Differences

This shows you the differences between two versions of the page.

--- openssl_command_line_troubleshooting [2025/10/09 16:02] – created sgriggs
+++ openssl_command_line_troubleshooting [2025/10/09 16:06] (current) – sgriggs
@@ Line 1: / Line 1: @@
-= OpenSSL Command-Line Cheat Sheet
+====== OpenSSL Command-Line Cheat Sheet ======
-:author: Swift Griggs
-:date: October 9, 2025
-:icons: font
-:toc: left
-:toclevels: 3
-:sectnums:
-:sectnumlevels: 3
-This cheat sheet provides OpenSSL commands for inspecting, verifying, and managing SSL/TLS certificates and CA stores, with a focus on troubleshooting certificate verification issues (e.g., `unable to get local issuer certificate`) and configuring custom CA certificates on Oracle Linux  systems.
+**Author**: Swift Griggs
+**Date**: October 9, 2025
-== 1. Inspecting Certificates
+This cheat sheet provides OpenSSL commands for inspecting, verifying, and managing SSL/TLS certificates and CA stores, with a focus on troubleshooting certificate verification issues (e.g., `unable to get local issuer certificate`) and configuring custom CA certificates on Oracle Linux (OEL) systems.
+===== 1. Inspecting Certificates =====
 Commands to view certificate details, useful for checking subjects, issuers, validity, and extensions.
-=== 1.1 View Subject and Issuer
+==== 1.1 View Subject and Issuer ====
 Display the subject and issuer of a certificate file.
-[source,bash]
+<code bash>
-----
 openssl x509 -in cert.pem -noout -subject -issuer
-----
+</code>
-* Example output: `subject=C=US, O=TestCo, OU=PKI, CN=TestCo Issuing CA`
+  * **Example output**: `subject=C=US, O=TestCo, OU=PKI, CN=TestCo Issuing CA`
+==== 1.2 View Full Certificate Details ====
-=== 1.2 View Full Certificate Details
 Show all certificate details, including extensions (e.g., Basic Constraints, Key Usage).
-[source,bash]
+<code bash>
-----
 openssl x509 -in cert.pem -noout -text
-----
+</code>
-* Use to check if a certificate is a CA (`CA:TRUE`) or self-signed (`subject = issuer`).
+  * Use to check if a certificate is a CA (`CA:TRUE`) or self-signed (`subject = issuer`).
+==== 1.3 Check Certificate Validity Dates ====
-=== 1.3 Check Certificate Validity Dates
 Display the certificate's validity period.
-[source,bash]
+<code bash>
-----
 openssl x509 -in cert.pem -noout -dates
-----
+</code>
-* Example output: `notBefore=Jun 5 19:02:35 2018 GMT`
+  * **Example output**: `notBefore=Jun 5 19:02:35 2018 GMT`
+==== 1.4 Get Certificate Fingerprint ====
-=== 1.4 Get Certificate Fingerprint
 Show the certificate's fingerprint for comparison.
-[source,bash]
+<code bash>
-----
 openssl x509 -in cert.pem -noout -fingerprint
-----
+</code>
-* Useful for verifying if two certificates are identical.
+  * Useful for verifying if two certificates are identical.
+==== 1.5 Convert Certificate Format (DER to PEM) ====
-=== 1.5 Convert Certificate Format (DER to PEM)
 Convert a DER certificate to PEM format.
-[source,bash]
+<code bash>
-----
 openssl x509 -inform der -in cert.der -out cert.pem
-----
+</code>
-== 2. Verifying Certificates
+===== 2. Verifying Certificates =====
 Commands to verify certificates against a CA store or specific CA file, including chain validation.
-=== 2.1 Verify Certificate Against System CA Store
+==== 2.1 Verify Certificate Against System CA Store ====
-Verify a certificate using the system\u2019s CA store directory.
-[source,bash]
+Verify a certificate using the system’s CA store directory.
-----
+<code bash>
 openssl verify -CApath /etc/pki/tls/certs/ -verbose -show_chain cert.pem
-----
+</code>
-* `-CApath`: Directory with hashed CA certificates.
-* `-show_chain`: Displays the certificate chain.
+  * `-CApath`: Directory with hashed CA certificates.
-* Success: `cert.pem: OK`
+  * `-show_chain`: Displays the certificate chain.
-* Failure: `error 20 at 0 depth lookup: unable to get local issuer certificate`
+  * **Success**: `cert.pem: OK`
+  * **Failure**: `error 20 at 0 depth lookup: unable to get local issuer certificate`
+==== 2.2 Verify Certificate with Specific CA File ====
-=== 2.2 Verify Certificate with Specific CA File
 Verify a certificate using a specific CA bundle file.
-[source,bash]
+<code bash>
-----
 openssl verify -CAfile /etc/pki/tls/certs/ca-bundle.crt -verbose -show_chain cert.pem
-----
+</code>
-* Use when the CA store is a single file.
+  * Use when the CA store is a single file.
+==== 2.3 Verify with Intermediate CA ====
-=== 2.3 Verify with Intermediate CA
 Verify a certificate with an untrusted intermediate CA.
-[source,bash]
+<code bash>
-----
 openssl verify -CApath /etc/pki/tls/certs/ -untrusted intermediate.pem -verbose -show_chain cert.pem
-----
+</code>
-* `-untrusted`: Specifies intermediate CA(s) not in the trusted store.
+  * `-untrusted`: Specifies intermediate CA(s) not in the trusted store.
+==== 2.4 Verify with CRL Checking ====
-=== 2.4 Verify with CRL Checking
 Verify a certificate with Certificate Revocation List (CRL) checking.
-[source,bash]
+<code bash>
-----
 openssl verify -CApath /etc/pki/tls/certs/ -crl_check -CRLfile crl.pem cert.pem
-----
+</code>
-* Download CRL: `curl -o crl.pem <CRL_URL>`
-== 3. Managing CA Stores
+  * Download CRL: `curl -o crl.pem <CRL_URL>`
-Commands to locate and manage the system\u2019s CA trust store, especially for adding custom CAs.
+===== 3. Managing CA Stores =====
-=== 3.1 Find OpenSSL Configuration and CA Store
+Commands to locate and manage the system’s CA trust store, especially for adding custom CAs.
-Show OpenSSL\u2019s configuration directory and CA store location.
-[source,bash]
+==== 3.1 Find OpenSSL Configuration and CA Store ====
-----
+Show OpenSSL’s configuration directory and CA store location.
+<code bash>
 openssl version -a
-----
+</code>
-* Look for `OPENSSLDIR` (e.g., `/etc/pki/tls`) and `SYSTEM_CIPHERS_FILE`.
+  * Look for `OPENSSLDIR` (e.g., `/etc/pki/tls`) and `SYSTEM_CIPHERS_FILE`.
+==== 3.2 List CA Store Contents ====
-=== 3.2 List CA Store Contents
 List certificates in the CA store directory.
-[source,bash]
+<code bash>
-----
+ls -l /etc/pki/tls/certs/ | grep -i testco
-ls -l /etc/pki/tls/certs/ | grep -i <name>
+ls -l /etc/ssl/certs/ | grep -i testco
-ls -l /etc/ssl/certs/ | grep -i <name>
+</code>
-----
-* Example: `ls -l /etc/pki/tls/certs/ | grep -i testguys`
-=== 3.3 Search for CA Certificate Files
+  * **Example**: `ls -l /etc/pki/tls/certs/ | grep -i testco`
-Find certificate files containing a specific string (e.g., \u201cTestCo\u201d).
-[source,bash]
+==== 3.3 Search for CA Certificate Files ====
-----
+Find certificate files containing a specific string (e.g., “TestCo”).
+<code bash>
 sudo find /etc -type f -name "*.crt" -exec grep -l "TestCo" {} \;
 sudo find /etc -type f -name "*.pem" -exec grep -l "TestCo" {} \;
-----
+</code>
+==== 3.4 Check CA Bundle Contents ====
-=== 3.4 Check CA Bundle Contents
 Inspect a CA bundle file for a specific CA.
-[source,bash]
+<code bash>
-----
+openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/ca-bundle.crt | openssl pkcs7 -print_certs | grep -i testco
-openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/ca-bundle.crt | openssl pkcs7 -print_certs | grep -i <name>
+</code>
-----
-* Example: `grep -i testco`
+  * **Example**: `grep -i testco`
+==== 3.5 Add Custom CA to Trust Store ====
-=== 3.5 Add Custom CA to Trust Store
+Add a custom CA certificate to the system’s trust store (OEL10).
-Add a custom CA certificate to the system\u2019s trust store (OEL10/RHEL10).
-[source,bash]
+<code bash>
-----
 sudo cp custom_ca.crt /etc/pki/ca-trust/source/anchors/
 sudo update-ca-trust
-----
+</code>
-* Ensure `ca-certificates` package is installed: `sudo dnf install ca-certificates`
+  * Ensure `ca-certificates` package is installed: `sudo dnf install ca-certificates`
+==== 3.6 Manually Hash CA Store ====
-=== 3.6 Manually Hash CA Store
 Hash certificates in the CA store directory for OpenSSL.
-[source,bash]
+<code bash>
-----
 sudo cp custom_ca.crt /etc/pki/tls/certs/
 sudo c_rehash /etc/pki/tls/certs/
-----
+</code>
-* Creates hashed symlinks (e.g., `6ed01128.0`).
-== 4. Troubleshooting Verification Issues
+  * Creates hashed symlinks (e.g., `6ed01128.0`).
+===== 4. Troubleshooting Verification Issues =====
 Commands to diagnose why certificate verification fails (e.g., `SSLCertVerificationError`).
-=== 4.1 Trace OpenSSL File Access
+==== 4.1 Trace OpenSSL File Access ====
 Identify which CA files OpenSSL reads during verification.
-[source,bash]
+<code bash>
-----
 strace -e open,openat openssl verify -CApath /etc/pki/tls/certs/ -verbose cert.pem 2>&1 | grep -i cert
-----
+</code>
-* Look for `openat` calls to files like `/etc/pki/tls/certs/ca-bundle.crt`.
+  * Look for `openat` calls to files like `/etc/pki/tls/certs/ca-bundle.crt`.
+==== 4.2 Check Environment Variables ====
-=== 4.2 Check Environment Variables
 Verify if custom CA paths are set.
-[source,bash]
+<code bash>
-----
 echo $SSL_CERT_FILE
 echo $SSL_CERT_DIR
-----
+</code>
-* If set, these override the default CA store.
-=== 4.3 Test Server Certificate Chain
+  * If set, these override the default CA store.
-Extract and inspect a server\u2019s certificate chain (e.g., for proxy issues).
-[source,bash]
+==== 4.3 Test Server Certificate Chain ====
-----
+Extract and inspect a server’s certificate chain (e.g., for proxy issues).
+<code bash>
 openssl s_client -connect <server>:443 -showcerts </dev/null > server_certs.pem
-openssl x509 -in server_certs.pem -noout -text | grep -i <name>
+openssl x509 -in server_certs.pem -noout -text | grep -i testco
-----
+</code>
-* Example: `openssl s_client -connect pki.testco.com:443 -showcerts`
+  * **Example**: `openssl s_client -connect pki.testco.com:443 -showcerts`
+==== 4.4 Check OpenSSL Configuration ====
-=== 4.4 Check OpenSSL Configuration
 View the OpenSSL configuration file.
-[source,bash]
+<code bash>
-----
 sudo cat /etc/pki/tls/openssl.cnf
-----
+</code>
-* Check for CA paths (e.g., `dir = /etc/pki/CA`).
-=== 4.5 Check Crypto Policies
+  * Check for CA paths (e.g., `dir = /etc/pki/CA`).
-Verify FIPS or crypto policy settings (OEL10/RHEL10).
-[source,bash]
+==== 4.5 Check Crypto Policies ====
-----
+Verify FIPS or crypto policy settings (OEL10).
+<code bash>
 cat /etc/crypto-policies/back-ends/opensslcnf.config
-----
+</code>
-* Adjust policy if needed: `sudo update-crypto-policies --set DEFAULT`
-== 5. Application-Specific Fixes
+  * Adjust policy if needed: `sudo update-crypto-policies --set DEFAULT`
+===== 5. Application-Specific Fixes =====
 Commands to address application issues (e.g., `pip` SSL errors).
-=== 5.1 Fix `pip` SSL Verification
+==== 5.1 Fix `pip` SSL Verification ====
 Use a custom CA file or proxy for `pip`.
-[source,bash]
+<code bash>
-----
 pip install --cert /etc/pki/tls/certs/ca-bundle.crt some_package
 export HTTPS_PROXY="http://proxy.example.com:port"
 pip install --proxy http://proxy.example.com:port some_package
-----
+</code>
+==== 5.2 Temporary Trust for Testing ====
-=== 5.2 Temporary Trust for Testing
 Temporarily trust a CA file without modifying the system.
-[source,bash]
+<code bash>
-----
 export SSL_CERT_FILE=custom_ca.crt
 openssl verify -CAfile custom_ca.crt cert.pem
-----
+</code>
-== Notes
+===== Notes =====
-* **10 Specifics**: Uses `p11-kit` and `ca-certificates` for CA trust management. Always use `sudo update-ca-trust` to update the trust store.
-* **FIPS Mode**: Ensure certificates use FIPS-compliant algorithms (e.g., SHA-256, RSA \u2265 2048 bits).
-* **CRL Checking**: If CRLs are required, download from URLs in certificate extensions (e.g., `http://pki.testco.com/cdp/TestCo%20Root%20CA.crl`).
-* **Permissions**: Run CA store updates as root (`sudo`) to avoid permission errors.
+  * **OEL10 Specifics**: Uses `p11-kit` and `ca-certificates` for CA trust management. Always use `sudo update-ca-trust` to update the trust store.
+  * **FIPS Mode**: Ensure certificates use FIPS-compliant algorithms (e.g., SHA-256, RSA ≥ 2048 bits).
+  * **CRL Checking**: If CRLs are required, download from URLs in certificate extensions (e.g., `http://pki.testco.com/cdp/TestCo%20Root%20CA.crl`).
+  * **Permissions**: Run CA store updates as root (`sudo`) to avoid permission errors.