OS: Ubuntu 14.04 Trusty

Openssl version: OpenSSL 1.0.1f 6 Jan 2014

I'm trying to verify a proxy certificate. If I use

openssl verify -CAfile myca.pem mycert.pem

I obtain this error:

error 40 at 0 depth lookup:proxy certificates not allowed, please set the appropriate flag

This is because "mycert.pem" is a proxy certificate, so I have to declare it to openssl.

The right way to do it is to add this command:


as written in Openssl verify: Man Page

But when I add -allow_proxy_certs command like this:

openssl verify -allow_proxy_certs -CAfile myca.pem mycert.pem

it prints

usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check] [-no_alt_chains] [-attime timestamp] [-engine e] cert1 cert2 ...

That is the same output I get calling

openssl verify -help

So it seems "-allow_proxy_certs" is missing in my openssl version. How could I add it and use it?


After Mikel's comment, I resolved the issue.

1) I've downloaded that openssl version from their github page

2) I've followed the instructions written in INSTALL file (using "./config --prefix=/usr/" instead of "./config")

3) after installation, "openssl version" gave me the correct output with new openssl version. Command "--allow_proxy_cert" can be now used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.