How to install VeriSign and Thawte root certificate
authority (CA) certificates for ucspi-ssl:

• For VeriSign:

  • Use openssl's s_client to obtain the VeriSign CA cert:

        openssl s_client -showcerts -connect www.verisign.com:443
    

    The first cert is the server cert, the second (last?) should be the CA cert (which you want to save).
    
    
  • Save the VeriSign CA cert to /usr/local/ssl/certs/verisign-ca.pem .
  
  
  • Use openssl to get the hash of the cert:

        openssl x509 -hash -noout -in verisign-ca.pem
    

  • Link the verisign-ca.pem to the hash name followed by '.0' (dot-zero).

        ln -s verisign-ca.pem f73e89fd.0
    

• For Thawte:

  • Download the Thawte CA cert:

        wget http://www.thawte.com/html/SUPPORT/keygen/serverbasic.crt -O thawte-ca.der
    

  • Convert the Thawte CA cert from DER to PEM format to /usr/local/ssl/certs/thawte-ca.pem :

        openssl x509 -inform DER -in thawte-ca.der -outform PEM -out /usr/local/ssl/certs/thawte-ca.pem
    

  • Remove the old DER format cert:

        rm thawte-ca.der
    

  • Use openssl to get the hash of the cert:

        openssl x509 -hash -noout -in thawte-ca.pem
    

  • Link the thawte-ca.pem to the hash name followed by '.0' (dot-zero).

        ln -s thawte-ca.pem ddc328ff.0
    

• Test with:

      echo -e 'GET / HTTP/1.0\n\n' |sslconnect www.verisign.com
  
      echo -e 'GET / HTTP/1.0\n\n' |sslconnect www.thawte.com
  

    openssl x509 -noout -text -in mycert.pem

    openssl x509 -fingerprint -noout -in mycert.pem

    openssl x509 -fingerprint -sha1 -noout -in mycert.pem