Curl fails to validate ceriticate presented by openssl server (with fullchain.pem)

Welcome @sat95

The openssl s_server requires 3 cert related files for this. The -key you have is correct.

But, the -cert should be the .../cert.pem file and you need the -cert_chain option for the .../chain.pem file.

You have fullchain.pem in the -cert file option but openssl only uses the first cert in that file. Thus, your client (curl) cannot follow the cert to a trusted root and fails validation

You can see this by using the below command instead of curl to test the connection.

echo | openssl s_client -connect satdev.hopto.org:443 | head -40 

You will only see a single cert in the "Certificate Chain" section when connecting to openssl s_server like you did it. Compare that to connecting to a domain like letsencrypt.org using that same openssl s_client command. For that you will see two certificates. The leaf and the intermediate which are both in "fullchain.pem" from Certbot.

Once you set the 3 options it should work fine. I just reproduced all of this on my own test server :slight_smile:

2 Likes