Subject: verify error:num=21

From: "Austin Conger (IT)" <[email-masked]>
Date: Thu, 3 Apr 2003 14:52:17 -0500

Hi All,
 
When I submit this command to my Verisign Certificate Secured Site I am getting this error.
 
openssl s_client -connect www.domain.com:443
 
Its returning these errors:
 
CONNECTED(00000004)
depth=0 /C=US/ST=michigan/L=some city/O=Company A LLC/OU=Terms of use at www.verisign.com/rpa (c)00/CN=www.domain.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=US/ST=michigan/L=some city/O=Company A LLC/OU=Terms of use at www.verisign.com/rpa (c)00/CN=www.domain.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=US/ST=michigan/L=some city/O=Company A LLC/OU=Terms of use at www.verisign.com/rpa (c)00/CN=www.domain.com
verify error:num=21:unable to verify the first certificate
verify return:1
etc....
 
Can anyone identify the reason as to why this is happening?  
 
The command I used to create the domain.key file:
/usr/local/ssl/bin/openssl genrsa -des3 -rand /var/apache/logs/access_log:/var/log/syslog.5 -out domain.key 1024
 
I then used this to generate the csr:
/usr/local/ssl/bin/openssl req -new -key doamin.key -out domain.csr
 
Any help or suggestions would be greatly appreciated!  
 
Please see my earlier post "netscape warning message" for additional information.
http://marc.theaimsgroup.com/?l=apache-modssl <http://marc.theaimsgroup.com/?l=apache-modssl&m=104929700518122&w=2> &m=104929700518122&w=2
 
Thanks,
 
Austin

---

From: Mads Toftum <[email-masked]>
Date: Thu, 3 Apr 2003 22:06:27 +0200

> Can anyone identify the reason as to why this is happening?  
Very simple really - openssl is telling you that it can't verify the
certificate because it does not know the CA that it was issued by.
Nothing strange or unexpected in that. Use one of the following to
enable verification:

 -CApath arg   - PEM format directory of CA's
 -CAfile arg   - PEM format file of CA's
 
By default openssl knows no CA's, so you need to get the CA cert
of the signer and use that.

vh

Mads Toftum
-- 
`Darn it, who spiked my coffee with water?!' - lwall

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]