My SSL server uses the following certificate setup: leaf -> intermediate -> root (trusted ca)
. I have verified using openssl
that it's returning both leaf
and intermediate
certificate (at least I think it does):
$ openssl s_client -showcerts -connect <SSL server endpoint>
depth=2 CN = root-cn - 1537386011
verify return:1
depth=1 OU = intermediate-ou, CN = intermediate-cn
verify return:1
depth=0 OU = leaf-ou, CN = leaf-cn
verify return:1
CONNECTED(00000003)
---
Certificate chain
0 s:/OU=leaf-ou/CN=leaf-cn
i:/OU=intermediate-ou/CN=intermediate-cn
-----BEGIN CERTIFICATE-----
<leaf certificate>
-----END CERTIFICATE-----
1 s:/OU=intermediate-ou/CN=intermediate-cn
i:/CN=root-cn - 1537386011
-----BEGIN CERTIFICATE-----
<intermediate certificate>
-----END CERTIFICATE-----
---
Server certificate
subject=/OU=leaf-ou/CN=leaf-cn
issuer=/OU=intermediate-ou/CN=intermediate-cn
---
Acceptable client certificate CA names
..
/CN=root-cn - 1537386011
..
---
SSL handshake has read 17882 bytes and written 427 bytes
---
But, when I attempt to use curl specifying only root certificate as cacert
with a client certificate issued by intermediate
issuer, SSL handshake fails with the error SSL peer had some unspecified issue with the certificate it received
/SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT
.
(I'm running the curl command on the same host the server, hence the CN name in the client certificate matches with that of server).
$ curl -k -v --cacert <root-ca> --cert <client cert> --key <client cert key> <endpoint>
* CAfile: <cafile>
* skipping SSL peer certificate verification
* NSS: client certificate from file
* subject: CN=leaf-cn,OU=leaf-ou
* common name: leaf-cn
* issuer: CN=intermediate-cn,OU=intermediate-ou
* NSS error -12224 (SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT)
* SSL peer had some unspecified issue with the certificate it received.
It works if I add intermediate
certs along with root
as trusted (--cacert
flag) when invoking the curl command. But after going through several StackExchange posts here, it seems if the server is returning intermediate
certificates, then the client shouldn't need to add them as trusted.
Any idea what am I missing here? Would appreciate any pointers.
intermediate
which has sameCN
as server side but a differentOU
. So, they are totally different certificates. I think that's why it doesn't work. Although, both client and server side intermediates are issued by the same root ca.