Openssl is unable to get local issuer certificate ever since DST Root X3 expired

I just used the first example command from this post in that thread:

So, this command:

openssl verify -purpose sslserver -untrusted chain.pem cert.pem

That command works with the openssl version 1.0.2 from the standard Centos7 package. You do not need to install a different version.

That does not use the -CAfile option. The "stock" openssl defaults to your CA system store. Your Centos7 CA store has ISRG Root X1 in it already. You should be fine.

3 Likes