Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?

share|improve this question
    
Look at the openssl x509 manual section. – alex Jul 7 '11 at 16:03
    
The OpenSSL verify manual can help you here. Also, see this page has some excellent examples. – Stefan Lasiewski Jul 7 '11 at 16:55
up vote 24 down vote accepted

Assuming your certificates are in PEM format, you can do:

openssl verify cert.pem

If your "ca-bundle" is a file containing additional intermediate certificates in PEM format:

openssl verify -untrusted ca-bundle cert.pem

If your openssl isn't set up to automatically use an installed set of root certificates (e.g. in /etc/ssl/certs), then you can use -CApath or -CAfile to specify the CA.

share|improve this answer
1  
Warning, the openssl verify command is more permissive than you might expect! By default, in addition to checking the given CAfile, it also checks for any matching CAs in the system's certs directory e.g. /etc/ssl/certs. To prevent this behavior and make sure you're checking against your particular CA cert given by CAfile, you must also pass a -CApath option with a non-existant directory, e.g.: openssl verify -verbose -CApath nosuchdir -CAfile cacert.pem server.crt – DSimon Jan 20 at 19:35
    
One further caveat: If you use -CApath nosuchdir then the combination of server.crt and cacert.pem must include the root CA; if openssl can only work up to an intermediate CA with those files then it will complain. – DSimon Jan 21 at 16:32

Here is one-liner to verify certificate chain:

openssl verify -verbose -x509_strict -CAfile ca.pem -CApath nosuchdir cert_chain.pem

This doesn't require to install CA anywhere.

See http://stackoverflow.com/questions/20409534/how-does-an-ssl-certificate-chain-bundle-work for details.

share|improve this answer
1  
Warning, the -CAfile option is more permissive than you might expect. See my comment on the accepted answer for details. – DSimon Jan 20 at 19:36
1  
@DSimon, I added -CApath nosuchdir this to answer. Thank you. – Vadzim Jan 21 at 9:10
    
No problem, glad to help. :-) One caveat that I figured out after posting my earlier comment: if the file specified with -CAfile is itself just an intermediate certificate, then openssl will complain. This is correct behavior, since verify requires a complete chain all the way up to a root CA, but can be misleading. – DSimon Jan 21 at 16:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.