verify if server certificate matches with root CA certificate

user_481493 0
Viewed 18469

I have a SSL server certificate for a server and I have a root CA certificate that the client can verify this server certificate during SSL handshake. For some reason I am not sure if I really retrieved the right root certificate. Is there any way where I can see if I have the right root certificate? Maybe an openssl command in which I provide both files and the output tells me "root CA certificate confirms SSL certificate".

Is that possible?

Thanks.

openssl certificate ssl-certificate ssl
2 Answers

There is an OpenSSL function X509_verify using this you can verify a certificate using public key of the root.

Its sample usage I am showing below:

//Get the public key of the root.
EVP_PKEY * pubkey = X509_get_pubkey(ca_cert);

//Verify the certificate.
ret = X509_verify(cert, pubkey);

if(ret != 1)
   //not verified.

OpenSSL does not tell whether this right root certificate. You have to explicitly set it as trusted or not trusted. A root certificate is self signed and so its public key should verify it.

user_16292620
Related