Build a two-tier certificate chain and break it on purpose

short · 40 min · Objective 1.4

Task

Build a root CA, an intermediate, and a server certificate on your own lab VM, verify the chain, then break it in two different ways and observe how the failures differ. Chain problems are the commonest certificate incident there is, and they are much clearer once you have caused them.

Steps

  1. Make a working directory and a root: generate a key and a self-signed root certificate with openssl req -x509 -newkey rsa:2048 -nodes -keyout root.key -out root.crt -subj '/CN=Lab Root CA' -days 365.
  2. Generate an intermediate key and CSR, then sign the CSR with the root, setting basicConstraints=CA:TRUE,pathlen:0 via an extension file so it is genuinely a CA certificate.
  3. Generate a server key and CSR for lab.internal, and sign it with the INTERMEDIATE, not the root.
  4. Verify the full chain: openssl verify -CAfile root.crt -untrusted intermediate.crt server.crt.
  5. Break it the first way: verify server.crt against the root alone, without supplying the intermediate. Note the error text.
  6. Break it the second way: reissue the server certificate with -days -1 so it is already expired, and verify again. Note that the error is different, and write both messages into /tmp/chain.md.

Verify

openssl verify -CAfile root.crt -untrusted intermediate.crt server.crt
openssl x509 -in server.crt -noout -issuer -subject -dates
openssl verify -CAfile root.crt server.crt 2>&1 | grep -ci "unable to get local issuer"
grep -ciE "expired|issuer" /tmp/chain.md

The first must print server.crt: OK for the good certificate. The second must show the issuer is the intermediate and the subject is your invented name. The third must be non-zero — that specific message is what a missing intermediate looks like, and recognising it saves an afternoon. The fourth confirms you recorded both failure modes, because they are different findings with different fixes.

Notes

The missing-intermediate failure is the one that reaches production, because it works in the browser of whoever tested it — their browser had already cached the intermediate from another site. The server must send the chain; relying on the client to have it is how a certificate works for you and fails for your customers.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.