title: C: client program reports SSL Certificate verify failed error with localCA
body: <p>I am writing a simple TLS client/server program to securely communicate over the network. Initially I am building and running both the client and server on the same machine running RHEL 8.2.</p>
  <p>First, I am using custom self signned ssl certificate and key for my programs. I have placed the rootCA.crt (my custom CA certificate in /root/CA/rootCA.crt). Also copied the rootCA.pem to /etc/pki/ca-trust/source/anchors/ and executed <code>update-ca-trust enable</code> then <code>update-ca-trust extract</code> to install the certificate to the system. (Not sure if I need to reboot the system for it to take effect.)</p>
  <p>Initially, the client and server were able to communicate usint TLS untill I added the certificate validation part of the code on the client side.</p>
  <p>Certificate Verification snippet:</p>
  <pre><code>ctx = SSL_CTX_new(method);   /* Create new context */
      if ( ctx == NULL )
      {
          ERR_print_errors_fp(stderr);
          abort();
      }
  
      SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
  
      SSL_CTX_set_verify_depth(ctx, 4);
  
      const long flags = SSL_OP_NO_SSLv2 |
                          SSL_OP_NO_SSLv3 |
                          SSL_OP_NO_TLSv1 |
                          SSL_OP_NO_TLSv1_1 |
                          SSL_OP_NO_COMPRESSION;
      SSL_CTX_set_options(ctx, flags);
  
      if(SSL_CTX_load_verify_locations(ctx, NULL, 
                  &quot;/root/CA/&quot;) == 0){
          ERR_print_errors_fp(stderr);
          abort();
      }
  
  ssl = SSL_new(ctx);      /* create new SSL connection state */
      SSL_set_fd(ssl, server);    /* attach the socket descriptor */
      if ( SSL_connect(ssl) == FAIL )   /* perform the connection */
          ERR_print_errors_fp(stderr);
      else
      {
  
          sprintf(acClientRequest, &quot;%s&quot;, cpRequestMessage);   /* construct reply */
          printf(&quot;\n\nConnected with %s encryption\n&quot;, SSL_get_ciphe
  
  }
  </code></pre>
  <p>when I run the server and client programs I see the following error messafe =&gt;</p>
  <p>Onclient:
  140736372886336:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1915:</p>
  <p>On Server:
  140736022137664:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:ssl/record/rec_layer_s3.c:1543:SSL alert number 48</p>
  <p>Not sure, what is going wrong with the certificate validation process. Can anyone suggest me how to fix this error?</p>