2

When checking Google's certificate with OpenSSL I get

$ echo 'Q' | /usr/bin/openssl s_client -connect www.google.com:443 -servername www.google.com -verify 6 > /dev/null 
verify depth is 6
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
verify error:num=27:certificate not trusted
verify return:1
depth=1 /C=US/O=Google Inc/CN=Google Internet Authority G2
verify return:1
depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
verify return:1
DONE

I then extracted the root certificates from Keychain

$ security find-certificate -a -p /Library/Keychains/System.keychain > cabundle.pem
$ security find-certificate -a \
  -p /System/Library/Keychains/SystemRootCertificates.keychain >> cabundle.pem 

and supplied them to OpenSSL with the same result

$ echo 'Q' | /usr/bin/openssl s_client -connect www.google.com:443 \
  -servername www.google.com -verify 6 -CAfile  ./cabundle.pem > /dev/null 
verify depth is 6
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
verify error:num=27:certificate not trusted
verify return:1
depth=1 /C=US/O=Google Inc/CN=Google Internet Authority G2
verify return:1
depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
verify return:1
DONE

With MacPorts openssl or with the same on a Linux machine everything works as expected.

Am I missing some root certificates?

I am using OpenSSL 0.9.8zh 14 Jan 2016 on OS X El Capitan (10.11.5)

  • Might be useful to the installed versions of openssl. Relevant discussion: security.stackexchange.com/questions/117651/… – NetherLinks Jul 12 '16 at 7:10
  • @NetherLinks I updated the question. But I am already specifying the location of the root certificates with --CAfile – Matteo Jul 12 '16 at 8:28
  • 1
    If it does not work as expected, please tell us what your expectations are. – Max Ried Jul 15 '16 at 11:31
  • As the CA is available OpenSSL should not give a verify error. – Matteo Jul 15 '16 at 11:31
  • OpenSSL prior to about 1.0.2 had path building bugs. "Path Building" refers to RFC 4158 and building the chain to a trusted root. You should start by using OpenSSL 1.0.2 or later. – jww Nov 25 '16 at 4:02

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.