@@ -109,7 +109,10 @@ function pem_check_chain {

 			echo "[!!] This certificate's subject key identifier does NOT match the previous certificate's authority key identifier."

 		fi

-		local verify_cmd=(openssl verify -partial_chain -trusted "${pem}" "${prev_pem}")

+		# Use -CAfile instead of -trusted to ensure openssl will trust ONLY the

+		# current certificate; this is useful is the previous certificate

+		# happens to be in openssl's system-wide CA store.

+		local verify_cmd=(openssl verify -partial_chain -CAfile "${pem}" "${prev_pem}")

 		if "${verify_cmd[@]}" > verify_out 2>&1; then

 			echo "[ok] ${verify_cmd[*]} succeeded"

 		else