Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?

share|improve this question
Look at the openssl x509 manual section. – alex Jul 7 '11 at 16:03

3 Answers 3

up vote 21 down vote accepted

Assuming your certificates are in PEM format, you can do:

openssl verify cert.pem

If your "ca-bundle" is a file containing additional intermediate certificates in PEM format:

openssl verify -untrusted ca-bundle cert.pem

If your openssl isn't set up to automatically use an installed set of root certificates (e.g. in /etc/ssl/certs), then you can use -CApath or -CAfile to specify the CA.

share|improve this answer

The OpenSSL verify manual can help you here.

Also, see this page has some excellent examples.

share|improve this answer

Here is one-liner to verify certificate chain:

openssl verify -verbose -x509_strict -CAfile ca.pem cert_chain.pem

This doesn't require to install CA anywhere.

See for details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.