Error in Request Certificate Phase

On my machines this command only works if I give it the trust store manually.

# openssl verify -purpose sslserver -CAfile chain.crt \*.interpreter.convergentsolutions.com.au.crt

This suggests that there may be an invalid formatted X509 cert somewhere.

The fact that OpenSSL spits out Expecting: TRUSTED CERTIFICATE is usually not related to the trust store. It's OpenSSLs generic message it gives when it wants an X509 cert as input, but got something else.

You can try this for yourself:

# openssl x509 -text -noout
< Put garbage here, CTRL-D to end input>

Gives output:

unable to load certificate
139748794573952:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: TRUSTED CERTIFICATE

(If you give it a valid X509 cert however, you will get correct output, even if it's a self signed cert not in your trust store)

1 Like