I'm currently struggling against a tenacious problem while setting up client certificate authentication for our mailservers via an NginX reverse proxy.
The setup seems to be working in most parts without the client certificates. But when I enable the checking of those and run a test with
openssl s_client I allways get:
Verify return code: 2 (unable to get issuer certificate)
The relevant part of my nginx.conf is as follows:
ssl on; ssl_certificate /etc/ssl/certs/server_cert.pem; ssl_certificate_key /etc/ssl/private/server_key.pem; ssl_client_certificate /etc/ssl/certs/IntermediateCA_chain.crt; ssl_crl /etc/ssl/crl.pem; ssl_verify_client on;
The file IntermediateCA_chain.crt is in PEM-format, and consists of both the IntermediateCA's certificate and afterwards our RootCA's cert.
Side-note: when I do
openssl x509 -text -noout -in IntermediateCA_chain.crtonly the IntermediateCA's cert is shown. I expected the chain to be displayed. Is that the correct behaviour?
I test the connection with the following command:
openssl s_client -connect server:995 -cert mycert.pem\ -key mykeyfile.pem -debug -CAfile IntermediateCA_chain.pem
[...] 0b50 - b3 c3 3b 17 66 8e 52 b3-ad 7f 14 ..;.f.R.... depth=1 DC = top, DC = ad, CN = Intermediate CA verify error:num=2:unable to get issuer certificate issuer= C = DE, O = My Company, CN = My Companies Root CA, emailAddress = email@example.com read from 0x10f6a10 [0x10fe333] (5 bytes => 5 (0x5)) [...]
I tried every variation of IntermediateCA_chain.pem I could think of (IntermediateCA.pem, RootCA.pem, IntermediateCA_chein.pem) on both sides.
It seems as though the failure is on the client-side, because it changes slightly with the used
-CAfile and the server's logs show nothing (literaly nothing - no connection attempt or anything else). It seems to me as if either the IntermediateCA_chain.pem on the server- or the client-side are not read correctly. The error seems to result in openssl not beeing able to verify the IntermediateCA, and the certificates issued by it. Can someone help me solve this riddle?