x509: invalid signature: parent certificate cannot sign this kind of certificate

Go wraps it as "x509: certificate signed by unknown authority (possibly because of \"x509: invalid signature: parent certificate cannot sign this kind of certificate\" while trying to verify candidate authority certificate \"<issuer CN>\")". The issuer name comes from your chain.

Go crypto/x509 — ConstraintViolationError: the issuer is not a CA (basicConstraints CA:FALSE or missing keyCertSign)

What it means

Go found a candidate issuer for a certificate (named in quotes at the end), but that issuer is not allowed to sign certificates: its basicConstraints say CA:FALSE (or are missing), or its keyUsage lacks keyCertSign. Go therefore discards it and, with no other path, reports "certificate signed by unknown authority", quoting this reason as the likely cause.

Why it happens

• Certificates signed with a non-CA certificate

  common

  Home-made PKI scripts that sign server certificates with another server certificate, or an "intermediate" created with the default (non-CA) profile.

• A CA certificate without keyCertSign

  occasional

  An intermediate with keyUsage = digitalSignature only (keyCertSign missing) cannot issue certificates in Go's eyes.

• A non-CA certificate in the chain bundle

  occasional

  A bundle that contains another leaf where the intermediate should be makes Go try that leaf as an issuer.

How to fix it

1. 1.

   Check basicConstraints and keyUsage of the issuer

   The quoted candidate must have CA:TRUE and keyCertSign. OpenSSL 3.5 reports the same defect as error 79, "invalid CA certificate".

   # Every issuing certificate needs CA:TRUE (and keyCertSign if keyUsage is present)
   openssl x509 -in intermediate.pem -noout -subject -ext basicConstraints,keyUsage
   openssl verify -CAfile root.pem -untrusted intermediate.pem server.pem   # OpenSSL 3.5: error 79, invalid CA certificate

2. 2.

   Reissue the intermediate as a CA

   Sign it with basicConstraints critical CA:TRUE (pathlen as appropriate) and keyUsage keyCertSign, cRLSign, then reissue or re-chain the leaves.

   # Issue the intermediate as a real CA
   printf 'basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign\n' > ca.ext
   openssl x509 -req -in int.csr -CA root.pem -CAkey root.key -days 1825 -extfile ca.ext -out int.pem

← Browse the full signature error database