最近服务器上配置了HTTPS之后，发现证书无法通过验证，客户端报告异常
|
1 |
java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. |
证书里面内容是正常的，并且通过浏览器是可以正常访问的，但是Android APP使用okhttp访问的时候就不能正常访问了。同样IOS应用访问也是异常的。
一脸懵逼，不清楚哪一步出现了问题。
于是想追踪一下正常的证书验证流程，搜索了一下发现如下命令：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
# on a successful verification # 注意需要指定端口，如果是https协议，默认端口也需要指定端口443 $ openssl s_client -quiet -connect jvt.me:443 depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify return:1 depth=0 CN = jamietanna.co.uk verify return:1 # on an unsuccessful verification $ openssl s_client -quiet -connect keystore.openbanking.org.uk:443 depth=2 C = GB, O = OpenBanking, CN = OpenBanking Root CA verify error:num=19:self signed certificate in certificate chain verify return:1 depth=2 C = GB, O = OpenBanking, CN = OpenBanking Root CA verify return:1 depth=1 C = GB, O = OpenBanking, CN = OpenBanking Issuing CA verify return:1 depth=0 C = GB, O = OpenBanking, OU = Open Banking Directory, CN = keystore verify return:1 read:errno=104 # for an expired cert $ openssl s_client -quiet -connect expired.badssl.com:443 depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority verify error:num=20:unable to get local issuer certificate verify return:1 depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA verify return:1 depth=0 OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.badssl.com verify error:num=10:certificate has expired notAfter=Apr 12 23:59:59 2015 GMT verify return:1 depth=0 OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.badssl.com notAfter=Apr 12 23:59:59 2015 GMT verify return:1 |
目前校验过程中发现错误信息如下：
|
1 2 3 4 5 6 7 8 |
# 注意需要指定端口，如果是https协议，默认端口也需要指定端口443 $ openssl s_client -quiet -connect xxx.xxxxxx.com.cn:38080 depth=0 C = CN, ST = xxx, L = xxx, O = xxxx, OU = IT, CN = *.xxxxxx.com.cn verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 C = CN, ST = xxx, L = xxx, O = xxxx, OU = IT, CN = *.xxxxxx.com.cn verify error:num=21:unable to verify the first certificate verify return:1 |
经过相关的分析，发现这个问题的原因在于证书签发机构在签发证书的时候，下发了两个证书，其中一个是根证书，一个是中级证书，但是在配置的时候，没有配置相关的中级证书。导致证书校验异常。
增加中级证书之后，校验恢复正常。