verify error:num=79:invalid CA certificate

OpenSSL 3.0.13 and 3.5.7 both report this case as error 79 (older references list "invalid CA certificate" as error 24, which still exists for other CA checks). s_client also prints error 26, "unsuitable certificate purpose", for the same certificate, and its summary line shows that last code.

OpenSSL 3.x CLI (openssl s_client / openssl verify) — X509_V_ERR_INVALID_CA

What it means

OpenSSL error 79 (X509_V_ERR_INVALID_CA): a certificate that sits in an issuer position of the chain is not a valid CA certificate — its basicConstraints say CA:FALSE or are missing, or its keyUsage does not allow certificate signing. The depth in the openssl verify message points at the offending certificate (1 is the first intermediate).

Why it happens

• The issuer is an end-entity certificate

  common

  Certificates signed with a server or client certificate's key, typical of hand-made PKI scripts.

• The CA certificate lacks keyCertSign

  occasional

  An intermediate whose keyUsage omits keyCertSign is not usable as an issuer even with CA:TRUE.

• Path length constraint exceeded

  rare

  An intermediate below a CA with pathlen:0 is not accepted as an issuer; restructure the hierarchy or reissue with a suitable pathlen.

How to fix it

1. 1.

   Inspect the certificate at the reported depth

   basicConstraints must be CA:TRUE (critical) and keyUsage must include keyCertSign.

   # The certificate at the depth named in the error must be a CA
   openssl x509 -in int.pem -noout -subject -ext basicConstraints,keyUsage

2. 2.

   Reissue the intermediate as a CA

   Re-sign it with CA extensions; certificates it issued stay valid if the key and subject are unchanged.

   printf 'basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign\n' > ca.ext
   openssl x509 -req -in int.csr -CA root.pem -CAkey root.key -days 1825 -extfile ca.ext -out int.pem

← Browse the full signature error database