openssl - “Verify return code: 21 (unable to verify the first certificate)”

Question

我在处理opensl时遇到麻烦，提示无法在具有CA链的地方验证本地颁发的证书。除了本地CA链证书(CER，PEM，CRT)之外，我还有本地颁发的证书(PEM和CRT)。根和颁发者是同一台服务器。比较两个证书上的文本，两个证书上的“issuer:”字段都匹配。这是redhat Linux服务器。
我收到错误消息“验证错误:num = 20:无法获取本地发行者证书”和“验证返回码:21(无法验证第一个证书)”

我不确定要寻找什么。感谢您提供任何反馈意见。

谢谢

乔恩

故障排除步骤

我确实使用cerutil certutil -d/etc/pki/nssdb -A -t“C，” -n DomainA1-Server1CA -i/root/DomainA1-Server1CA.cer将发行者CA证书添加到linux证书中。

-Ran certutil -d/etc/pki/nssdb -L，我在那里可以看到证书

   Certificate Nickname   Trust Attributes 
                          SSL,S/MIME,JAR/XPI 
   DomainA1-Server1CA     C,,

Ran openssl s_client -connect ServerA2:443 -CAfile/root/certs/DomainA1-Server1CA.cer，尝试了(.CRT和.PEM)，上面出现了2个错误。
-Ran openssl s_client -connect ServerA2:443 -CApath/root/certs，尝试使用(.CRT和.PEM)，上面有2个错误。

Ran openssl s_client -connect ServerA2:443。上面有2个错误。

颁发的证书片段

    Data:
    Version: 3 (0x2)
    Serial Number:
    54:a9:50:a3:00:01:00:00:14:47
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: DC=com, DC=domainA1, CN=DomainA1-Server1CA
    Validity
    Not Before: April  5 16:45:48 2017 GMT
    Not After : April  5 16:45:48 2019 GMT
    Subject: C=US, ST=NY, L=CityA, O=CompanyNAME, OU=IT,
    CN=ServerB1.DomainA1.com 

CA链证书

    Data: Version: 3 (0x2) 
    Serial Number: 19:11:eb:af:4c:d5:a9:94:49:ka:2f:41:f2:e1:09:g2 
    Signature Algorithm: sha256WithRSAEncryption 
    Issuer: DC=com, DC=domainA1, CN=DomainA1-Server1CA 
    Validity 
    Not Before: Aug 15 18:41:45 2015 GMT 
    Not After : Aug 15 18:41:45 2025 GMT Subject: DC=com, DC=domainA1,                 
    CN=DomainA1-Server1CA Subject Public Key Info: 
    Public Key Algorithm: rsaEncryption Public-Key: (2048 bit)

        ...C.A
    X509v3 Key Usage:
        Digital Signature, Certificate Sign, CRL Sign
    X509v3 Basic Constraints: critical
        CA:TRUE
    X509v3 Subject Key Identifier:

Answer 1

After enabling SSL certificate on Server.

您可以通过贝娄命令进行测试。

$ openssl s_client -connect <server name>:443

输出:

CONNECTED(00000003)
depth=0 OU = Domain Control Validated, CN = <server-name>
verify error:num=20:unable to get local issuer certificate
verify return:1
-----------
-----------
 Start Time: 1492427495

    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---

如果出现“高于错误”(返回码:20 ..或返回码21)

在 /etc/apache2/site-available/default-ssl.conf 文件中添加波纹管

SSLCertificateFile      /home/ubuntu/cert/e4720ca1b42c1ebb.crt
SSLCertificateKeyFile /home/ubuntu/cert/server.key

SSLCertificateChainFile /home/ubuntu/cert/gd_bundle-g2-g1.crt

再次运行

$ openssl s_client -connect <server name>:443

示例: $ openssl s_client -connect google.com:443
输出:

CONNECTED(00000003)
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
------------
------------
Start Time: 1492431152
Timeout   : 300 (sec)
Verify return code: 0 (ok)

如果仍然出现错误，则应重新生成 SSL KEY 和附加服务器

注意:Apache服务器配置。

希望它能解决问题:)