OpenSSL Verify Certificate Chain: Complete Guide

# Verify against system CA certificates
openssl verify server.crt

# Verify against specific CA bundle
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt server.crt

# Verify against your CA file
openssl verify -CAfile root-ca.crt server.crt

# Using -untrusted for intermediate certificates
openssl verify -CAfile root-ca.crt -untrusted intermediate.crt server.crt

# Multiple intermediates
openssl verify -CAfile root-ca.crt \
  -untrusted intermediate1.crt \
  -untrusted intermediate2.crt \
  server.crt

# If you have a combined chain file
cat intermediate.crt root-ca.crt > ca-chain.crt
openssl verify -CAfile ca-chain.crt server.crt

# Verify each certificate in the chain individually
openssl crl2pkcs7 -nocrl -certfile chain.pem | \
  openssl pkcs7 -print_certs -noout

# Display chain verification details
openssl verify -show_chain -CAfile ca-bundle.crt server.crt

# Example output:
# server.crt: OK
# Chain:
# depth=0: CN = example.com (untrusted)
# depth=1: CN = DigiCert SHA2 Extended Validation Server CA
# depth=2: CN = DigiCert High Assurance EV Root CA

# Basic remote verification
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>&1 | \
  grep -E "(Verify return code|depth|verify)"

# Successful output:
# Verify return code: 0 (ok)

# Show all certificates sent by server
openssl s_client -connect example.com:443 -servername example.com -showcerts < /dev/null 2>&1

# Count certificates in chain
openssl s_client -connect example.com:443 -servername example.com -showcerts < /dev/null 2>&1 | \
  grep -c "BEGIN CERTIFICATE"

# Verify remote server against custom CA bundle
openssl s_client -connect internal.example.com:443 \
  -servername internal.example.com \
  -CAfile /path/to/internal-ca.crt < /dev/null 2>&1 | \
  grep "Verify return code"

# Verify with system certificates
openssl s_client -connect example.com:443 \
  -servername example.com \
  -CApath /etc/ssl/certs < /dev/null

# Save complete chain from server
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null | \
  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > chain.pem

# Extract individual certificates
csplit -f cert- chain.pem '/-----BEGIN CERTIFICATE-----/' '{*}' 2>/dev/null

# Verify saved chain
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt chain.pem

# 1. Find the issuer of your certificate
openssl x509 -in server.crt -issuer -noout

# 2. Download the intermediate certificate from your CA
# (Usually provided with your certificate or on CA website)

# 3. Create a chain file (order: leaf → intermediate → root)
cat server.crt intermediate.crt > chain.pem

# 4. Verify the chain
openssl verify -CAfile root-ca.crt chain.pem

# 5. Configure your web server with the chain file

# Check which certificate in chain is expired
for cert in *.crt; do
  echo "=== $cert ==="
  openssl x509 -in "$cert" -dates -noout
done

# Check if intermediate/root is expired (common issue)
openssl s_client -connect example.com:443 -showcerts 2>/dev/null | \
  awk '/BEGIN CERT/,/END CERT/{print}' | \
  while read line; do
    echo "$line"
  done | openssl x509 -dates -noout

# Add self-signed root to your trust store
# For testing only:
openssl verify -CAfile self-signed-root.crt server.crt

# For system-wide trust (Ubuntu/Debian):
sudo cp self-signed-root.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# For system-wide trust (RHEL/CentOS):
sudo cp self-signed-root.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

# Create properly ordered chain file
cat server.crt intermediate.crt > fullchain.pem

# Verify order
openssl crl2pkcs7 -nocrl -certfile fullchain.pem | \
  openssl pkcs7 -print_certs -text -noout | \
  grep "Subject:"

# Should show:
# Subject: CN=example.com (your server)
# Subject: CN=DigiCert... (intermediate)
# Subject: CN=DigiCert... (root, if included)