8

I've attempted to setup a certificate authority, and issue a certificate from that authority (with no intermediate inbetween The authority covers *.node.consul, and the certificate is underneath that at: i-0c2e25880dab06f71.node.consul). However when executing openssl verify (passing in the -CAfile option), it seems to still not be able to complete the lookup:

root@i-0c2e25880dab06f71:~# openssl verify -verbose -CAfile /root/ssl-ca.crt /root/ssl-cert.pem /root/ssl-cert.pem: CN = i-0c2e25880dab06f71.node.consul, emailAddress = [email protected], O = Instructure, OU = Ops, C = US, ST = UT, L = SLC error 20 at 0 depth lookup:unable to get local issuer certificate

Reading in the certificates with:

openssl x509 -in /root/ssl-cert.pem -text -noout

Leads to the following two outputs:

for the ca:

Certificate: Data: Version: 3 (0x2) Serial Number: d3:f3:bc:d7:8f:6c:43:2f:ad:9b:6c:3e:1d:13:8e:c4 Signature Algorithm: sha256WithRSAEncryption Issuer: CN=*.node.consul/[email protected], O=Instructure, OU=Ops, C=US, ST=UT, L=SLC Validity Not Before: Jan 1 16:52:31 2018 GMT Not After : Jan 1 16:52:31 2038 GMT Subject: CN=*.node.consul/[email protected], O=Instructure, OU=Ops, C=US, ST=UT, L=SLC Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:be:15:5d:e3:32:b0:58:bf:01:7b:73:c2:ad:b6: 7c:59:9f:ca:a0:6a:26:64:8b:56:83:6e:43:b6:aa: e9:81:70:39:70:22:bd:10:a4:d8:d1:a1:a1:cb:0d: eb:d2:5c:c3:f8:9c:d2:d9:a5:d0:48:65:bb:d1:a8: 1a:cc:a4:53:27:9a:ca:fc:23:84:e3:f7:59:97:d6: 05:35:f5:94:5e:af:aa:a8:4f:24:25:0a:8e:e1:21: 6a:35:a5:e7:da:ed:f4:50:2c:cc:ef:ac:a6:28:da: c1:a3:ea:53:84:64:9f:2c:a0:6a:73:6a:8d:e6:7e: 03:10:dd:42:cc:89:24:13:d7:5d:14:43:e2:cc:9a: 12:ef:4b:c6:96:fb:20:88:0e:fc:6c:b3:88:ba:ed: 64:d9:f7:8f:97:e1:50:a0:ae:42:5f:4f:8e:8f:7e: 40:fd:e5:a3:f4:1d:fc:88:f0:c3:2e:d1:1d:32:fb: 95:85:00:23:ba:d3:cc:0c:65:8e:be:e0:dd:4f:5f: 22:fe:26:8d:1c:12:94:0a:d1:44:4d:0c:be:72:56: c6:7e:be:cb:81:41:0f:20:d8:31:34:d9:4c:11:ae: c5:12:57:35:bf:15:8c:ea:15:88:29:2d:81:c8:11: fb:a8:13:7a:cb:eb:68:f8:32:47:98:fa:dc:86:a9: 07:4a:cf:96:0d:fd:ce:09:48:df:ac:f7:f4:57:d0: 13:d5:75:cc:3d:63:3c:26:2d:95:88:b7:f9:27:83: 2a:ff:1f:63:fd:b5:f0:e9:d3:cf:85:3b:7a:6e:0e: 56:46:70:29:1e:be:3f:02:81:81:0c:0b:d4:88:da: 7f:93:46:03:d1:0c:73:97:44:33:a3:0b:1a:a0:a6: b5:4d:f1:95:ea:37:7f:ac:e2:71:e1:90:94:97:99: 5f:d8:84:f5:29:9e:9a:86:ff:cd:6e:7d:b0:64:2e: a1:21:a8:4a:84:e3:6c:a9:ac:cf:62:3e:8f:fd:71: 14:c9:c1:dc:99:13:84:9a:47:9a:42:53:52:e0:72: 32:48:9d:1b:ab:ea:c4:97:24:20:a3:86:e3:d5:d5: 79:c6:bf:e1:b0:31:a7:8f:8d:bc:0b:f3:b4:ab:03: f1:e2:68:08:e0:3a:c3:50:3e:c1:40:8b:42:ae:71: 7d:7b:24:24:34:75:df:9f:b2:75:16:63:af:7b:58: fb:eb:0c:8e:44:a7:1b:bb:59:c9:b4:db:c1:b4:9a: c1:b1:42:a5:4b:62:b4:84:ab:c9:b0:6e:fe:db:20: 9e:32:24:0c:3c:dd:8b:82:9a:f6:75:76:73:6f:73: f6:34:d8:02:b7:01:7c:e2:f7:90:43:5e:d0:00:dc: 0f:4d:e1 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Basic Constraints: critical CA:TRUE, pathlen:1 X509v3 Subject Alternative Name: critical DNS:*.node.consul Signature Algorithm: sha256WithRSAEncryption 53:52:50:d2:25:01:8f:7a:fb:03:18:2f:3c:cd:d2:85:4f:d2: 4d:39:8e:e4:06:bb:fa:8d:9a:9a:ab:e0:8f:ce:bb:6f:74:49: 1d:72:fb:27:e8:0f:bb:62:40:d7:06:69:71:4f:21:39:ac:ba: 78:b5:a8:43:8c:2d:6c:87:45:8e:75:9e:a4:79:65:cb:b0:bf: 47:0c:86:7a:a8:9b:40:80:71:30:a5:fe:db:1f:f2:2e:41:85: f2:1d:8a:31:bd:ec:6d:94:58:a5:b5:93:25:6f:b8:bd:4e:13: 7a:40:d2:e2:bc:41:e6:33:fe:22:55:bb:01:5d:7e:af:8d:62: 9b:9f:9d:c9:e8:63:4d:7a:b5:f9:13:8f:f3:45:68:a8:1f:e7: d5:5b:cc:77:49:eb:c9:26:3d:19:50:b6:34:e8:e4:21:14:37: aa:76:d0:e0:77:69:77:ab:6a:da:0d:e7:22:6d:23:61:5c:8b: da:64:da:48:5a:6f:01:42:0f:c1:24:06:5c:f6:06:3c:45:3a: 37:c0:3e:0a:ee:cb:44:aa:d3:a9:74:d0:e2:77:30:d4:0a:8b: 13:73:ba:a6:a2:3b:02:f0:60:fa:6e:27:20:d1:3d:23:64:38: 4d:54:36:c5:20:04:d1:2e:68:6d:5c:30:af:ef:5a:a5:7f:a5: 06:c2:f7:51:40:ec:14:c7:1d:bc:45:7f:fe:77:02:50:aa:37: 19:9d:2c:02:74:a3:56:e5:d4:36:e9:c0:33:bc:c8:52:e2:c8: 1e:21:26:83:cb:e3:b6:72:55:df:1e:dc:48:7b:d8:1a:ca:2a: 21:4f:eb:94:9f:de:82:f8:5b:82:0d:ef:d5:e9:89:99:b4:48: ce:d5:9e:a4:ca:3b:c9:e1:19:a5:60:ec:04:36:31:11:b0:31: 7a:22:64:9c:6e:dd:82:e4:65:96:a2:e3:aa:9c:99:ec:f5:e1: 48:84:7c:f5:38:00:cb:24:cf:5d:ed:e5:87:a9:86:c5:cb:4f: 65:6a:35:21:2e:30:cd:e6:85:84:13:e3:ff:9c:72:4d:a8:9c: fb:63:01:eb:a8:ae:6f:84:66:b8:bd:fe:0f:c9:17:96:8d:42: 9d:8c:0c:bc:90:ab:17:19:df:6f:6a:28:fc:8c:50:6d:88:69: 31:75:6e:d7:6d:f2:f4:70:f0:64:14:c2:fc:57:dc:f3:68:57: 9d:4c:fe:94:e5:13:d7:9f:ad:ee:68:1b:df:9c:af:bb:f4:73: 83:d6:0a:54:fa:73:ec:02:f2:f2:87:35:7c:2a:58:df:20:32: 1a:c2:c2:ba:1d:4f:5f:8c:fe:3c:7e:e7:0c:80:0e:27:57:c2: 01:48:1f:58:f7:2c:f3:b7

And for the certificate itself:

Certificate: Data: Version: 3 (0x2) Serial Number: d7:9b:09:48:1f:62:44:95:80:ef:b7:e4:5c:e1:c7:4b Signature Algorithm: sha256WithRSAEncryption Issuer: CN=*.node.consul/[email protected], O=Instructure, OU=Ops, C=US, ST=UT, L=SLC Validity Not Before: Jan 1 18:41:57 2018 GMT Not After : Jan 1 18:41:57 2021 GMT Subject: CN=i-02da590eb53768ddc.node.consul/[email protected], O=Instructure, OU=Ops, C=US, ST=UT, L=SLC Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:aa:77:6d:61:52:be:92:78:b6:b2:82:41:93:08: 86:ba:00:e3:fc:d4:43:2e:3a:e6:49:f8:9d:dc:e5: 40:f3:18:18:ac:56:ae:a1:96:b6:ff:35:63:97:8b: 9b:a7:cc:c0:f3:7b:99:82:8e:4c:cf:d4:25:56:c2: 32:2f:35:08:5f:79:ee:ea:52:02:2b:2f:11:ac:10: ea:18:e7:00:b6:52:ee:df:c7:01:7a:68:7e:32:1c: 63:73:77:43:99:a0:a6:13:05:26:39:e2:4d:b9:e6: c1:58:99:02:dc:0c:99:90:1f:d4:79:9e:fe:77:99: 58:a7:a7:26:42:9e:13:34:f3:e9:c2:f2:3a:6f:72: 33:55:ad:66:89:4a:39:4b:c9:67:a8:d2:8e:80:75: 42:c9:01:9e:e7:d0:b1:7a:63:f5:6b:f1:a4:66:be: d9:e5:e9:87:4c:2e:99:87:0f:26:1f:2c:19:25:78: 82:fe:31:e2:26:6f:de:0d:93:75:65:7f:cc:c9:a3: 24:69:db:7b:57:57:fa:49:ec:39:8c:ac:92:2f:1c: cc:3d:e4:e2:6c:48:4b:bb:35:20:74:77:91:80:ad: 7d:9d:9f:7b:53:7c:bf:98:bb:a6:27:15:de:aa:27: e3:8b:87:3b:35:50:ac:6d:36:ba:2b:95:b5:4b:2b: ce:6b:84:91:e0:4d:e0:21:fd:d3:80:43:17:98:ff: 66:b8:7f:32:f9:ed:d3:25:a3:6f:b4:e9:26:56:4c: c3:d8:2f:2f:6e:f8:9a:85:4d:a9:05:d2:f5:60:1d: 42:df:29:75:1b:2c:66:b1:a4:56:8a:0b:43:14:b8: 7d:62:4d:5a:1b:a6:a1:da:98:64:4e:e2:e2:8b:8d: c9:57:f9:7d:58:91:12:d7:dd:7b:52:7c:00:91:bc: ab:25:a0:63:91:8c:02:c8:8f:7e:23:80:33:95:b2: 4a:ea:f9:ee:87:1a:17:f1:85:60:ae:db:f1:d3:63: ab:0b:d8:ab:7c:56:90:8f:f5:9a:60:25:2b:81:b5: df:bc:f7:0d:9c:47:8a:b6:4d:2b:88:21:cf:bd:d5: fe:1a:d7:76:19:03:06:d1:9b:67:42:f9:8f:be:27: 61:9f:a8:9c:2a:57:96:e1:a2:d8:84:7f:9f:15:bb: b2:ae:21:92:7a:4c:42:69:10:63:da:bf:b6:eb:74: 57:13:6f:d9:c2:a9:99:09:09:b5:d6:ff:e0:c4:eb: 91:bf:4d:9e:98:3e:e3:8c:69:7a:06:01:f7:d0:75: df:d2:6e:78:b2:39:6a:73:70:41:dd:30:f5:00:c0: f6:70:d3:63:76:98:01:ee:52:4a:92:77:39:c5:ab: 99:33:97 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Basic Constraints: critical CA:FALSE X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication X509v3 Subject Key Identifier: AA:C7:CB:B6:22:D2:EF:05:72:89:92:DF:2E:44:6B:D5:33:00:D8:06 X509v3 Subject Alternative Name: critical DNS:i-02da590eb53768ddc.node.consul Signature Algorithm: sha256WithRSAEncryption ab:dc:ad:f4:55:af:a6:ca:27:d2:7a:f6:77:b3:4f:1d:14:41: 7c:56:3a:a0:75:de:1f:0a:3c:7f:50:d0:4d:b0:1b:01:75:4c: d0:19:c7:5d:86:c5:ac:85:10:9e:58:22:87:23:70:27:a5:75: 11:73:6f:2f:8e:f3:90:ca:51:c7:cb:75:46:59:91:3f:d3:f3: dd:d4:60:4d:60:e1:82:a9:c6:e8:ac:3e:01:9d:4d:b8:cb:70: 90:2a:f6:58:ba:dd:44:67:e7:7e:71:70:cc:fc:5a:7e:1e:e4: 32:e4:2c:43:64:79:69:32:a4:d2:12:5a:fe:3e:e3:47:b9:3d: 8d:41:16:b5:5e:d8:bd:dd:39:e8:0a:8a:ee:7d:44:fd:98:bc: 02:79:57:d5:2d:dd:f7:14:87:f5:19:29:80:27:f4:3d:6e:0d: 0a:ce:78:fd:e1:1e:b3:7e:4b:cd:07:d7:e3:4e:50:35:56:a6: 8d:ea:3d:b3:ab:99:55:54:27:22:9d:3d:7d:93:37:b6:9d:51: 5d:f1:64:69:d9:72:de:58:e2:ec:4e:c0:0e:62:77:68:13:5e: 2d:01:7b:06:ec:8a:23:bc:6f:e5:ee:b5:1d:0b:4d:08:35:6c: 49:a4:43:24:32:99:ad:fd:34:44:24:ba:49:f7:79:28:0e:88: cb:72:9b:ce:c4:9d:fc:e1:5f:3c:d9:f5:18:ae:e9:f4:4a:52: 72:03:cb:77:23:0d:9b:63:9a:1f:66:fe:6e:f1:78:87:85:80: 93:39:d7:59:dd:7b:4b:c5:b2:13:7b:f5:ab:78:ac:32:cf:b1: b6:2b:08:5f:ba:46:fd:50:82:48:62:81:e6:9d:77:05:25:53: 40:c1:6d:8b:b2:89:5f:fb:6e:f9:d3:69:e7:d6:f8:7c:5e:72: 0a:19:d5:bc:ec:4f:f3:91:38:cc:88:58:f1:19:0b:08:8a:76: 45:c8:3f:30:52:ff:8c:83:01:5e:c8:f7:41:ee:38:13:db:ce: 9b:86:a3:0b:a3:3d:48:d1:03:2c:ab:6f:1c:b1:46:67:70:13: 64:99:c3:37:21:af:4d:ce:0a:28:9c:94:67:89:d4:04:5d:a2: 56:fa:e0:bb:82:5f:75:d4:a5:22:a7:57:53:dc:cb:f1:65:e3: df:b6:66:a2:88:39:25:09:b5:84:a8:5b:a7:76:89:a1:46:7b: 16:d3:df:7f:ab:a2:41:c1:cb:0b:75:98:8c:d6:67:fd:5b:4a: ad:50:a9:e0:af:5c:f3:28:a0:aa:80:62:f5:77:4d:17:d4:6a: 3f:2a:6a:59:47:c4:b1:88:36:f6:55:f2:32:84:6b:70:78:3a: d2:b4:13:53:e2:1c:e8:ef

I assume this is probably due to something in the way I've generated the certificates, but I'm not really sure where to check. As it's my understanding error 20 unable to lookup local issuer certificate happens when it can't find a particular cert in the chain. However, I'm not sure why it can't find the full info it needs.

Improve this question

1 Answer 1

Reset to default
6

You CA certificates has the following extensions:

X509v3 extensions: X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Basic Constraints: critical CA:TRUE, pathlen:1 X509v3 Subject Alternative Name: critical DNS:*.node.consul

Apart from the fact that there is no need for Subject Alternative Name extension and TLS Web Client/Server Authentication key usage for a CA certificate none of the given key usages is needed for a CA but the one which is needed is missing.

Lets see what the key usages you have are needed for. The relevant citations are taken from RFC 5280 section 4.2.1.3 Key Usage.

  • Digital Signature
    The digitalSignature bit is asserted when the subject public key is used for verifying digital signatures, other than signatures on certificates (bit 5) and CRLs (bit 6), such as those used in an entity authentication service, a data origin authentication service, and/or an integrity service.
  • Key Encipherment
    The keyEncipherment bit is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. For example, this bit shall be set when an RSA public key is to be used for encrypting a symmetric content-decryption key or an asymmetric private key.

In other words: none of these key usages is relevant when validating the signature on certificates.

But there is one important key usage needed when validating certificates:

  • Certificate Sign
    The keyCertSign bit is asserted when the subject public key is used for verifying signatures on public key certificates. If the keyCertSign bit is asserted, then the cA bit in the basic constraints extension (Section 4.2.1.9) MUST also be asserted.

Only, this key usage is missing on your CA certificate. That's why it will not use this CA certificate to validate the signature of the leaf certificate and thus it fails to build the trust chain. Once you add this key usage to your CA certificate (and preferable remove all the unneeded key usage, purpose and SAN) it will successfully be used to validate the leaf certificate.

If that was there, it would look like

X509v3 Key Usage: critical Digital Signature, Certificate Sign, Key Encipherment
Improve this answer
1
  • @EvanCarroll: not in OpenSSL, which displays in the bit order defined by the ASN.1 which puts Certificate Sign AFTER Key Encipherment if both are present (which Steffen didn't recommend anyway) Commented Apr 24, 2019 at 22:50

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.