I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. First, I run openssl (OpenSSL 3.0.1 14 Dec 2021)
openssl s_client -showcerts -connect letsencrypt.org:443 -servername letsencrypt.org
and I get
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = lencr.org
verify return:1
along with the certs.
For Internet Security Research Group, CN = ISRG Root X1
I see this
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
i:O = Digital Signature Trust Co., CN = DST Root CA X3
a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
v:NotBefore: Jan 20 19:14:03 2021 GMT; NotAfter: Sep 30 18:14:03 2024 GMT
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
...
This is Let's Encrypt's Cross-signed by DST Root CA X3
cert rather than the Self-Signed ISRG Root
cert.
I have some old java code running on 1.8.0_131-b11 that makes API calls. The calls stopped working and I attempted to use openssl to retrieve the root cert so I could add that to my java keystore. The cert returned from openssl didn't fix the issue and I eventually added the Self-Signed ISRG Root
and everything started working.
I also tried adding the -trusted_first
option to my openssl command but that displays the same certs.
Why is openssl showing Let's Encrypt's Cross-Signed cert instead of their Self-Signed cert? How do I get the correct cert chain using openssl?