title: How does an SSL certificate chain bundle work?
body: <p>I've created a chain hierarchy like this.</p>
  
  <pre><code>root-ca ==&gt; signing-ca ==&gt; subordinate-ca ==&gt; server
  </code></pre>
  
  <p>It is mentioned to create chain bundle, the lowest should go first.</p>
  
  <pre><code>$ cat server.crt subordinate-ca.crt signing-ca.crt &gt; server.pem
  </code></pre>
  
  <p>But verification fails.</p>
  
  <pre><code>$ openssl verify -CAfile root-ca.crt server.pem
  error 20 at 0 depth lookup:unable to get local issuer certificate
  </code></pre>
  
  <p>However, if I change the order it seems to work.</p>
  
  <pre><code>$ cat signing-ca.crt subordinate-ca.crt server.crt &gt; server.pem
  $ openssl verify -CAfile root-ca.crt server.pem
  server.pem: OK
  </code></pre>
  
  <p>So what would be the error here? </p>
  
  <p>The chain after "cat" looks like below.</p>
  
  <pre><code>-----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----
  </code></pre>
  
  <p>More info: According to "<a href="http://www.herongyang.com/crypto/openssl_verify_2.html">http://www.herongyang.com/crypto/openssl_verify_2.html</a>", I perform the following test which works.</p>
  
  <pre><code>$ cat signing-ca.crt subordinate-ca.crt &gt; inter.crt
  $ openssl verify -CAfile root-ca.crt -untrusted inter.crt server.crt
  server.crt: OK
  </code></pre>
  
  <p>Does that mean all the links are good?</p>
  
  <p>OK, I finally discover that this cannot be done through OpenSSL command line (or at least easily). <a href="http://openssl.6102.n7.nabble.com/check-certificate-chain-in-a-pem-file-td43871.html">http://openssl.6102.n7.nabble.com/check-certificate-chain-in-a-pem-file-td43871.html</a></p>