Topic: openssl
-
TLS verification errors across tools: unknown authority, CERTIFICATE_VERIFY_FAILED, self-signed in chain
Different TLS clients report the same underlying failure - an incomplete or untrusted certificate chain - in their own wording: 'certificate signed by unknown authority', 'CERTIFICATE_VERIFY_FAILED', 'unable to get local issuer certificate', 'self-signed certificate in certificate chain'. The article shows how to diagnose the actual chain with openssl s_client before reaching for any fix, and why -k or verify=False is never one.
-
Converting certificates between PEM, DER and PKCS#12 with openssl for cross-platform trust and keystores
Trust stores and keystores expect different container formats: RHEL/Debian anchors want PEM .crt files, Windows and Java tooling often hand you or expect PKCS#12 (.pfx/.p12) or DER (.cer), and openssl pkcs12/x509 convert between them and split out the key.
-
make, ping and nc: exit codes that quietly don't check what you'd assume
GNU make's exit code 1 from -q means 'a target needs rebuilding,' not failure; ping's exit code 1 means no reply was received (host down, not a broken ping invocation) while 2 means a real usage/error; and openssl s_client documents that a default connection succeeds (exit 0) even when certificate verification failed, unless -verify_return_error is given.
Machine-readable: JSON