title: How to verify certificate chain with openssl
body: <p>I am trying to verify a certificate file with OpenSSL. Can you explain me why <code>s_client</code> connection succeeds, but <code>verify</code> file with the same certificate chain fails? How can I verify the file?</p>
  
  <p>Note I compiled OpenSSL 1.0.1k myself, it shouldn't be using any distro-specific config. And I provided the same <code>CAfile</code> to both commands.</p>
  
  <pre><code>$ openssl s_client -CAfile /etc/pki/tls/certs/ca-bundle.crt -connect www.google.com:443
  WARNING: can't open config file: /usr/local/ssl/openssl.cnf
  CONNECTED(00000003)
  depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
  verify return:1
  depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
  verify return:1
  depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
  verify return:1
  depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.google.com
  verify return:1
  ---
  Certificate chain
   0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
     i:/C=US/O=Google Inc/CN=Google Internet Authority G2
   1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
     i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
     i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
  ---
      ...
      Verify return code: 0 (ok)
  ---
  </code></pre>
  
  <p>If I run it with <code>-showcerts</code> argument, it outputs all three certificates sent from server. I concatenated them into file <code>google.pem</code>. But the chain can't be verified. See:</p>
  
  <pre><code>$ openssl verify -CAfile /etc/pki/tls/certs/ca-bundle.crt google.pem
  WARNING: can't open config file: /usr/local/ssl/openssl.cnf
  google.pem: C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.google.com
  error 20 at 0 depth lookup:unable to get local issuer certificate
  </code></pre>
  
  <p>Applying a patch suggested on <a href="https://stackoverflow.com/a/27606964/1823988">https://stackoverflow.com/a/27606964/1823988</a> doesn't help.</p>