Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
  • OS : archlinux
  • Openssl dir : /etc/ssl

I just installed a root certificates authority. The xxx.pem and yyy.0 file exists in the /etc/ssl/certs folder. Then I verify the vimeo.com:443 via bash:

$ openssl s_client  -connect vimeo.com:443

It shows:

SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : RC4-MD5
    Session-ID: 001635EF0132A25577F3799825F2698A8FEDCDF916393DB44E9FCC5701D5E310
    Session-ID-ctx: 
    Master-Key: C5AA72B1E0A805AA950D1E0EFC7565F0EF3949618927EA84081B65E65B664C7AB803757CFF1CB12333CB8FC7D8298BA6
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1394981067
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)

And if I explicitly set the CA file:

$ openssl s_client  -connect vimeo.com:443 -CAfile XXX.pem

SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : RC4-MD5
    Session-ID: BF58BED9C13FF42E5DDEBC938CED703CD81A96EC59442B91FC6669D31D13E510
    Session-ID-ctx: 
    Master-Key: 197D80168908A8491C26F27B1C5AAA29BE2DC9CCBB8B840BAA45FCE683BDDB95133E58A48EDAC5AF820C97C948D436E2
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1394981110
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

Have I successfully installed the certificates? Why must I specify the CA file?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

This works for me on Fedora 19.

$ openssl s_client  -connect vimeo.com:443 < /dev/null
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : RC4-MD5
    Session-ID: 2345C651AB00DC97DF7390227CFA1EE8FD4F35EDCB142C4EB053F01380890514
    Session-ID-ctx: 
    Master-Key: B1BD06863BD3CEF2C2963AF47E5269DFE19A650A27A1A7D9032D361D34C3AFC914E59FBABEAE8087AD47D6EFC067548D
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1394988228
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
DONE

I would debug your issue further using strace to confirm that openssl is picking up the added .pem files from the directory you think it is.

$ strace -s 2000 -o ssl.log openssl s_client  -connect vimeo.com:443 < /dev/null

You can then interrogate the resulting log file, ssl.log, looking to find out where openssl the executable is accessing it's PEM files.

open("/etc/pki/tls/openssl.cnf", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=10906, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9c0277e000
...
open("/etc/pki/tls/cert.pem", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=235586, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9c0277e000
...

I'd also pay special attention to the permissions of the files you've added as well as making sure that openssl's configuration file, /etc/pki/tls/openssl.cnf, is referencing the correct directory:

...
[ ca ]
default_ca  = CA_default        # The default ca section

####################################################################
[ CA_default ]

dir     = /etc/pki/CA       # Where everything is kept
certs       = $dir/certs        # Where the issued certs are kept
crl_dir     = $dir/crl      # Where the issued crl are kept
database    = $dir/index.txt    # database index file.
...
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.