Given
- Final X.509 certificate A in PEM format.
- Access to the certificate store of the server, which encloses all certificates, including singing chain for the certificate A.
OpenSSL shows following attributes of the certificate:
openssl x509 -in second.der -inform DER -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
xx:xx:xx:xx:xx
Signature Algorithm: sha256WithRSAEncryption
Issuer: aaa
Validity
Not Before: May 14 08:33:31 2019 GMT
Not After : May 14 04:33:51 2024 GMT
Subject: bbb
How can I recover the singing chain, thus all certificates which were used to sign the A until the root certificate?
Naive approach to look for the certificates having Subjet: bbb fails, because it also fetches from the store old certificates, which were used to sign previous versions of the current certificate.