Build a Full Certificate Chain

medium 20 XP ~7 minHands-on lab

Clients connecting to core fail with unable to get local issuer certificate: the server only sends its own certificate. In /srv/lab/pki you have server.crt, intermediate.crt and root.crt.

Task

Create /home/student/fullchain.pem for the server to send:

the server certificate first, then the intermediate
not the root (clients already have it)
openssl verify -CAfile /srv/lab/pki/root.crt -untrusted /home/student/fullchain.pem /srv/lab/pki/server.crt must report OK

About this machine

Ubuntu 24.04 with no internet access. You are student with passwordless sudo. The grader checks the final state of the machine, not the commands you typed. Values like names and ports are generated for you.

tls openssl chain intermediate-ca