With OpenSSL 1.0.2g (MacPorts on OS X) I can check Google's certificate (I have to specify the certificate bundle as OS X usually stores it in the KeyChain)$ echo Q |  /opt/local/bin/openssl s_client   -connect www.google.com:443 -servername www.google.com -verify 6 -CAfile test/cabundle.crt > /dev/null verify depth is 6depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CAverify return:1depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2verify return:1depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.google.comverify return:1DONEEverything OK. Now if I use the system's version (0.9.8zg) with the very same CA bundle I get an error:$ echo Q |  /usr/bin/openssl s_client   -connect www.google.com:443 -servername www.google.com -verify 6 -CAfile test/cabundle.crt > /dev/null verify depth is 6depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CAverify error:num=20:unable to get local issuer certificateverify return:1depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CAverify error:num=27:certificate not trustedverify return:1depth=1 /C=US/O=Google Inc/CN=Google Internet Authority G2verify return:1depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.comverify return:1DONEI don't get where the problem could be since I am specifying the CA bundle manually.
openssl: unable to get local issuer certificate with some versions
openssl