title: Invalid CA certificate with self signed certificate chain
body: <p>I have a self signed certificate chain with these commands and configured them on an Apache server</p>
  <p>But when i try <code>openssl s_client -showcerts -servername server -connect my-host.local:443 -CAfile all.crt</code></p>
  <p>I get an error from openssl <code>Verify return code: 24 (invalid CA certificate)</code></p>
  <p>Is there something wrong with the commands used to generate the certificates or with the configuration files?</p>
  <h2>commands used to create certificate chain</h2>
  <pre><code># self signed root cert
  openssl genrsa -aes256 -out ca.key 4096
  openssl req -new -x509 -days 3000 -key ca.key -out ca.crt -config ca.conf
  
  # intermediate cert signed with the root cert
  openssl genrsa -aes256 -out int.key 4096
  openssl req -new -key int.key -out int.csr -config int.conf
  openssl x509 -req -days 3000 -in int.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out int.crt
  
  # leaf cert signed with the intermediate cert
  
  openssl genrsa -aes256 -out leaf.key 4096
  openssl req -new -key leaf.key -out leaf.csr -config leaf.conf
  openssl x509 -req -days 3000 -in leaf.csr -CA int.crt -CAkey int.key -set_serial 01 -out leaf.crt
  
   cat ca.crt int.crt leaf.crt &gt; all.crt
  </code></pre>
  <h2>These are the config files I have used</h2>
  <blockquote>
  <h3>ca.conf</h3>
  <p>[ req ]<br />
  distinguished_name     = req_distinguished_name<br />
  x509_extensions        = v3_ca<br />
  dirstring_type = nobmp<br />
  [ req_distinguished_name ]<br />
  commonName                     = Common Name (eg, YOUR name)<br />
  commonName_default             = root<br />
  [ v3_ca ]<br />
  keyUsage=critical, keyCertSign<br />
  subjectKeyIdentifier=hash<br />
  authorityKeyIdentifier=keyid:always,issuer:always<br />
  basicConstraints=critical,CA:TRUE,pathlen:1<br />
  extendedKeyUsage=serverAuth</p>
  <h3>int.conf</h3>
  <p>[ req ]<br />
  distinguished_name     = req_distinguished_name<br />
  x509_extensions        = ext<br />
  [ req_distinguished_name ]<br />
  commonName                     = Common Name (eg, YOUR name)<br />
  commonName_default             = int<br />
  [ ext ]<br />
  keyUsage=critical, keyCertSign<br />
  subjectKeyIdentifier=hash<br />
  authorityKeyIdentifier=keyid:always,issuer:always<br />
  basicConstraints=CA:TRUE,pathlen:0<br />
  extendedKeyUsage=serverAuth</p>
  <h3>leaf.conf</h3>
  <p>[ req ]<br />
  distinguished_name     = req_distinguished_name<br />
  dirstring_type = nobmp<br />
  [ req_distinguished_name ]<br />
  commonName                     = Common Name (eg, YOUR name)<br />
  commonName_default             = leaf</p>
  </blockquote>