openssl - problem using an intermediate CA

Question

I am trying to understand how to sign stuff using an intermediate CA certificate. I have developed a rather simple example (using https://gist.github.com/jadbaz/9350f4df4e4ef4c5d256889aa3d5a5ed as the basis, though I removed the configuration file and adjusted some of the commands accordingly)... I would expect the final certificate to be verifiable using either of the 2 CAs that I create during the execuion, but verification fails.... what am I missing:

# root ca
openssl genrsa -out rootca.key 4096
openssl req -sha256 -new -x509 -days 3650 -key rootca.key -out rootca.crt -subj /CN=rootca

# intermediate ca
openssl genrsa -out interca1.key 4096
openssl req -sha256 -new -key interca1.key -out interca1.csr -subj /CN=intermediateca -addext "basicConstraints=critical,CA:true" -addext "keyUsage=critical,keyCertSign,cRLSign"
openssl x509 -copy_extensions copyall -req -days 365 -in interca1.csr -CA rootca.crt -CAkey rootca.key -CAcreateserial -out interca1.crt

# verify chain so far
openssl verify -CAfile rootca.crt rootca.crt interca1.crt # both certificates are ok

# generating an example certificate
openssl genrsa -out example1.key 2048
openssl req -new -sha256 -key example1.key -out example1.csr -subj /CN=example1
openssl x509 -copy_extensions copyall -req -days 365 -in example1.csr -CA interca1.crt -CAkey interca1.key -CAcreateserial -out example1.crt

# verify results
openssl verify -CAfile rootca.crt rootca.crt interca1.crt example1.crt
openssl verify -CAfile interca1.crt interca1.crt example1.crt

Here's the output of the last verify runs:

# openssl verify -CAfile rootca.crt rootca.crt interca1.crt example1.crt
rootca.crt: OK
interca1.crt: OK
CN=example1
error 20 at 0 depth lookup: unable to get local issuer certificate
error example1.crt: verification failed
# openssl verify -CAfile interca1.crt interca1.crt example1.crt
CN=intermediateca
error 20 at 0 depth lookup: unable to get local issuer certificate
error interca1.crt: verification failed
CN=intermediateca
error 2 at 1 depth lookup: unable to get issuer certificate
error example1.crt: verification failed

What am I missing?

Also, why can't interca1 verify itself the same way that rootca did?

I am using openssl 3.2.2.

Update

It is not explained in the accepted answer but let me add a command that should work in case you want to try:

$ openssl verify -CAfile <( cat rootca.crt interca1.crt ) rootca.crt interca1.crt example1.crt
rootca.crt: OK
interca1.crt: OK
example1.crt: OK

Answer 1

In your case the issued certificate contain reference to all root and intermediate CA. When you check issued certificate you should provide (if in file) all root and intermediate certificates in one file. If you use CAdir instead of CAfile you can add all the root, intermediate certificates in this dir.

P.S. And you use verify command which require all the certificates in chain to be verified. And to quote comment:

One more bit I temporarily forgot: verify requires everything above the to-be-verified to be either in the truststore OR supplied by the -untrusted option, but that is rarely used. The root, or other anchor with partial_chain, must be specifically in the truststore