So I look after 2 web servers, one old, one new. The old one uses our old url, the new, our new url, both are internally signed.
The HTTPS certificate is about to expire on the old one, so I've checked and even though it has 1 month left on it, it's identifying as not valid, due to it's certificate authority, which is an internal machine.
However, the new server, which has a similarly internally signed certificate is showing as valid, albeit it is signed by a different internal authority.
I'm struggling to figure out why the new cert is fine, but the old one is not. Either the new cert has some magic in it I'm not aware of (like the ultimate parent in the signing chain is one of the well known certs in my CA, but its not showing up when I interrogate the .crt), or the unfamiliar (internal) parent .crt in the signing chain, has been added to the ca-certificates on my ubuntu client.
What are the cli commands on my ubuntu desktop, or the centos client, that I can use to find out? If the reason why the new .crt works, is because of a certificate that's been installed on my desktop, how do I find where that certificate is installed (and how do I copy it on to other centos machines)?
openssl s_client -connect -showcerts to identify the chain on both servers and they end up with a signing authority CN that is internal. I've downloaded the certs and run
openssl verify -verbose -issuer_checks and I don't see any parent authority that I'd recognise. I ran the same things on www.google.com and I get a familiar parent of 'GeoTrust Global CA', so I'm leaning towards the internal parent authority having been added to my local ca-certificates, but how can I check?
The CN which is reporting as the ultimate authority in all cases isn't a DNS name, so I can't download that .crt from somewhere, all I've got is what's in the new url .crt, so can I use
openssl to lookup the certificate, from just a CN (which presumably openssl is doing internally to conclude it's valid, if the apparent parent .crt isn't in my local ca-certificates)?
Edit: I think the master key has been added to my chrome (libnss3) certificates. What is needed to add the same master key so it's supported by something other than chrome (like php and openssl on cli)