certificate verify return with error : unable to get issuer certificate

Question

我已经创建了端点证书并使用我的中间证书对其进行了签名：

用中间符号结束点

openssl x509 -req -days 3650 -CAcreateserial -CA ../intermediate.crt -CAkey ../intermediate.key.insecure -in server.csr -out server.crt -sha256

我的服务器 csr:

Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=IL, L=Default City, O=mysrvr, OU=666, CN=www.mysrvr.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:cc:.:b2:4d
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha1WithRSAEncryption
        49:e0:.:.:27:be

我的中级 crt:

openssl x509 -in intermediate_AE.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:22:33:44:55:66:77:90
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=S1, L=Default City, O=SIP, OU=SIPCA, CN=rootca
        Validity
            Not Before: Apr 23 11:39:29 2018 GMT
            Not After : Apr 20 11:39:29 2028 GMT
        Subject: C=AU, O=Default Company Ltd, OU=666, CN=intermediate
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d1:.:.:fb:cf
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                FE:C5:C3:99:D4:05:71:5B:C6:68:95:D0:29:4F:6C:46:CB:C0:4E:3D
            X509v3 Authority Key Identifier:
                keyid:96:D5:C4:D5:CD:B3:88:D4:90:89:AA:F2:FC:D8:86:8B:DE:70:6F:42

    Signature Algorithm: sha1WithRSAEncryption
        42:e7:..:..:..:d0:2d

当我尝试验证符号时，我得到：

openssl verify -CAfile intermediate.crt server.crt

server.crt: C = AU, O = Default Company Ltd, OU = 666, CN = intermediate
error 2 at 1 depth lookup:unable to get issuer certificate

我的问题：我的 command/intermediate 有什么问题阻止了正确的链

Answer 1

OpenSSL 尝试建立一条一直返回到自签名根证书的链。仅信任中介本身是不够的，除非您还提供标志“-partial_chain”，即试试这个：

openssl verify -partial_chain -CAfile intermediate.crt server.crt

或者，您应该一直向根证书提供证书。例如

openssl verify -CAfile rootCA.cert -untrusted intermediate.crt server.crt

或者，如果您想明确信任中间 CA，您可以将根 CA 和中间 CA 连接到一个文件中：

openssl verify -CAfile rootAndInter.crt server.crt

certificate verify return with error : unable to get issuer certificate

certificate verify return with error : unable to get issuer certificate

openssl

ssl-certificate

x509