The situation is:

  • there is a root certificate (a „home brew”)
  • there is an „intermediary” certificate signed by the previous one (also a „home brew”)
  • there are two hosts (A and B) on which the above (CA) certificates have been installed in
    /etc/ssl/certs/
  • on host A a certificate C1 (signed by the intermediary CA) and private key K1 are configured to be used by a network (SOAP) listener.
  • on host B a certificate C2 (signed by the intermediary CA) and private key K2 are configured to be used by a network (SOAP) listener.

On host A I can successfully use the network services from both hosts and issuing the commands on host A:

openssl s_client -connect A:18080
openssl s_client -connect B:18080

both return

...
Verify return code: 0 (ok)
...

However on host B I can't successfully use any of the network services (certificates are not validated) and issuing the commands on host B:

openssl s_client -connect A:18080
openssl s_client -connect B:18080

both return

...
Verify return code: 7 (certificate signature failure)
...

When the verification succeeds, the output from the above commands contains:

CONNECTED(00000003)
depth=2 C = CX, ST = SX, L = Loc, O = Org, emailAddress = user@org.cx
verify return:1
depth=1 C = CX, ST = SX, L = Loc, O = Org, emailAddress = user@org.cx
verify return:1
depth=0 C = CX, ST = Loc, L = Loc, O = Comp, OU = OX, CN = a.comp.int, emailAddress = user@comp.com
verify return:1
---
Certificate chain
 0 s:/C=CX/ST=Loc/L=Loc/O=Comp/OU=OX/CN=a.comp.int/emailAddress=user@comp.com
   i:/C=CX/ST=SX/L=Loc/O=Org/emailAddress=user@org.cx
---

When the verification fails, the output from the above commands contains:

CONNECTED(00000003)
depth=1 C = CX, ST = SX, L = Loc, O = Org, emailAddress = user@org.cx
verify return:1
depth=0 C = CX, ST = Loc, L = Loc, O = Comp, OU = OX, CN = a.comp.int, emailAddress = user@comp.com
verify error:num=7:certificate signature failure
verify return:1
depth=0 C = CX, ST = Loc, L = Loc, O = Comp, OU = OX, CN = a.comp.int, emailAddress = user@comp.com
verify return:1
---
Certificate chain
 0 s:/C=CX/ST=Loc/L=Loc/O=Comp/OU=OX/CN=a.comp.int/emailAddress=user@comp.com
   i:/C=CX/ST=SX/L=Loc/O=Org/emailAddress=user@org.cx
---

Can someone help me find out where the fault lies?
Is it that on host B (the one that cannot validate ether certificates) the certification chain (Root CA - Intermediary CA) is somehow „broken”? What should I do to debug this further?
Even though openssl on host B cannot validate the certificates from ether hosts, Firefox running on host B also successfully validates those - of course using its own certificate store where the root CA and the intermediary CA mentioned above have been imported.
Again, from the side of host A everything works just fine, as expected.
One more thing: the command

openssl verify -CAfile /etc/ssl/certs/CA.pem -untrusted /etc/ssl/certs/Int_CA.pem /home/<user>/.ssh/id_b.pub

on host B produces the result:

/home/<user>/.ssh/id_b.pub: OK

So this time everything seems to be in order.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.