Verify SSLCertificateChainFile using OpenSSL

Question

I encountered such issue on a server of a client as I did not know how to verify SSLCertificateChainFile among other certificates. I have a folder with a lot of SSL certificate keys and corresponding files (.crt, .key). Also, I know SSLCertificateFile and SSLCertificateKeyFile for my.example.com site. I have checked an MD5 hash between them:

openssl x509 -noout -modulus -in my-exam.crt| openssl md5
(stdin)= d41d8cd98f00b204e9800998ecf8427e

openssl rsa -noout -modulus -in my-exam.key | openssl md5
(stdin)= d41d8cd98f00b204e9800998ecf8427e

Other certificate files have other names and they are different from my-exam.

My question is: How to find out SSLCertificateChainFile among other certificate files using OpenSSL if we have already known SSLCertificateFile and SSLCertificateKeyFile?

Answer 1

Do a for loop:

for file in  *.pem; do
     if  openssl verify -CAfile "$file" my-exam.crt>/dev/null 2>&1; then
          echo "Chainfile:$file";
     fi;
done

Eg. O/P:

Chainfile:ca_chain.pem

I have assumed chain files are in pem format else change it in for loop.

Answer 2

After not a long research I have found out the way to verify what SSLCertificateChainFile is related to my SSLCertificateFile and SSLCertificateKeyFile. When OpenSSL verifies the certificate it first creates the entire certificate chain. The following command

sudo openssl verify -verbose -CAfile sf_bundle.crt my-exam.crt helps me to verify my SSLCertificateChainFile (sf_bundle.crt).

Output must be: my-exam.crt: ok

With other .crt files I got only errors.