Search code examples
sslopensslcertificateverificationmulti-level

OpenSSL: Create a self-signed CA with many intermediate certificate levels

I'd like to build my own self-signed CA structure to use in my applications. The idea is presented by the following picture:

OpenSSL cert idea

So, to summarize it, I want a CA that has several levels of intermediate certificates.

For instance I want to create a Root CA that signs all of my apps and then create an intermediate cert for my first app APP_1. This app is used by several companies so I want that every company has it's own intermediate cert just for them which is signed by APP_1 (you can imagine this intermediate cert as a "child" of APP_1 cert). Company intermediate cert then signs end-user's certificate which he uses on his device.

Is it possible to create this cert hierarchy scheme with OpenSSL?

I've tried to create an example of this scheme and it went well until I tried to verify Company_1 intermediate cert. The verification with the chain was successful, but the verification with the intermediate cert that created this one failed. The command that fails is this one:

openssl verify -CAfile /CA/app_1/certs/app_1.cert.pem /CA/app_1/company_1/certs/company_1.cert.pem

The error is as it follows:

error 2 at 1 depth lookup: unable to get issuer certificate
error /CA/app_1/company_1/certs/company_1.cert.pem: verification failed

What am I doing wrong? Should I also verify the Company_1 intermediate with Root CA as I do with APP_1?

Solution

  • openssl verify by default wants to build the full chain. But you only provide the leaf certificate and the chain certificate and not the root certificate (which is signed by itself). To accept a chain certificate as the final trust anchor instead of a root certificate use the -partial_chain option:

    $ openssl verify -partial_chain  -CAfile app_1.cert.pem company_1.cert.pem