I'm working on an application which uses ECDSA certificates. After the cert generation, they should be verified but currently the following error is received:

C = CA, ST = BC, L = City, O = Corp, OU = Software, emailAddress = administrators@corp.com, CN = va.corp.com
error 18 at 0 depth lookup: self signed certificate

That is when the following command is invoked: openssl verify -CAfile ca-chain en-cert.pem

The certs are generated using the CSR like openssl ca -in CSR

How can the certificate be verified properly against the ca-cert/ca-chain? openssl verify -CAfile en-cert.pem en-cert.pem returns OK

  • 2
    I think it's a self-signed certificate. There is no CA. What is the issuer of a certificate? Check with this command: openssl.exe x509 -in en-cert.pem -noout -issuer. If the issuer is the same as subject CN, then it is a self-signed certificate and that's why the last verify command is working.
    – saurabh
    Sep 22, 2021 at 6:01

1 Answer 1


The certs are generated using...

If you generate certificates, you get self signed certificates. The message self signed certificate says exactly that.

Not you should generate certificate, but a CA. To get a valid certificate, you should send CSR to a CA. After you obtain a certificate from CA, load CA chain for this CA. Then you can verify your certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.