Skip to main content

Verify the certificate chain

With all the certificates created, you're ready to verify that you have a functional hybrid certificate chain.

  1. Verify that the hybrid chain works using legacy cryptography.

    /app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl verify -engine IQREngine -verbose -CAfile xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem -untrusted dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem

    You should see this output:

    engine "IQREngine" set.
rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem: OK

  2. Verify that the hybrid certificate chain works using quantum-safe cryptography.

    /app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl x509QSVerify -engine /app/digicert-pqc/connector/lib/libiqre_engine.so -root xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem -untrusted dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem -cert rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem

    Which should provide this output:

    engine "IQREngine" set.
2 : ok : /C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=DigiCert PQC Root
1 : ok : /C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=DigiCert PQC Test Intermediate CA
0 : ok : /C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=digicert.pqc
Success!!

  3. To verify all files were created, execute an ls command . If you were successful, you should see an output like this:

    configs
dilithium_catalyst_mixed_chain_intermediate_private_key.pem
dilithium_catalyst_mixed_chain_intermediate_public_key.pem
dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem
dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_req.pem
ecdsa_catalyst_mixed_chain_parameters.pem
ecdsa_without_dilithium_catalyst_mixed_chain_intermediate_private_key.pem
ecdsa_without_dilithium_x509_catalyst_mixed_chain_intermediate_certificate.pem
ecdsa_without_dilithium_x509_catalyst_mixed_chain_intermediate_req.pem
ecdsa_without_rainbow_catalyst_mixed_chain_private_key.pem
ecdsa_without_rainbow_x509_catalyst_mixed_chain_certificate.pem
ecdsa_without_rainbow_x509_catalyst_mixed_chain_req.pem
ecdsa_without_xmss_catalyst_mixed_chain_root_private_key.pem
ecdsa_without_xmss_x509_catalyst_mixed_chain_root_certificate.pem
ecdsa_without_xmss_x509_catalyst_mixed_chain_root_req.pem
rainbow_catalyst_mixed_chain_private_key.pem
rainbow_catalyst_mixed_chain_public_key.pem
rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem
rainbow_ecdsa_x509_catalyst_mixed_chain_server_req.pem
xmss_catalyst_mixed_chain_root_private_key.pem
xmss_catalyst_mixed_chain_root_private_key_state.bin
xmss_catalyst_mixed_chain_root_public_key.pem
xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem
In this section: