certificate verify return with error : unable to get issuer certificate

Question

I've created end-point certificate and signed it with my intermediate :

sign end-point with intermediate

openssl x509 -req -days 3650 -CAcreateserial -CA ../intermediate.crt -CAkey ../intermediate.key.insecure -in server.csr -out server.crt -sha256

my server csr:

Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=IL, L=Default City, O=mysrvr, OU=666, CN=www.mysrvr.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:cc:.:b2:4d
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha1WithRSAEncryption
        49:e0:.:.:27:be

my intermediate crt:

openssl x509 -in intermediate_AE.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:22:33:44:55:66:77:90
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=S1, L=Default City, O=SIP, OU=SIPCA, CN=rootca
        Validity
            Not Before: Apr 23 11:39:29 2018 GMT
            Not After : Apr 20 11:39:29 2028 GMT
        Subject: C=AU, O=Default Company Ltd, OU=666, CN=intermediate
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d1:.:.:fb:cf
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                FE:C5:C3:99:D4:05:71:5B:C6:68:95:D0:29:4F:6C:46:CB:C0:4E:3D
            X509v3 Authority Key Identifier:
                keyid:96:D5:C4:D5:CD:B3:88:D4:90:89:AA:F2:FC:D8:86:8B:DE:70:6F:42

    Signature Algorithm: sha1WithRSAEncryption
        42:e7:..:..:..:d0:2d

when I try to verify sign I get:

openssl verify -CAfile intermediate.crt server.crt

server.crt: C = AU, O = Default Company Ltd, OU = 666, CN = intermediate
error 2 at 1 depth lookup:unable to get issuer certificate

my question : what is wrong with my command/intermediate preventing proper chain

Answer 1

OpenSSL attempts to build a chain all the way back to a self signed root cert. It is not sufficient by itself to just trust the intermediate unless you also supply the flag "-partial_chain", i.e. try this:

openssl verify -partial_chain -CAfile intermediate.crt server.crt

Alternatively, you should supply certs all the way back to the root cert. E.g.

openssl verify -CAfile rootCA.cert -untrusted intermediate.crt server.crt

Or, if you want to explicitly trust the intermediate you can concatenate the root CA and the intermediate CA into a single file:

openssl verify -CAfile rootAndInter.crt server.crt