Thank you Victor for that valuable analysis. The original self-signed CA file has a NUL at the end which has been propagated when we created the concatenated CA file. We'll have to see how that cert was created and also correct our concatenation routine to cater for trailing NULs. That will teach me not to make assumptions! Regards, John. -----Original Message----- From: openssl-users [mailto:openssl-users-bounces@xxxxxxxxxxx] On Behalf Of Viktor Dukhovni Sent: 06 September 2016 21:14 To: openssl-users at openssl.org Subject: Re: A self-signed CA certificate in the CA files *sometimes* stops verification working On Tue, Sep 06, 2016 at 06:10:42PM +0000, John Unsworth wrote: > This seems to me to be very easy to validate by just inserting a self-signed certificate at the front of a CAfile that works. > > Attached are the 3 certificate files. > > _CAcerts.good is the first file with two certs the second of which is the CA cert for the server. > _CAcerts.bad has the self-signed cert inserted between the two original CA certs. > _CAcerts.bad.fixed has the self-signed cert last, after the valid CAcert for the server. The CAcerts.bad file contains a NUL byte at the start of the (should be) blank line separating two of the certificates. This prevents OpenSSL from reading the rest of the file. Cleaned-up CAfiles attached, the server cert verifies with all three. $ for file in _CAcerts.*; do echo $file; openssl verify -CAfile $file chain.pem; done _CAcerts.bad chain.pem: OK _CAcerts.bad.fixed chain.pem: OK _CAcerts.good chain.pem: OK -- Viktor.
