What is the correct format for a CRLF in a SSL certificate's pem
No, x509: certificate signed by unknown authority shows that the certificate of the Certificate Authority or one of the intermediate certificates issued by it is not present at the other party. It could be that the certificate is very new and it hasn't yet been taken into account, or that the certificate was not received or accepted by the parties you mention. Even more likely is that an intermediate certificate is missing so that the chain to a trusted certificate cannot be made.

To look up the certificates above it the certificates look up the issuer certificate which is referenced by the certificate you send them. Then using that certificate the next certificate is looked up. Finally the signatures within the certificates are verified and the other information (validity period etc.) are validated. This is called chain validation. This ends with a trusted certificate, often the self signed root certificate of the CA.

Obviously to even try to look up the "parent" certificate the certificate must first be parsed. You'd expect another error if the certificate could not be parsed at all.



As for the carriage return: openssl returns only a line-feed character - as most unix utilities probably will. But any implementation that doesn't accept CRLF or even just CR (for Apple) will be in serious trouble, so I don't think you'll find many libraries / applications that won't accept any kind of line ending (and certainly not Amazon etc.).