title: SSL handshake fails with - a verisign chain certificate - that contains two CA signed certificates and one self-signed certificate
body: <p>I am stuck with a issue and trying to debug it. We purchased a Verisign certificate. When we use:</p>
  
  <pre><code>openssl&gt; s_client -connect myweb.com:443 -showcerts
  </code></pre>
  
  <p>SSL Handshake never completes and at the end we see error:</p>
  
  <pre><code>Verify return code: 19 (self signed certificate in certificate chain)
  </code></pre>
  
  <p>It shows 3 <code>---BEGIN/END CERTIFICATE---</code> tags. Two certificates in chain are Verisign signed but one is self signed.</p>
  
  <ol>
  <li><p>If someone can please explain how this self-signed certificate shows up in a CA signed certificate?</p></li>
  <li><p>Is this error <code>19 (self signed certificate in certificate chain)</code> benign? If not, what could be causing it? </p></li>
  <li><p>Client has the CA certificate in trusted store but there is nothing for the self-signed certificate. Do you think that could be causing problem? If yes, how do I:</p>
  
  <ol>
  <li>How can I get rid of the self-signed certificate from the chain certificate leaving behind only 2 CA signed certificates in chain?</li>
  <li>Add this self signed certificate on client trusted store?</li>
  </ol></li>
  </ol>