openssl：无法使用自签名证书验证链中的第 3 个

问：

我正在尝试使用OpenSSL实现证书链，但是我在进行验证时遇到了问题。一些参考资料：root -> intermediate -> user1,user2,...

• 使用 openssl verify 验证证书链验证不起作用，即使它踢出错误无效的 CA 证书-untrusted
• 验证工作正常，但不能。rootCAintermediateuser1intermediate

批处理脚本：

:: Generate root certificate and self sign it
openssl genrsa -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=root"

:: Intermediate certificate, signed with root CA
openssl genrsa -out intermediate.key 2048
openssl req -addext basicConstraints=CA:TRUE -new -sha256 -key intermediate.key -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=intermediate" -out intermediate.csr
openssl x509 -req -in intermediate.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out intermediate.crt -days 500 -sha256

:: User 1 certificate, signed by intermediate certificate
openssl genrsa -out user1.key 2048
openssl req -addext basicConstraints=CA:TRUE -new -sha256 -key user1.key -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=user1" -out user1.csr
openssl x509 -req -in user1.csr -CA intermediate.crt -CAkey intermediate.key -CAcreateserial -out user1.crt -days 500 -sha256

:: User 2 certificate, signed by intermediate certificate
openssl genrsa -out user2.key 2048
openssl req -addext basicConstraints=CA:TRUE -new -sha256 -key user2.key -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=user2" -out user2.csr 
openssl x509 -req -in user2.csr -CA intermediate.crt -CAkey intermediate.key -CAcreateserial -out user2.crt -days 500 -sha256

:: Verify user 1 certificate trust chain w/o untrusted mode
openssl verify -verbose -CAfile rootca.crt intermediate.crt user1.crt

:: Verify user 1 certificate trust chain
echo "verify check with untrusted mode"
openssl verify -verbose -CAfile rootca.crt -untrusted intermediate.crt user1.crt

运行 verify 命令： 无不受信任的参数

> openssl verify -verbose -CAfile rootca.crt intermediate.crt user1.crt
C = US, ST = CA, O = "MyOrg, Inc.", CN = intermediate
error 24 at 1 depth lookup: invalid CA certificate
error user1.crt: verification failed

带参数-untrusted

> openssl verify -verbose -CAfile rootca.crt -untrusted intermediate.crt user1.crt
C = US, ST = CA, O = "MyOrg, Inc.", CN = intermediate
error 24 at 1 depth lookup: invalid CA certificate
error user1.crt: verification failed

我需要做什么来验证是否真的是根证书？rootca.crtuser1.crt

生成证书的脚本如下：https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309