You have several things wrong.
The chain received by s_client is incorrect; the server cert (#0) is issued
by CN=VeriSign Class 3 Secure Server CA - G3
but neither #1 not #2 is a cert for that CA. #2 is for CN=VeriSign Class 3
International Server CA - G3
under CN=VeriSign Class 3 Public Primary Certification Authority - G5,
and #1 is that under OU=Class 3 Public Primary Certification Authority,
one of Verisign's roots (although they also publish Primary G5 as a newer
root).
Assuming the apache config you show is the server used at "xxx.com", then
the contents of your SSLCertificateChainFile
are not the correct intermediates for your cert. Check with Verisign, or
construct the chain yourself. Technically what you
have is also backwards, because according to 5246 et pred added certs should
be in order upward from EE, but
in practice clients (certainly including openssl) handle any order as long
as the correct certs are in there.
"browser" may have validated this server because it has the correct CA cert
(Class 3 Secure Server CA G3) in its truststore,
and thus doesn't need to use the incorrect one in the (sent and) received
chain. Of the PC browsers I have to hand
(vanilla) FIrefox 27 does have it, but Windows7 (for IE9 and Chrome recent)
does not.
Further if the "-----BEGIN CERT" "ca.cert's content" "-----END CERT" in your
obviously-censored log means you
took the server cert and put it in the file you use for -CAfile in s_client,
that's wrong and also causes the failure.
Server certs and CA certs are different except in the special case of a
selfsigned cert used by an server.
For a server using a selfsigned cert, you do need to supply s_client with
the server's cert as trusted, and
while there are a few ways to do that -CAfile file is simple and easy. For a
server using a CA-issued cert,
as yours visibly is, providing the server cert as trusted does not work (at
least before 1.0.2) and using -CAfile
may suppress a default truststore which would have worked. Once you fix the
server to send the correct chain,
either specify -CAfile with the Verisign root cert, or omit it if the
Verisign root is in /etc/pki/tls/{cert.pem,certs}.
From: [email protected]
[mailto:[email protected]] On Behalf Of wooo Zucker
Sent: Thursday, February 20, 2014 20:44
To: [email protected]
Subject: *** Spam *** openssl failed to verify the certificates, while
browser is ok
I meet some problems when I use openssl to verify the certificate. but
browser has already accepted the certificates.
[mocker ~]$ openssl version
OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
[mocker ~]$ openssl version -d
OPENSSLDIR: "/etc/pki/tls"
apache related configurations :
#==============================
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLCryptoDevice builtin
SSLMutex default
SSLPassPhraseDialog builtin
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
SSLSessionCache
shmcb:/var/cache/mod_ssl/scache(67108863)
SSLSessionCacheTimeout 2100
SSLProxyEngine On
# Service vhosts
<VirtualHost _default_:443>
SSLProxyEngine on
SSLEngine on
#SSLSessionCacheTimeout 2100
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
SSLCertificateFile /etc/httpd/common/server.crt
SSLCertificateKeyFile /etc/httpd/common/server.key
SSLCertificateChainFile /etc/httpd/common/server_intermediate.pem
Include conf/conf/xxx.conf
</VirtualHost>
#==============================
openssl configuarions
<snip lots; openssl.cnf does not affect s_client at all>
error message
#==================================================
[mocker ~]$ openssl s_client -connect xxx.com:443 -CAfile ca.cert
CONNECTED(00000003)
depth=0 /C=FI/ST=Finland/L=Espoo/O=xxxx/OU=yyyy/OU=For Intranet Use
Only/CN=xxx.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=FI/ST=Finland/L=Espoo/O=xxxx/OU=yyyy/OU=For Intranet Use
Only/CN=xxx.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=FI/ST=Finland/L=Espoo/O=xxxx/OU=yyyy/OU=For Intranet Use
Only/CN=xxx.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/C=FI/ST=Finland/L=Espoo/O=xxxx/OU=yyyy/OU=For Intranet Use
Only/CN=xxx.com
i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at
https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign,
Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary
Certification Authority - G5
i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification
Authority
2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at
https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server
CA - G3
i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign,
Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary
Certification Authority - G5
---
Server certificate
-----BEGIN CERTIFICATE-----
..............
ca.cert's
content
.............
-----END CERTIFICATE-----
subject=/C=FI/ST=Finland/L=Espoo/O=Nokia Solutions and Networks/OU=NSN
IT/OU=For Intranet Use Only/CN=beisop60.china.nsn-net.net
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at
https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
---
No client certificate CA names sent
---
SSL handshake has read 4973 bytes and written 319 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES256-SHA
Session-ID: session ID here
Session-ID-ctx:
Master-Key: Master-key here
Key-Arg : None
Krb5 Principal: None
Start Time: 1392946292
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
#==================================================
