2

When checking Google's certificate with OpenSSL I get

$ echo 'Q' | /usr/bin/openssl s_client -connect www.google.com:443 -servername www.google.com -verify 6 > /dev/null 
verify depth is 6
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
verify error:num=27:certificate not trusted
verify return:1
depth=1 /C=US/O=Google Inc/CN=Google Internet Authority G2
verify return:1
depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
verify return:1
DONE

I then extracted the root certificates from Keychain

$ security find-certificate -a -p /Library/Keychains/System.keychain > cabundle.pem
$ security find-certificate -a \
  -p /System/Library/Keychains/SystemRootCertificates.keychain >> cabundle.pem 

and supplied them to OpenSSL with the same result

$ echo 'Q' | /usr/bin/openssl s_client -connect www.google.com:443 \
  -servername www.google.com -verify 6 -CAfile  ./cabundle.pem > /dev/null 
verify depth is 6
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
verify error:num=27:certificate not trusted
verify return:1
depth=1 /C=US/O=Google Inc/CN=Google Internet Authority G2
verify return:1
depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
verify return:1
DONE

With MacPorts openssl or with the same on a Linux machine everything works as expected.

Am I missing some root certificates?

I am using OpenSSL 0.9.8zh 14 Jan 2016 on OS X El Capitan (10.11.5)

  • Might be useful to the installed versions of openssl. Relevant discussion: security.stackexchange.com/questions/117651/… – NetherLinks Jul 12 '16 at 7:10
  • @NetherLinks I updated the question. But I am already specifying the location of the root certificates with --CAfile – Matteo Jul 12 '16 at 8:28
  • 1
    If it does not work as expected, please tell us what your expectations are. – Max Ried Jul 15 '16 at 11:31
  • As the CA is available OpenSSL should not give a verify error. – Matteo Jul 15 '16 at 11:31
  • OpenSSL prior to about 1.0.2 had path building bugs. "Path Building" refers to RFC 4158 and building the chain to a trusted root. You should start by using OpenSSL 1.0.2 or later. – jww Nov 25 '16 at 4:02

You must log in to answer this question.

Browse other questions tagged .