1:c9:06:bd:5b:bc:0c:2a:e6:f6:52:4f:d4:d6:29:
                    1e:e4:37:5b:61:f0:b3:5f:ab:30:3d:14:44:9a:99:
                    cb:f0:f6:6e:db:4f:c5:58:13:ff:92:aa:09:2a:66:
                    06:3b:ec:bf:6b:a7:4d:fc:55:6d:92:27:41:01:6d:
                    b7:bd:25
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                12:DF:81:75:71:CA:92:D3:CE:1B:2C:2B:77:3B:9E:33:77:F3:F7:6F
            X509v3 Authority Key Identifier: 
                keyid:0E:03:13:DC:2F:CC:CC:5C:04:2F:57:82:5D:76:8D:62:FE:07:CD:46

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
         4f:95:dc:b0:8f:0c:9e:b3:ef:2e:86:62:ba:7f:f5:bd:28:28:
         ef:f0:dc:c0:f2:ce:dc:11:ea:d9:92:85:de:e6:31:8a:1d:98:
         e6:ba:e5:07:f1:96:81:b6:15:f9:60:65:14:81:7a:46:da:9c:
         d6:8d:ac:2c:85:a8:5a:3c:e0:c5:a2:c3:3a:61:5e:1e:e9:c5:
         61:39:6a:26:9e:08:f2:81:ce:a5:48:2b:f9:b0:98:c9:79:ba:
         20:35:f8:6a:a3:8e:74:16:07:c6:1c:68:3a:b0:0a:38:d1:92:
         d7:e4:4a:45:a1:b6:7c:2d:b7:d9:73:e5:0c:c1:4e:38:fd:c7:
         ff:f9:b0:c3:af:4c:7c:57:ca:d5:f9:1c:58:e1:74:28:a6:56:
         47:8d:ea:a1:83:2a:df:27:1a:10:25:3b:62:a6:63:53:fd:30:
         b7:72:29:85:0d:ca:18:ce:6b:94:63:c2:d8:d3:c8:bf:70:9b:
         fe:b9:69:8e:c4:ee:69:d5:1e:f0:a2:36:8b:48:49:33:e1:8e:
         78:39:1a:55:2d:ad:9c:2e:b7:86:9d:32:89:6b:f1:8b:cb:b6:
         04:5c:bd:5d:91:c0:fa:c6:5c:84:03:0e:2e:f5:2a:48:9e:c0:
         82:47:d9:2b:1d:9f:49:62:11:83:12:7a:56:74:65:1c:28:96:
         c2:52:e8:c7:ac:5f:d3:64:04:bd:3f:25:69:38:a0:87:d5:ca:
         65:39:fa:17:c1:59:ac:ea:42:c4:94:ce:01:e7:b1:11:c8:0f:
         99:13:61:7b:ea:7d:b0:45:8f:c5:95:ad:54:f7:d3:62:69:61:
         b3:68:18:94:58:77:1b:14:62:79:59:aa:ef:9f:62:6d:1f:fd:
         4f:54:1a:15:16:4f:68:c9:c7:61:63:88:09:73:db:e7:a0:eb:
         92:dc:e3:e0:96:e5:28:ca:99:3d:6e:a9:fc:1b:2e:9f:7d:24:
         07:af:d4:a7:42:3c:1f:b9:72:2f:36:7a:40:7e:65:2b:06:70:
         b4:0f:71:f8:13:07:a7:57:82:39:e8:f5:87:a0:5d:a8:69:c5:
         29:67:bd:55:d1:6d:ff:b6:2a:f5:cd:d8:45:37:6b:c7:ed:1a:
         55:e4:26:0b:ba:e1:da:ff:84:9f:0d:ed:1c:8c:91:81:dc:8c:
         d0:5c:f2:d3:ef:40:03:5f:52:a6:7f:56:cc:4d:59:fa:fe:10:
         d9:42:db:a0:e9:45:d4:12:5e:cc:64:81:15:ca:c7:9e:cc:dd:
         04:f7:1a:37:d0:c8:92:80:41:ba:07:d9:ce:7b:49:04:01:c9:
         f1:e3:d3:6b:15:c1:b9:1b:ea:fb:e5:9b:cc:fa:a8:71:06:f0:
         93:a7:a0:75:ad:0f:3e:b1

The server cert:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 30584 (0x7778)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = CA, O = service
        Validity
            Not Before: Sep  5 05:39:25 2017 GMT
            Not After : Aug 12 05:39:25 2117 GMT
        Subject: C = US, ST = CA, O = service, CN = service Test Cert
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b1:d3:62:20:76:1e:b6:19:b5:d7:61:79:6a:f0:
                    3f:72:6d:85:df:8f:8b:bf:af:df:9d:5e:5e:bc:d1:
                    aa:69:5f:5e:bf:7e:41:d0:1b:e2:fb:4b:cc:4d:ac:
                    76:45:48:f8:28:a0:0c:5d:cc:e7:cf:e1:33:48:a8:
                    da:37:93:de:ce:c6:56:7b:42:6c:33:df:6c:c0:06:
                    05:36:8d:dc:90:89:72:4d:83:2e:d6:42:9f:5d:8f:
                    bb:62:0d:93:bb:55:5a:01:ba:3b:fc:ac:c6:0c:42:
                    6d:10:3c:90:4c:37:ff:1f:de:cc:d9:33:2a:aa:2f:
                    b7:c9:2d:a3:2b:87:65:8e:34:8d:dd:2a:5c:82:ca:
                    1e:db:da:d3:69:62:38:4c:20:59:86:ab:ca:be:ca:
                    4c:49:7f:b6:57:9a:37:f3:a0:25:2d:ac:25:22:ff:
                    d8:19:e8:66:bf:cc:d3:04:7a:84:10:ea:fd:d8:1f:
                    80:23:e6:e6:1a:23:53:f1:a5:8d:98:04:74:a2:0a:
                    54:a2:6b:6d:11:1c:2f:70:ff:dd:a2:76:3a:ea:d6:
                    2f:12:5a:a0:39:bb:13:b1:13:34:f6:96:1e:b5:e8:
                    f7:65:83:bb:02:ca:24:4f:79:bd:2d:74:e3:4b:b8:
                    48:3a:65:00:b5:bc:24:48:3a:57:ae:7e:91:a4:71:
                    b7:29
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Cert Type: 
                SSL Server
            X509v3 Subject Key Identifier: 
                06:2D:AD:32:62:BA:AD:46:C1:D7:34:7B:F8:FE:74:A4:AB:C1:AC:54
            X509v3 Authority Key Identifier: 
                keyid:12:DF:81:75:71:CA:92:D3:CE:1B:2C:2B:77:3B:9E:33:77:F3:F7:6F
                DirName:/C=US/ST=CA/O=service
                serial:86:CD:BD:21:8C:44:D7:77

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            Authority Information Access: 
                OCSP - URI:http://ocsp.ocsptest.com

    Signature Algorithm: sha256WithRSAEncryption
         93:de:af:c1:bd:37:5c:64:55:b0:08:27:69:44:bf:c4:59:98:
         b7:b0:bc:99:7d:8e:c7:5b:26:a2:45:6b:f1:ed:d1:c5:80:50:
         c3:c8:94:50:96:be:8d:c8:58:38:a9:f0:a5:ba:5a:25:74:15:
         ce:9a:71:02:6d:97:f3:7e:dd:9b:b1:ef:bd:55:a1:68:60:fb:
         bb:b6:5b:94:22:74:d9:f9:ea:d1:1c:bb:08:63:62:88:0d:e8:
         f8:17:3b:c9:91:cb:6d:b7:fb:55:b8:2b:a3:89:34:ba:81:28:
         04:75:d4:0a:4a:11:68:f1:ce:4b:3a:c1:de:a8:3a:af:67:fd:
         7c:f9:6d:6f:ad:7b:c0:1a:7e:e2:05:66:29:ee:11:fe:2b:76:
         ac:e0:ec:27:93:9e:bf:59:d8:79:cf:6a:7f:f3:b7:37:59:a6:
         95:05:c2:05:59:23:4e:73:10:6e:9b:ff:d2:e0:21:c9:2f:5c:
         ac:6f:77:53:45:24:40:4f:3c:bf:82:f7:8d:ee:18:1a:9b:fb:
         c8:99:e4:38:21:67:ed:39:f0:c6:b9:16:29:1e:05:51:92:70:
         ec:b3:39:f8:32:93:93:ac:10:66:a6:29:c5:f2:31:9c:e4:bf:
         31:13:fe:3f:e0:b4:57:67:4a:13:9d:62:5e:a3:ee:08:1e:68:
         70:e7:42:12:11:a0:e2:1a:a5:cc:bb:50:c9:1e:4c:97:8b:96:
         0c:c3:fd:6c:df:c2:5d:3c:3e:6e:87:df:be:53:b7:e0:f9:ee:
         46:d3:50:d8:6c:64:1c:e5:6a:0a:fb:b4:7a:20:3b:e0:36:b5:
         8c:ea:18:b5:e0:77:58:75:38:05:98:31:8b:dd:7c:99:3d:b4:
         91:27:09:bb:0b:cf:c2:1a:1d:6f:3d:93:15:1a:80:63:a6:b3:
         24:00:5b:f0:c5:ef:87:84:9c:5e:df:e4:a4:df:af:31:64:85:
         b3:75:1e:05:c2:30:04:b6:36:ec:2d:08:c4:ea:43:6e:67:cb:
         a6:20:f1:42:f6:35:02:c5:68:1d:dc:2b:70:c8:8e:6d:5c:56:
         d5:78:28:de:0e:a7:fa:03:9c:67:7a:0e:56:fe:e7:4b:9d:3f:
         37:50:ec:2c:c8:fa:15:c2:00:3e:33:4e:24:b9:de:91:4c:9f:
         91:ed:bb:01:c9:06:32:05:a2:00:78:12:21:69:76:0b:86:de:
         cd:64:85:34:28:ad:e9:22:08:11:9f:95:b4:42:f7:29:0c:ab:
         7c:bf:32:99:5a:e8:ef:10:a7:fa:98:89:fe:44:c2:48:b8:37:
         ff:a5:cd:a4:97:05:88:7a:ab:6e:db:c3:b2:de:38:bd:7c:a3:
         2c:ac:3d:07:42:0a:15:c7

Answer 1

To me, this implies that openssl can verify the immediate cert, but not the server cert.

That's right. What you are missing is that openssl verify [options] file1 file2 ... validates (the one/first cert in) each file1, file2, etc. independently. What is happening is:

1. OpenSSL tries to validate intermediate_cert.pem against the root ca_cert.pem. This succeeds.

2. OpenSSL tries to validate server_cert.pem against the root ca_cert.pem. It completely ignores the intermediate_cert file used in step 1. Since server_cert was not issued directly under ca_cert and the intermediate is not available, validation fails.

What you want to do is openssl verify -CAfile ca_cert -untrusted imed_cert server_cert. This validates servercert using imed as a chain cert against the given root. Validating a chain includes verifying all non-root (technically, non-anchor) certs in the chain, so this verifies BOTH server_cert and imed_cert in one operation, giving an error if either (or more generally any) of them has a problem.

Dupes:
Why is OpenSSL verify output depending on source of cert files?
https://superuser.com/questions/904859/why-cant-i-verify-this-certificate-chain

Similar:
https://stackoverflow.com/questions/44375300/openssl-verify-with-chained-ca-and-chained-cert
https://stackoverflow.com/questions/29436967/how-to-chain-a-ssl-server-certificate-with-the-intermediate-and-root-ca-certific

I thought there were more; I certainly have answered this question more times than those, but maybe they're deleted or unfindable or something.

Answer 2

It seems these are test certificates, thus issued from a test CA. If they don't chain to a trusted CA you will get the above error. You may use -CAfile ca.pem to point to the CA so the intermediate is trusted, and then per the intermediate signatuere, the leaf certificate is as well