title: Is it possible to use self-signed server certificates alongside a valid trust chain?
body: <p>I'm working on a project and I've hit a bit of a snag getting access to just a simple Flask page over HTTPS.</p>
  <p>I have the following certificates/keys that must be used:</p>
  <ol>
  <li>A PKI certificate (with non-exportable key) on a smart card</li>
  <li>An intermediate certificate (without key) that signed the PKI above</li>
  <li>A root certificate (without key) that signed the intermediate certificate above</li>
  </ol>
  <p>I'm dabbling with using these concepts for the first time, but as I understand it, this is the trust chain:</p>
  <blockquote>
  <p>User PKI &gt; Intermediate &gt; Root CA</p>
  </blockquote>
  <p>At this point, I have a very small Flask application:</p>
  <pre><code>import ssl
  from flask import Flask
  
  app = Flask(__name__)
  
  @app.route(&quot;/&quot;)
  def main():
      return &quot;Hello World&quot;
  
  if __name__ == '__main__':
      ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
      ctx.verify_mode = ssl.CERT_REQUIRED
      ctx.load_verify_locations('intermediate.pem')
      ctx.load_cert_chain('localhost.crt', 'localhost.key')
      app.run(ssl_context=ctx)
  </code></pre>
  <p>Both intermediate and the Root CA that signed it are installed on the machine; further, inspecting certificates in the browser shows the user certificates available from the smart card as well. The problem, I believe, occurs with the <code>localhost.crt/.key</code>. No browser will allow me to reach the page, but they do allow me to select a certificate to compare to the intermediate certificate. For example, Firefox presents me with:</p>
  <blockquote>
  <p>An error occurred during a connection to 127.0.0.1:5000. Peer does not recognize and trust the CA that issued your certificate. Error code: SSL_ERROR_UNKNOWN_CA_ALERT</p>
  </blockquote>
  <p>When inspecting, the certificate that is of issue is the <code>intermediate.pem</code>. From what I can gather in the error message, it sounds like this chain does not agree:</p>
  <blockquote>
  <p>User PKI &gt; Self-Signed Server &gt; Self-Signed Root</p>
  </blockquote>
  <p>I could be wrong, but I am not sure unfortunately. Which chain is failing? Why? And how do I overcome it? I cannot get a server certificate signed by the Root CA either, so ideally for testing I would need to use self-signed server certificates.</p>