| 基本 | openssl verify -CAfile root.pem -untrusted intermediate.pem leaf.pem |
|---|---|
| 展示链 | -show_chain 打印验证路径与层级 |
| 用途检查 | -purpose sslserver / sslclient 校验证书用途 |
| 常见错误 | unable to get local issuer certificate、certificate has expired |
完整校验流程
完整校验流程
openssl verify -show_chain -CAfile root.pem -untrusted intermediate.pem leaf.pem
openssl verify -purpose sslserver -CAfile root.pem -untrusted intermediate.pem leaf.pem错误信息会指出失败层级：链缺失、过期、用途不符或名称约束，先读错误再查字段。