OpenSSL错误-无法获取本地颁发者证书

Question

我有一个简单的链设置，在这种情况下可以成功验证：

$ openssl version
OpenSSL 1.0.2m  2 Nov 2017
$ openssl verify -CAfile chain.pem cert.pem
cert.pem: OK

然而，在这些情况下，我会遇到错误：

$ openssl verify -CAfile ca-cert.pem cert.pem
cert.pem: C = US...
error 2 at 1 depth lookup:unable to get issuer certificate

特别是无法获得颁发者证书。

$ openssl verify chain.pem
chain.pem: C = US...
error 20 at 0 depth lookup:unable to get local issuer certificate

$ openssl verify cert.pem
cert.pem: C...
error 20 at 0 depth lookup:unable to get local issuer certificate

events.js:193
      throw er; // Unhandled 'error' event
      ^

Error: unable to get local issuer certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1036:34)
    at emitNone (events.js:115:13)
    at TLSSocket.emit (events.js:218:7)
    at TLSSocket._finishInit (_tls_wrap.js:637:8)

events.js:193
      throw er; // Unhandled 'error' event
      ^

Error: self signed certificate in certificate chain
    at TLSSocket.onConnectSecure (_tls_wrap.js:1036:34)
    at emitNone (events.js:115:13)
    at TLSSocket.emit (events.js:218:7)
    at TLSSocket._finishInit (_tls_wrap.js:637:8)

Error: unable to verify the first certificate
    at TLSSocket.<anonymous> (_tls_wrap.js:1108:38)
    at emitNone (events.js:105:13)
    at TLSSocket.emit (events.js:207:7)
    at TLSSocket._finishInit (_tls_wrap.js:638:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:468:38)

不知道该怎么做。

在这里他们说：

OpenSSL无法为颁发者（或TLS握手期间从web服务器接收的链中第一个证书的颁发者）找到用于验证签名的本地证书。

此问题通常由日志消息表示，例如“无法获得本地颁发者证书”或“自签名证书”。当一个证书被验证时，它的根CA必须被OpenSSL“信任”，这通常意味着CA证书必须被放置在目录或文件中，并且相关的程序被配置为读取它。OpenSSL程序'verify'以类似的方式运行，并发出类似的错误消息：查看verify(1)程序手册页面以获得更多信息。

• https://www.openssl.org/docs/faq.html#user6

但还是帮不上什么忙。

$ node -pe process.versions | grep openssl
  openssl: '1.0.2l'

Uncaught Error: unable to verify the first certificate
      at TLSSocket.onConnectSecure (_tls_wrap.js:1036:34)
      at TLSSocket._finishInit (_tls_wrap.js:637:8)

Answer 1

（此答案摘自x509_verify_cert，位于crypto/x509/x509_vfy.c:204，在OpenSSL-1.0.2m中）

OpenSSLverify应用程序以以下方式验证证书：它从目标证书开始构建证书链，并跟踪颁发者链，首先搜索随目标证书一起提供的任何不受信任的证书。如果找不到不受信任的颁发者证书，OpenSSL将切换到受信任的证书存储并继续构建链。当出现以下情况时，此进程停止

1. 在受信任存储中找不到颁发者。
2. 遇到自签名证书。
3. 遇到最大验证深度。

然后，OpenSSL扫描链上的每个受信任证书，寻找指定受信任证书用途的SSLv3扩展。如果受信任的证书对于验证操作的“目的”具有正确的“trust”属性（或者具有AnyExtendedKeyUsage属性），则链是受信任的。（请原谅在信任属性上的挥手，这部分代码很难读懂。）

让我们来测试一下。首先，让我们再现OP的错误案例：

#
echo "Making Root CA..."
openssl req -newkey rsa:4096 -nodes -keyout ca-key.pem -sha384 -x509 -days 365 -out ca-crt.pem -subj /C=XX/ST=YY/O=RootCA

echo "Making Intermediate CA..."
openssl req -newkey rsa:3072 -nodes -keyout int-key.pem -new -sha384 -out int-csr.pem -subj /C=XX/ST=YY/O=IntermediateCA
openssl x509 -req -days 360 -in int-csr.pem -CA ca-crt.pem -CAkey ca-key.pem -CAcreateserial -out int-crt.pem

echo "Making User Cert..."
openssl req -newkey rsa:2048 -nodes -keyout usr-key.pem -new -sha256 -out usr-csr.pem -subj /C=XX/ST=YY/O=LockCmpXchg8b
openssl x509 -req -days 360 -in usr-csr.pem -CA int-crt.pem -CAkey int-key.pem -CAcreateserial -out usr-crt.pem

echo ""
echo "Making Chain..."
cat ca-crt.pem int-crt.pem > chain.pem

echo ""
echo "Verfying UserCert via RootCA..."
openssl verify -CAfile ca-crt.pem usr-crt.pem

echo ""
echo "Verfying UserCert via IntermediateCA..."
openssl verify -CAfile int-crt.pem usr-crt.pem

echo ""
echo "Verfying UserCert via chain..."
openssl verify -CAfile chain.pem usr-crt.pem

收益率

[... Skipping OpenSSL KeyGen / CertGen verbosity ...]
Making Chain...

Verfying UserCert via RootCA...
usr-crt.pem: C = XX, ST = YY, O = LockCmpXchg8b
error 20 at 0 depth lookup:unable to get local issuer certificate

Verfying UserCert via IntermediateCA...
usr-crt.pem: C = XX, ST = YY, O = IntermediateCA
error 2 at 1 depth lookup:unable to get issuer certificate

Verfying UserCert via chain...
usr-crt.pem: OK

echo ""
echo "Alternate Intermedate CA (using -addtrust anyExtendedKeyUsage)"
echo ""

echo "Making IntermediateCAWithTrust..."
openssl req -newkey rsa:3072 -nodes -keyout int-key2.pem -new -sha384 -out int-csr2.pem -subj /C=XX/ST=YY/O=IntermediateCAWithTrust
openssl x509 -req -days 360 -in int-csr2.pem -CA ca-crt.pem -CAkey ca-key.pem -CAcreateserial -out int-crt2.pem -addtrust anyExtendedKeyUsage

echo "Making AnotherUser Cert..."
openssl req -newkey rsa:2048 -nodes -keyout usr-key2.pem -new -sha256 -out usr-csr2.pem -subj /C=XX/ST=YY/O=LockCmpXchg8b_2
openssl x509 -req -days 360 -in usr-csr2.pem -CA int-crt2.pem -CAkey int-key2.pem -CAcreateserial -out usr-crt2.pem

echo ""
echo "Verfying AnotherUserCert via IntermediateCAWithTrust..."
openssl verify -CAfile int-crt2.pem usr-crt2.pem

Alternate Intermedate CA (using -addtrust anyExtendedKeyUsage)

Making IntermediateCAWithTrust...
[... Snip more OpenSSL generation output ...]
Making AnotherUser Cert...
[... Snip more OpenSSL generation output ...]

Verfying AnotherUserCert via IntermediateCAWithTrust...
usr-crt2.pem: OK

        X509v3 Basic Constraints:
            CA:TRUE

Trusted Uses:
  Any Extended Key Usage
No Rejected Uses.

有关-addtrust选项中的更多信息以及可以添加的信任属性类型，请参阅https://www.openssl.org/docs/manmaster/man1/x509.html#trust_settings

这一页的底部是前面讨论的简明摘要：

basicConstraints扩展CA标志用于确定证书是否可以用作CA。如果CA标志为true，则它是CA；如果CA标志为false，则它不是CA。所有CA都应将CA标志设置为true。