So I have a certificate file I need to verify.

1. openssl x509 -in x.txt -noout -text says Issuer: C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
2. openssl verify -CApath /etc/ssl/certs x.txt and openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt x.txt both complain error 20 at 0 depth lookup: unable to get local issuer certificate. ca-certificates is of version 20230311ubuntu0 which I feel should include a 2020 certificate.

Maybe there’s some info where to download the missing cert?

openssl x509 -in x.txt -noout -text|grep http
                  CPS: http://www.digicert.com/CPS
                  URI:http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl
                  URI:http://crl4.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl
                OCSP - URI:http://ocsp.digicert.com
                CA Issuers - URI:http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt

After downloading DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt and DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl I tried

openssl verify -CAfile DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt x.txt

800B219FFB7F0000:error:05800088:x509 certificate routines:X509_load_cert_crl_file_ex:no certificate or crl found:../crypto/x509/by_file.c:251:

The same happens if I download http://crl3.digicert.com/DigiCertGlobalRootG2.crl and http://cacerts.digicert.com/DigiCertGlobalRootG2.crt

I think I am missing something (like having the faintest idea of what I am doing).