title: Unable to openssl verify SSL certificate
body: <p>What I want to do:
  Get a clean connection with <code>openssl -connect</code> to a remote site.</p>
  
  <p>Site seems self signed.</p>
  
  <pre><code>What I'm getting: CONNECTED(00000003)
  depth=0 CN = DC01.home.pri
  verify error:num=20:unable to get local issuer certificate
  verify return:1
  depth=0 CN = DC01.home.pri
  verify error:num=27:certificate not trusted
  verify return:1
  depth=0 CN = DC01.home.pri
  verify error:num=21:unable to verify the first certificate
  verify return:1
  ...
  ...
  Verify return code: 21 (unable to verify the first certificate)
  </code></pre>
  
  <p>What I have tried:</p>
  
  <pre><code>echo -n | openssl s_client -connect DC01.home.pri:636 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' &gt; ldapserver.pem
  echo -n | openssl s_client -connect DC01.home.pri:636 -CAfile ldapserver.pem
  
  sudo cp ldapserver.pem /etc/ssl/certs/ldapserver.pem
  sudo c_rehash /etc/ssl/certs/
  echo -n | openssl s_client -connect dc01.home.pri:636 -CApath /etc/ssl/certs/
  </code></pre>
  
  <p>I have also tried</p>
  
  <pre><code>openssl verify -CAfile /etc/ssl/certs/ldapserver.pem ldapserver.pem 
  openssl verify -CApath /etc/ssl/certs/ ldapserver.pem
  </code></pre>
  
  <p>with the results of</p>
  
  <pre><code>ldapserver.pem: CN = DC01.home.pri
  error 20 at 0 depth lookup:unable to get local issuer certificate
  </code></pre>
  
  <p>I have changed the CN/Hostname to guard myself. But the hostname is also added to my hosts file, in case it helps.</p>
  
  <p>Censored PEM file</p>
  
  <pre><code>Certificate:
      Data:
          Version: 3 (0x2)
          Serial Number:
              64:c7:48:64:00:00:00:00:00:d0
      Signature Algorithm: sha1WithRSAEncryption
          Issuer: DC=pri, DC=home, CN=home-HOMECA-CA
          Validity
              Not Before: Mar  7 22:41:45 2015 GMT
              Not After : Mar  6 22:41:45 2016 GMT
          Subject: CN=DC01.home.pri
          Subject Public Key Info:
              Public Key Algorithm: rsaEncryption
                  Public-Key: (1024 bit)
                  Modulus:
                      &lt;CENSORED&gt;
                  Exponent: 65537 (0x10001)
          X509v3 extensions:
              1.3.6.1.4.1.311.20.2: 
                  . .D.o.m.a.i.n.C.o.n.t.r.o.l.l.e.r
              X509v3 Extended Key Usage: 
                  TLS Web Client Authentication, TLS Web Server Authentication
              X509v3 Key Usage: 
                  Digital Signature, Key Encipherment
              S/MIME Capabilities: 
  ......0...`.H.e...*0...`.H.e...-0...`.H.e....0...`.H.e....0...+....0
  ..*.H..
              X509v3 Subject Alternative Name: 
                  othername:&lt;unsupported&gt;, DNS:DC01.home.pri
              X509v3 Subject Key Identifier: 
                  &lt;CENSORED&gt;
              X509v3 Authority Key Identifier: 
                  keyid:&lt;CENSORED&gt;
  
              X509v3 CRL Distribution Points: 
  
                  Full Name:
                    URI:ldap:///CN=home-HOMECA-CA,CN=HOMECA,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=home,DC=pri?certificateRevocationList?base?objectClass=cRLDistributionPoint
                    URI:http://homeca.home.pri/CertEnroll/home-HOMECA-CA.crl
  
              Authority Information Access: 
                  CA Issuers - URI:ldap:///CN=home-CA-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=home,DC=pri?cACertificate?base?objectClass=certificationAuthority
  
      Signature Algorithm: sha1WithRSAEncryption
           &lt;CENSORED&gt;
  </code></pre>