On Fri, Dec 09, 2005, [EMAIL PROTECTED] wrote: > > But I am able to veify the certs using following command > > clientChain.pem has ServiceProviderCA and ClientCert (in that order) > serverChain.pem has ServiceProviderCA and ServerCert (in that order) > > C:\OpenSSL\bin>openssl verify -CApath \certs clientChain.pem > c:\certs\clientChain.pem: OK > > C:\OpenSSL\bin>openssl verify -CApath \certs serverChain.pem > c:\certs\serverChain.pem: OK > > In addition I used default server.pem as input to run both client and server > side, even that seems to fail. > C:\OpenSSL\bin>openssl s_server -Verify yes -tls1 -cert server.pem
Well "yes" isn't a valid argument to the "-Verify" option for a start. Its a numerical value with the maximum chain length. Try giving it a value like "9". Also note that the "verify" command verifies the first certificate in a file. So the above two commands end up verifying the ServiceProviderCA twice which isn't what you want... Something like: openssl verify -CApath \certs -purpose sslserver -untrusted ServiceProviderCA.pem ServerCert.pem is more realistic. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
