title: openSSL verify RFC 3161 TimeStampResp signed with self-signed certificate
body: <p>I generated a RFC 3161 TimeStampResp out of a RFC 3161 TimeStampReq using openSSL.
  Therefore I used a self signed CA cert and a TSA cert issued by the self-signed CA using this command:</p>
  
  <pre><code>openssl ts -reply -queryfile request.tsq -signer TSAcert.pem -out response.tsr
  </code></pre>
  
  <p>The response was created.</p>
  
  <pre><code>openssl ts -reply -text -in response.tsr
  </code></pre>
  
  <p>genereated the following output:</p>
  
  <blockquote>
    <p>Status info:<br>
    Status: Granted.<br>
    Status description: unspecified<br>
    Failure info: unspecified<br>
    TST info:<br>
    Version: 1<br>
    Policy OID: tsa_policy1<br>
    Hash Algorithm: sha256<br>
    Message data:<br>
        0000 - 43 2c bb 03 28 48 42 06-c0 c8 95 ee d8 32 9d 29   C,..(HB......2.)<br>
        0010 - 09 7c 10 be 68 2a 77 f6-6e 96 61 7c bf 8f e2 cd   .|..h*w.n.a|....<br>
    Serial number: 0x01<br>
    Time stamp: Aug  1 13:40:03 2018 GMT<br>
    Accuracy: 0x01 seconds, 0x01F4 millis, 0x64 micros<br>
    Ordering: yes<br>
    Nonce: unspecified<br>
    TSA: DirName:/C=stuff/ST=Some-State/L=stuff/O=stuff/CN=stuff<br>
    Extensions:</p>
  </blockquote>
  
  <p>As I try to verify the TimeStampResp against the TimeStampReq using this command:</p>
  
  <pre><code>openssl ts -verify -queryfile request.tsq -in response.tsr -CAfile CAcert.pem -untrusted TSAcert.pem
  </code></pre>
  
  <p>I get a error message stating, that my CAcert is self signed (which is actually true)</p>
  
  <blockquote>
    <p>Verification: FAILED<br>
    139727615005120:error:2F06D064:time stamp routines:ts_verify_cert:certificate verify error:../crypto/ts/ts_rsp_verify.c:182:Verify error:self signed certificate</p>
  </blockquote>
  
  <p>Is there any way to skip the certificate validation or to tell openSSL that this CA can be trusted?</p>