topic SSL error: self signed certificate in certificate chain in Operating System - HP-UX

SSL error: self signed certificate in certificate chain

dictum9 — Thu, 13 Nov 2014 18:14:06 GMT

hp-ux v11.31

Getting the following failure. Looks like the certificate expired? How do I regenerate it and re-install it?

ssl version: 0.9.8

OpenSSL> s_client -showcerts -connect xxx.xxx.xxx.xxx:yyyy
CONNECTED(00000003)
depth=2 /xxxxxxxxxxxxxxxxxxxxxxxx/OU=PKI/CN=DoD Root CA 2
verify error:num=19:self signed certificate in certificate chain
verify return:0
SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate:s3_pkt.c:102:SSL alert number 42
xxxx:error:xxxxxx:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:
OpenSSL> quit

Re: SSL error: self signed certificate in certificate chain

Dennis Handly — Thu, 13 Nov 2014 18:51:03 GMT

>Looks like the certificate expired?

I would think it would say that in the error message. It may be complaining about the self signed certificate, which needs that certificate in the trusted certificate directory.

Re: SSL error: self signed certificate in certificate chain

dictum9 — Fri, 14 Nov 2014 12:59:13 GMT

Why would it stop working all of a sudden?

No changes were made.

How do I fix it?

Re: SSL error: self signed certificate in certificate chain

Dennis Handly — Sat, 15 Nov 2014 01:12:04 GMT

>Why would it stop working all of a sudden?

Do you have a copy of that -showcerts when it last worked? That would tell you when it expired.
Can you get to xxx.xxx.xxx.xxx:yyyy and look at the certificates? Is openssl installed there too?

Has anything changed on that machine?

The s3_pkt.c source is here:

http://git.openssl.org/gitweb/?p=openssl.git;a=blob;f=ssl/s3_pkt.c;hb=701134320a94908d8c0ac513741cab41e215a7b5

It could be that the "self signed certificate in certificate chain" is being promoted that that final error.