I'm attempting to faithfully follow the chained certificates example on the wiki [1] but I'm unsuccessful.
This is Arch, x86_64, on both sides, and it's working just fine with a single CA that issues both client and server certs.
When I use an intermediate CA ("working-ca") for the client, and stick with the "root-ca" for the server:
* the client is happy
* the server reports "VERIFY ERROR: depth=1, error=invalid CA certificate: CN=working-ca"
Here's the basic algorithm I'm using:
* generate root-ca key, self-sign
* generate working-ca key, issue csr, have root-ca sign
* generate server key, issue csr, have root-ca sign
* generate client key, issue csr, have working-ca sign
* use server key, crt and root-ca on the server
* use client key, concatenation of client crt and working-ca crt as crt, and root-ca on the client
(Here's a Makefile that implements the algorithm [2] and a description which files goes where at the bottom of [3])
What am I doing wrong?
[1]
https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains
[2]
https://github.com/jernst/make-openvpn-keys/blob/master/root-ca-and-ca/Makefile
[3]
https://github.com/jernst/make-openvpn-keys/tree/master/root-ca-and-ca
