I want openssl to list entire cert chain, including root CA, when executing:
openssl s_client -showcerts -connect host:443
However, this is not the case. Depth 2 cert root CA cert is not included:
openssl s_client -showcerts -connect www.google.com:443 CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 -----BEGIN CERTIFICATE----- MIIFkzCCBHugAwIBAgIQP1H8lc2ARYwDAAAAALrahTANBgkqhkiG9w0BAQsFADBC MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMRMw EQYDVQQDEwpHVFMgQ0EgMU8xMB4XDTIwMTExMDE0MjgwOVoXDTIxMDIwMjE0Mjgw OFowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcT DU1vdW50YWluIFZpZXcxEzARBgNVBAoTCkdvb2dsZSBMTEMxFzAVBgNVBAMTDnd3 dy5nb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvnPJ VeaTK7pGoNtG1rGNLHR2y2aYUXJx5+mHCUQsn0+hsEb1VXJQtbI61Zs8HEH3kGmd PD3opQoH5wY9uBadLMsGXtfSeuFCIJThLgz8SCTOr7Q/BDJqZ37HaibQfYu8upcR Mvd/Gp5udJAy2uFlQ5o5vCf0ySAPXrN1fmhh1z6pIXJa0pLmG/rysSMAJZbVOF0J nEfJ1/HTGiPzzNON37DHvWc1t13tFuc3xiIsWQrEkOoknhLAiZvle0R9CNB2vawd aQmRXLHRi+1BJRLvgCDgdM/wMdLwDUHCPf08B3WC7O2W3yxu8Tu3AWC7g1LY0XRb 24qAW+8e7VzPmfRvBQIDAQABo4ICXTCCAlkwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFBvBctGy1itS cOPrDhxR3cCF31OaMB8GA1UdIwQYMBaAFJjR+G4Q68+b7GCfGJAboOt9Cf0rMGgG CCsGAQUFBwEBBFwwWjArBggrBgEFBQcwAYYfaHR0cDovL29jc3AucGtpLmdvb2cv Z3RzMW8xY29yZTArBggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nL2dzcjIvR1RT MU8xLmNydDAZBgNVHREEEjAQgg53d3cuZ29vZ2xlLmNvbTAhBgNVHSAEGjAYMAgG BmeBDAECAjAMBgorBgEEAdZ5AgUDMDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9j cmwucGtpLmdvb2cvR1RTMU8xY29yZS5jcmwwggEFBgorBgEEAdZ5AgQCBIH2BIHz APEAdwD2XJQv0XcwIhRUGAgwlFaO400TGTO/3wwvIAvMTvFk4wAAAXWyxYQuAAAE AwBIMEYCIQCH6zkFy7ML4LOs6uXxQGdAY+ggd/MPz46av190Df4z0wIhALdmziRv LtcrwcWa7apMJbfNVtRQiD0kRp9oQAx5+4t1AHYAlCC8Ho7VjWyIcx+CiyIsDdHa TV5sT5Q9YdtOL1hNosIAAAF1ssWEfQAABAMARzBFAiEAiUjUL8/6cpQJ8p9tWUE5 Sib0yQLYp7Y2v+ocLCapxJACIHWcToQ7NTrnJW2uAqpyruoGppLPou6D4eugtC9/ 8FmhMA0GCSqGSIb3DQEBCwUAA4IBAQC2rVWLbSjwz3yIghOQGgHt0WPN8HjPbUoU m6qqsrpqgIGg6ZpHRqO+Qym5yWTgabpCQ+5Mi/Q+FwJlqLd49UydB2xSndiuHPxj aYanphIHLhx4NqFmNiktg+ZY7d5ARz0sVBkom2mc9WHnpPJQPWhXdBL0OgY7r+Ik Y3NkRocsigeyyjHyE9VL6WTmRV64/ehih/pQCJBeb69yU0FkkWJ9EwwaN7Z0rSHd 4hdCTGfl1Lg34Nl5e6IoOTrOLh5uFHdJAiAdXWeDDLfYlgpUAhtf+pWYTWyKGhg0 2haxV9AoHZKY3KTd4tb6OC/O+6g0GauNoiOt55Os0pnKk5i0gZ0r -----END CERTIFICATE----- 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign -----BEGIN CERTIFICATE----- MIIESjCCAzKgAwIBAgINAeO0mqGNiqmBJWlQuDANBgkqhkiG9w0BAQsFADBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEGA1UEChMKR2xvYmFs U2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjAeFw0xNzA2MTUwMDAwNDJaFw0yMTEy MTUwMDAwNDJaMEIxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVHb29nbGUgVHJ1c3Qg U2VydmljZXMxEzARBgNVBAMTCkdUUyBDQSAxTzEwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDQGM9F1IvN05zkQO9+tN1pIRvJzzyOTHW5DzEZhD2ePCnv UA0Qk28FgICfKqC9EksC4T2fWBYk/jCfC3R3VZMdS/dN4ZKCEPZRrAzDsiKUDzRr mBBJ5wudgzndIMYcLe/RGGFl5yODIKgjEv/SJH/UL+dEaltN11BmsK+eQmMF++Ac xGNhr59qM/9il71I2dN8FGfcddwuaej4bXhp0LcQBbjxMcI7JP0aM3T4I+DsaxmK FsbjzaTNC9uzpFlgOIg7rR25xoynUxv8vNmkq7zdPGHXkxWY7oG9j+JkRyBABk7X rJfoucBZEqFJJSPk7XA0LKW0Y3z5oz2D0c1tJKwHAgMBAAGjggEzMIIBLzAOBgNV HQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIGA1Ud EwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFJjR+G4Q68+b7GCfGJAboOt9Cf0rMB8G A1UdIwQYMBaAFJviB1dnHB7AagbeWbSaLd/cGYYuMDUGCCsGAQUFBwEBBCkwJzAl BggrBgEFBQcwAYYZaHR0cDovL29jc3AucGtpLmdvb2cvZ3NyMjAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnBraS5nb29nL2dzcjIvZ3NyMi5jcmwwPwYDVR0g BDgwNjA0BgZngQwBAgIwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly9wa2kuZ29vZy9y ZXBvc2l0b3J5LzANBgkqhkiG9w0BAQsFAAOCAQEAGoA+Nnn78y6pRjd9XlQWNa7H TgiZ/r3RNGkmUmYHPQq6Scti9PEajvwRT2iWTHQr02fesqOqBY2ETUwgZQ+lltoN FvhsO9tvBCOIazpswWC9aJ9xju4tWDQH8NVU6YZZ/XteDSGU9YzJqPjY8q3MDxrz mqepBCf5o8mw/wJ4a2G6xzUr6Fb6T8McDO22PLRL6u3M4Tzs3A2M1j6bykJYi8wW IRdAvKLWZu/axBVbzYmqmwkm5zLSDW5nIAJbELCQCZwMH56t2Dvqofxs6BBcCFIZ USpxu6x6td0V7SvJCCosirSmIatj/9dSSVDQibet8q/7UK4v4ZUN80atnZz1yg== -----END CERTIFICATE----- --- Server certificate subject=/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com issuer=/C=US/O=Google Trust Services/CN=GTS CA 1O1 --- No client certificate CA names sent Server Temp Key: ECDH, X25519, 253 bits --- SSL handshake has read 3208 bytes and written 281 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-CHACHA20-POLY1305 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-CHACHA20-POLY1305 Session-ID: BDC10F2FDB072D68E18A32B3BFE025D874AB08C97C11D2FA9D7105010CFE44A5 Session-ID-ctx: Master-Key: 2A041A3C5386A91E9088D17502FE33DFE7794A688D205CCBFE5AEF86B1E6E3AD43580C28FD024BE8007F2A9CC9377B6D TLS session ticket lifetime hint: 100800 (seconds) TLS session ticket: 0000 - 01 bc 94 57 98 22 79 55-e5 74 07 e4 15 9d cb 21 ...W."yU.t.....! 0010 - 31 6b e0 cb 69 f5 83 08-93 80 b1 88 fd 3e a9 3f 1k..i........>.? 0020 - 22 c0 e3 1d f8 7b de 93-56 08 20 94 38 64 a3 58 "....{..V. .8d.X 0030 - b2 a9 49 a4 20 9f 0f 14-b2 58 1d 47 ae ca de 9a ..I. ....X.G.... 0040 - fe 72 0e 84 ad eb 14 8b-c3 2b fd 29 df da 8a 4c .r.......+.)...L 0050 - 53 21 1d 69 5c b6 5e 22-5a e7 ba c4 e0 65 7a b7 S!.i\.^"Z....ez. 0060 - 39 d5 52 b4 19 40 16 72-eb 2e 88 03 8d 25 d7 0d [email protected].....%.. 0070 - 83 ac 13 9e ad 49 33 56-5c 74 e3 22 af af 69 d3 .....I3V\t."..i. 0080 - fc 4b fe 40 57 44 94 e4-df 8c db 0f 9b 42 a7 1a [email protected].. 0090 - 4c 2d 1e c3 28 0d 41 78-ff b7 55 1c fb 02 59 b2 L-..(.Ax..U...Y. 00a0 - 10 8f 44 b9 c2 4a ec 59-ef 6b 89 e0 15 b9 db 63 ..D..J.Y.k.....c 00b0 - df 78 da 4e 0f 69 d7 c9-13 b5 0c 8f a4 67 65 17 .x.N.i.......ge. 00c0 - f9 74 41 ae 6a da a5 22-b5 1c 7f 46 0d b0 64 74 .tA.j.."...F..dt 00d0 - d8 40 f2 c0 46 e6 7c 71-d9 bf b8 91 75 [email protected].|q....u Start Time: 1608578092 Timeout : 7200 (sec) Verify return code: 0 (ok) --- Quick investigation reveals why this might be the case. 04:00:00:00:00:01:0F:86:26:E6:0D is the serial number of the www.google.com cert chain root CA cert I can see when I inspect it in the browser:
openssl version -a LibreSSL 2.8.3 built on: date not available platform: information not available options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx) compiler: information not available OPENSSLDIR: "/private/etc/ssl" ls -lR /private/etc/ssl total 696 -rw-r--r-- 1 irek staff 346545 Dec 21 20:08 cert.pem drwxr-xr-x 2 root wheel 64 Sep 9 2019 certs -rw-r--r-- 1 root wheel 745 Sep 9 2019 openssl.cnf -rw-r--r-- 1 root wheel 1006 Sep 9 2019 x509v3.cnf /private/etc/ssl/certs: cat /private/etc/ssl/cert.pem | grep -i '04:00:00:00:00:01:0F:86:26:E6:0D' 04:00:00:00:00:01:0f:86:26:e6:0d Up until now it could make sense. However, when I:
- delete this certificate from
/private/etc/ssl/cert.pem, - or specify CApath without this cert,
- or specify CAfile without this cert, nothing changes - the depth 2 root CA cert is not listed anyway.
I either made an incorrect assumption that I can get openssl to include top-level cert in cert chain with -showcerts, or I'm misinterpreting the role of CApath / CAfile, or I'm making a simple mistake somewhere.
