I have a website that works perfectly with Chrome & other browser but i get some errors with PHP in CLI mode so i'm investigating it, running this:
openssl s_client -showcerts -verify 32 -connect dev.carlipa-online.com:443
Quite suprisingly my HTTPS appears untrusted with a Verify return code: 27 (certificate not trusted) Here is the raw output :
verify depth is 32
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=27:certificate not trusted
verify return:1
depth=1 C = US, O = "GeoTrust, Inc.", CN = RapidSSL CA
verify return:1
depth=0 serialNumber = khKDXfnS0WtB8DgV0CAdsmWrXl-Ia9wZ, C = FR, O = *.carlipa-online.com, OU = GT44535187, OU = See www.rapidssl.com/resources/cps (c)12, OU = Domain Control Validated - RapidSSL(R), CN = *.carlipa-online.com
verify return:1
So GeoTrust Global CA appears to be not trusted on the system (Ubuntu 11.10). Added Equifax_Secure_CA to try to solve this... But i get in this case Verify return code: 19 (self signed certificate in certificate chain) !
Raw output :
verify depth is 32
CONNECTED(00000003)
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify error:num=19:self signed certificate in certificate chain
verify return:1
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = "GeoTrust, Inc.", CN = RapidSSL CA
verify return:1
depth=0 serialNumber = khKDXfnS0WtB8DgV0CAdsmWrXl-Ia9wZ, C = FR, O = *.carlipa-online.com, OU = GT44535187, OU = See www.rapidssl.com/resources/cps (c)12, OU = Domain Control Validated - RapidSSL(R), CN = *.carlipa-online.com
verify return:1
Edit
Looks like my server does not trust/provide the Equifax Root CA, however i do correctly have the file in /usr/share/ca-certificates/mozilla/Equifax...
Looks like GeoTrust has done some re-jiggering of their signing structure.
The third certificate that you're presenting (per Raj's answer) is this one:
But when I open your certificate with a Windows client, the chain resolves to this one:
These two certificates share common cryptography (so they'll both verify for the subordinate's signature), but the one you're presenting is signed by that Equifax certificate, while the one that Windows decides the trust chain leads to is signed by Equifax.
Since you're presenting the certificate that is signed by Equifax instead of the self-signed one, you're not presenting the full chain. Add the Equifax certificate to the chain that your web server is presenting:
Now, that may or may not resolve the trust issues with your
opensslcommand line client - you'll need to make sure that it's properly finding your system's store of trusted roots; you can use-CApathto make sure that it's pointing to the correct location.Add
-CApath RapidSSL_CA_bundle.pem:Download the RapidSSL_CA_bundle.pem here.
Posting in answer instead of comments as this is too big for comment. Don't have ubuntu to test with right at this moment, but chain looks complete from my redhat server(rhel 5 update 3):
openssl s_client -showcerts -connect dev.carlipa-online.com:443