- Final X.509 certificate A in PEM format.
- Access to the certificate store of the server, which encloses all certificates, including singing chain for the certificate A.
OpenSSL shows following attributes of the certificate:
openssl x509 -in second.der -inform DER -text Certificate: Data: Version: 3 (0x2) Serial Number: xx:xx:xx:xx:xx Signature Algorithm: sha256WithRSAEncryption Issuer: aaa Validity Not Before: May 14 08:33:31 2019 GMT Not After : May 14 04:33:51 2024 GMT Subject: bbb
How can I recover the singing chain, thus all certificates which were used to sign the A until the root certificate?
Naive approach to look for the certificates having Subjet: bbb fails, because it also fetches from the store old certificates, which were used to sign previous versions of the current certificate.