I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. First, I run openssl (OpenSSL 3.0.1 14 Dec 2021)
openssl s_client -showcerts -connect letsencrypt.org:443 -servername letsencrypt.org
and I get
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = lencr.org verify return:1
along with the certs.
Internet Security Research Group, CN = ISRG Root X1 I see this
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1 i:O = Digital Signature Trust Co., CN = DST Root CA X3 a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256 v:NotBefore: Jan 20 19:14:03 2021 GMT; NotAfter: Sep 30 18:14:03 2024 GMT -----BEGIN CERTIFICATE----- MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT ...
This is Let's Encrypt's
Cross-signed by DST Root CA X3 cert rather than the
Self-Signed ISRG Root cert.
I have some old java code running on 1.8.0_131-b11 that makes API calls. The calls stopped working and I attempted to use openssl to retrieve the root cert so I could add that to my java keystore. The cert returned from openssl didn't fix the issue and I eventually added the
Self-Signed ISRG Root and everything started working.
I also tried adding the
-trusted_first option to my openssl command but that displays the same certs.
Why is openssl showing Let's Encrypt's Cross-Signed cert instead of their Self-Signed cert? How do I get the correct cert chain using openssl?