The situation is:there is a root certificate (a home brew)there is an intermediary certificate signed by the previous one (also a home brew)there are two hosts (A and B) on which the above (CA) certificates have been installed in /etc/ssl/certs/on host A a certificate C1 (signed by the intermediary CA) and private key K1 are configured to be used by a network (SOAP) listener.on host B a certificate C2 (signed by the intermediary CA) and private key K2 are configured to be used by a network (SOAP) listener.On host A I can successfully use the network services from both hosts and issuing the commands on host A:openssl s_client -connect A:18080openssl s_client -connect B:18080both return...Verify return code: 0 (ok)...However on host B I can't successfully use any of the network services (certificates are not validated) and issuing the commands on host B:openssl s_client -connect A:18080openssl s_client -connect B:18080both return...Verify return code: 7 (certificate signature failure)...When the verification succeeds, the output from the above commands contains:CONNECTED(00000003)depth=2 C = CX, ST = SX, L = Loc, O = Org, emailAddress = user@org.cxverify return:1depth=1 C = CX, ST = SX, L = Loc, O = Org, emailAddress = user@org.cxverify return:1depth=0 C = CX, ST = Loc, L = Loc, O = Comp, OU = OX, CN = a.comp.int, emailAddress = user@comp.comverify return:1---Certificate chain 0 s:/C=CX/ST=Loc/L=Loc/O=Comp/OU=OX/CN=a.comp.int/emailAddress=user@comp.com   i:/C=CX/ST=SX/L=Loc/O=Org/emailAddress=user@org.cx---When the verification fails, the output from the above commands contains:CONNECTED(00000003)depth=1 C = CX, ST = SX, L = Loc, O = Org, emailAddress = user@org.cxverify return:1depth=0 C = CX, ST = Loc, L = Loc, O = Comp, OU = OX, CN = a.comp.int, emailAddress = user@comp.comverify error:num=7:certificate signature failureverify return:1depth=0 C = CX, ST = Loc, L = Loc, O = Comp, OU = OX, CN = a.comp.int, emailAddress = user@comp.comverify return:1---Certificate chain 0 s:/C=CX/ST=Loc/L=Loc/O=Comp/OU=OX/CN=a.comp.int/emailAddress=user@comp.com   i:/C=CX/ST=SX/L=Loc/O=Org/emailAddress=user@org.cx---Can someone help me find out where the fault lies?Is it that on host B (the one that cannot validate ether certificates) the certification chain (Root CA - Intermediary CA) is somehow broken?What should I do to debug this further?Even though openssl on host B cannot validate the certificates from ether hosts, Firefox running on host B also successfully validates those - of course using its own certificate store where the root CA and the intermediary CA mentioned above have been imported.Again, from the side of host A everything works just fine, as expected.One more thing: the commandopenssl verify -CAfile /etc/ssl/certs/CA.pem -untrusted /etc/ssl/certs/Int_CA.pem /home/<user>/.ssh/id_b.pubon host B produces the result:/home/<user>/.ssh/id_b.pub: OKSo this time everything seems to be in order.
SSL: certificate signature failure
openssl;certificates;https