| 9 / 10 | certificate is not yet valid / certificate has expired |
|---|---|
| 18 / 19 | self-signed certificate / self-signed certificate in certificate chain |
| 20 / 21 | unable to get local issuer certificate / unable to verify the first certificate |
| 23 | certificate revoked（配合 -crl_check） |
| 24 / 26 | invalid CA certificate / unsupported certificate purpose |
| 62 | hostname mismatch |
输出解读
输出解读
openssl verify -CAfile ca.pem -untrusted chain.pem leaf.pem
# 典型输出：
# leaf.pem: CN = example.com
# error 20 at 0 depth lookup: unable to get local issuer certificate配合 -show_chain 可打印各层证书，快速看出链在哪一级断开。