I am trying to learn how ssl chain of trust works with practical examples. I thought maybe
openssl would be a good education tool. But I'm running into a few problems while practicing, and I'm at a lost on how to approach my education.
Below is an experiment where I'm trying to set up certificates for a Root CA, Intermediate CA and an End User (I still don't have a confident understanding of what these terms mean despite several hours of googling and watching YouTube videos, hence my desire to experiment below).
I created and ran a bash script like this:
# make certs for root ca openssl genrsa -out root.key 2048 openssl req -x509 -sha256 -nodes -extensions v3_ca -key root.key -subj "/C=CA/ST=ON/O=HelloWorld/CN=root.example.com" -days 3650 -out root.crt # make certs for intermediate ca openssl genrsa -out intermediate.key 2048 openssl req -new -sha256 -nodes -key intermediate.key -subj "/C=CA/ST=ON/O=HelloWorld/CN=intermediate.example.com" -out intermediate.csr openssl x509 -req -extensions v3_ca -in intermediate.csr -CA root.crt -CAkey root.key -CAcreateserial -out intermediate.crt -days 500 -sha256 # make certs for end user openssl genrsa -out enduser.key 2048 openssl req -new -sha256 -nodes -key enduser.key -subj "/C=CA/ST=ON/O=HelloWorld/CN=enduser.example.com" -out enduser.csr openssl x509 -req -in enduser.csr -CA intermediate.crt -CAkey intermediate.key -CAcreateserial -out enduser.crt -days 500 -sha256
Then I tried to verify the
enduser.crt along with the certificate chain. But these commands all fail for various reasons:
>openssl verify -CAfile intermediate.crt enduser.crt C = CA, ST = ON, O = HelloWorld, CN = intermediate.example.com error 2 at 1 depth lookup: unable to get issuer certificate error enduser.crt: verification failed >openssl verify -CAfile <(cat intermediate.crt root.crt) enduser.crt C = CA, ST = ON, O = HelloWorld, CN = intermediate.example.com error 24 at 1 depth lookup: invalid CA certificate error enduser.crt: verification failed >openssl verify -CAfile <(cat root.crt intermediate.crt) enduser.crt C = CA, ST = ON, O = HelloWorld, CN = intermediate.example.com error 24 at 1 depth lookup: invalid CA certificate error enduser.crt: verification failed
This command runs fine though
>openssl verify -CAfile root.crt intermediate.crt intermediate.crt: OK
Have I completely misunderstood how intermediate CA work or how chain of trusts work?