My SSL server uses the following certificate setup:
leaf -> intermediate -> root (trusted ca). I have verified using
openssl that it's returning both
intermediate certificate (at least I think it does):
$ openssl s_client -showcerts -connect <SSL server endpoint> depth=2 CN = root-cn - 1537386011 verify return:1 depth=1 OU = intermediate-ou, CN = intermediate-cn verify return:1 depth=0 OU = leaf-ou, CN = leaf-cn verify return:1 CONNECTED(00000003) --- Certificate chain 0 s:/OU=leaf-ou/CN=leaf-cn i:/OU=intermediate-ou/CN=intermediate-cn -----BEGIN CERTIFICATE----- <leaf certificate> -----END CERTIFICATE----- 1 s:/OU=intermediate-ou/CN=intermediate-cn i:/CN=root-cn - 1537386011 -----BEGIN CERTIFICATE----- <intermediate certificate> -----END CERTIFICATE----- --- Server certificate subject=/OU=leaf-ou/CN=leaf-cn issuer=/OU=intermediate-ou/CN=intermediate-cn --- Acceptable client certificate CA names .. /CN=root-cn - 1537386011 .. --- SSL handshake has read 17882 bytes and written 427 bytes ---
But, when I attempt to use curl specifying only root certificate as
cacert with a client certificate issued by
intermediate issuer, SSL handshake fails with the error
SSL peer had some unspecified issue with the certificate it received/
(I'm running the curl command on the same host the server, hence the CN name in the client certificate matches with that of server).
$ curl -k -v --cacert <root-ca> --cert <client cert> --key <client cert key> <endpoint> * CAfile: <cafile> * skipping SSL peer certificate verification * NSS: client certificate from file * subject: CN=leaf-cn,OU=leaf-ou * common name: leaf-cn * issuer: CN=intermediate-cn,OU=intermediate-ou * NSS error -12224 (SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT) * SSL peer had some unspecified issue with the certificate it received.
It works if I add
intermediate certs along with
root as trusted (
--cacert flag) when invoking the curl command. But after going through several StackExchange posts here, it seems if the server is returning
intermediate certificates, then the client shouldn't need to add them as trusted.
Any idea what am I missing here? Would appreciate any pointers.