A certificate is valid and will be added to the certificate database if it is formatted correctly, and in the case of a CA certificate chain, if the certificates are installed in the required order. A certificate is verified using OpenSSL if it is signed and trusted by the system.
The following certificates are part of the certificate verification path:
A root certificate is self-signed, and is used to sign intermediate certificates and endpoint certificates. A root certificate is optional in a CA certificate chain.
An intermediate certificate is signed by its parent (issuer) certificate, which is signed by its issuer certificate, and so on, until the certification path ends at the root certificate (if any).
An endpoint (server) certificate is signed by its issuer certificate. An endpoint certificate does not sign other certificates.
A certificate is automatically verified when the following are true:
Root certificate: The certificate is self-signed and the
Subject type=CAfield is in itsBasic Constraintssection.Intermediate and endpoint certificate: Its issuer certificate is verified as described below.
Issuer (root and intermediate) certificate: Each issuer certificate is in the public CA bundle or the supplemental CA list. Certificates in these lists are already trusted by the system.
Verification will fail if the certificate cannot find its issuer certificate or if the issuer certificate is not trusted by the system.
For example, each endpoint and intermediate CA in a Web server certificate chain obtains its authority from its issuer certificate, which is the next CA in the chain. The certificates are installed in a bundle, and must be ordered from the intermediate CA that issued the endpoint certificate, the other intermediate certificates, and finally through to the root CA (if any). However, because the issuer certificates are not yet in the supplemental CA list, each intermediate CA will fail the initial verification check as it is added to the certificate database. After you add the issuer certificates to the supplemental CA list, you can manually verify the certificate chain.
This topic describes how to manually verify a certificate chain, an individual certificate, or a certificate bundle after the issuer certificates are installed and added to the supplemental CA list.
Note
If the certificates in a CA certificate chain are installed in the required order, the chain of trust will be established, even if the certificates do not pass the OpenSSL verification described in this topic.
Operator or Admin access