ssl - Get complete certificate chain including the root certificate -

how complete certificate chain server? though claim one should able that openssl s_client -showcerts, turns not case.

echo | openssl s_client -capath /etc/ssl/certs -connect www.ssllabs.com:443 \                         -showcerts | grep -b2 begin depth=3 c = se, o = addtrust ab, ou = addtrust external ttp network, cn = addtrust external ca root verify return:1 depth=2 c = gb, st = greater manchester, l = salford, o = comodo ca limited, cn = comodo rsa certification authority verify return:1 depth=1 c = gb, st = greater manchester, l = salford, o = comodo ca limited, cn = comodo rsa domain validation secure server ca verify return:1 depth=0 ou = domain control validated, ou = positivessl, cn = www.ssllabs.com verify return:1  0 s:/ou=domain control validated/ou=positivessl/cn=www.ssllabs.com    i:/c=gb/st=greater manchester/l=salford/o=comodo ca limited/cn=comodo rsa domain validation secure server ca -----begin certificate----- --  1 s:/c=gb/st=greater manchester/l=salford/o=comodo ca limited/cn=comodo rsa domain validation secure server ca    i:/c=gb/st=greater manchester/l=salford/o=comodo ca limited/cn=comodo rsa certification authority -----begin certificate----- --  2 s:/c=gb/st=greater manchester/l=salford/o=comodo ca limited/cn=comodo rsa certification authority    i:/c=se/o=addtrust ab/ou=addtrust external ttp network/cn=addtrust external ca root -----begin certificate----- done 

here have 3 certificates our of four. except of addtrust external ca root certificate. (possibly because not included certificate bundle. , not required. , yes, can find missing 1 @ /etc/ssl/certs)

how certificates server in automatic fashion?

you chain including builtin trusted root certificate inside verify_callback (see ssl_ctx_set_verify. small perl program can dump chain this:

#!/usr/bin/perl use strict; use warnings; use io::socket::ssl;  io::socket::ssl->new(     peerhost => 'www.google.com:443',     ssl_verify_callback => sub {         $cert = $_[4];         $subject = net::ssleay::x509_name_oneline(net::ssleay::x509_get_subject_name($cert));         $issuer  = net::ssleay::x509_name_oneline(net::ssleay::x509_get_issuer_name($cert));         print "# $subject (issuer=$issuer)\n";         print net::ssleay::pem_get_string_x509($cert),"\n";         return 1;     } ) or die $ssl_error||$!;