Technical Tip: Unable to authorize EMS server with a custom certificate, even though the CA cert is imported correctly

When using a custom certificate on the EMS server signed by a custom CA, there is a chance that there will be an intermediate certificate as part of the chain for that certificate. This would also be required on the firewall in order to authorize the EMS server.

It is possible to check for this by using OpenSSL to verify the CA cert against the cert imported on the EMS server.

Here is a download for the OpenSSL binary: OpenSSL Binary Distributions for Microsoft Windows.

The command to do is as follows:

openssl verify -CAfile ca_cert.cer ems_cert.cer

Replace the file names with the CA certificate and the EMS certificate respectively.

Here is an example of the output signifying there is a missing certificate in the chain:

Once an intermediate CA cert is found, it is possible to check it by running the following command:

openssl verify -verbose -CAfile ca_cert.cer -untrusted intermediate.cer ems_cert.cer

The following is the output of this command when the full chain is present: