Mister PKI

SSL Certificates * SSL Tools * Certificate Decoder

Verifying certificate chains is one of the most common troubleshooting tasks when diagnosing TLS and SSL connection issues. If a certificate chain is incomplete or incorrectly configured, clients may fail to establish a trusted connection.

This guide explains how to verify certificate chains with OpenSSL, how certificate trust works, and how DevOps engineers can diagnose certificate validation problems.

This article is part of the PKI for DevOps Engineers training series. In previous lessons we covered certificate chains and debugging TLS with OpenSSL. In this lesson we will verify certificate chains locally using OpenSSL.

—

Table of Contents

—

What is a certificate chain

A certificate chain links a server certificate to a trusted root certificate authority.

The chain typically contains:

  • the server certificate
  • one or more intermediate certificates
  • a trusted root certificate

Clients verify this chain during the TLS handshake to ensure the certificate is issued by a trusted authority.

If you want a deeper explanation, see our guide on certificate chains explained.

—

Why certificate verification fails

Certificate validation errors commonly occur when:

  • intermediate certificates are missing
  • certificate chains are misconfigured
  • root certificates are not trusted
  • certificate expiration has occurred

These issues often appear as TLS handshake errors such as:

  • unable to get local issuer certificate
  • certificate verify failed
  • unable to verify the first certificate

Understanding how to validate certificate chains helps diagnose these problems quickly.

—

Verify certificate chains with OpenSSL

OpenSSL provides a command called openssl verify that can validate certificate chains locally.

Example command:

openssl verify -CAfile chain.pem server-cert.pem

In this example:

  • chain.pem contains the certificate authority chain
  • server-cert.pem is the server certificate being verified

If the certificate is valid, OpenSSL returns:

server-cert.pem: OK

If verification fails, OpenSSL will return an error describing the failure.

For a full command reference and additional examples, see our detailed guide on openssl verify.

—

Verifying certificates retrieved from servers

Before verifying a certificate locally, you may need to retrieve the certificate chain from a server.

This can be done using openssl s_client.

Example:

openssl s_client -connect example.com:443 -showcerts

This command returns the certificate chain presented by the server.

The certificates can then be saved and verified using OpenSSL.

—

Common certificate verification errors

Some common errors encountered when verifying certificate chains include:

Unable to get local issuer certificate

This usually indicates that the intermediate certificate is missing.

Certificate has expired

The certificate’s validity period has ended.

Self-signed certificate

The certificate was not issued by a trusted certificate authority.

Understanding these errors is critical when diagnosing TLS connection failures.

For more troubleshooting examples, see our guide on common TLS errors.

—

Frequently Asked Questions

What does OpenSSL verify do?

The openssl verify command validates certificate chains and confirms that a certificate is trusted by a certificate authority.

Why does certificate verification fail?

Verification commonly fails because intermediate certificates are missing or the certificate chain is misconfigured.

How can I test a server’s certificate chain?

You can retrieve the server certificate using openssl s_client and then verify the certificate locally with OpenSSL.

—

Next Lesson

Next we will learn how to create certificate signing requests using OpenSSL.

Lesson 6 – Creating CSRs with OpenSSL →

—

Training Series Navigation