Alexa request validation in python : <p>I work on a service that will handle Alexa voice intents. I need to verify the signature of each request and I almost succeed. The only part that is not working is the validation of certificates chain.</p>

<p>From the <a href="https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/developing-an-alexa-skill-as-a-web-service#checking-the-signature-of-the-request" rel="noreferrer">documentation</a> I know that:</p>

<blockquote>
  <p>This certificate chain is composed of, in order, (1) the Amazon signing 
  certificate and (2) one or more additional certificates that create a chain of 
  trust to a root certificate authority (CA) certificate.</p>
</blockquote>

<p>My code looks like this:</p>

<pre><code>certificates = pem.parse_file("chain.pem")
store = crypto.X509Store()
for cert in certificates[:-1]:
    loaded_cert = crypto.load_certificate(crypto.FILETYPE_PEM,
                                          cert.as_bytes())
    store.add_cert(loaded_cert)

intermediate_cert = crypto.load_certificate(
    crypto.FILETYPE_PEM,
    certificates[-1].as_bytes()
)
# Create a certificate context
store_ctx = crypto.X509StoreContext(store, intermediate_cert)

# Verify the certificate
store_ctx.verify_certificate()
</code></pre>

<p>I receive the following error:</p>

<pre><code>OpenSSL.crypto.X509StoreContextError: [20, 0, 'unable to get local issuer certificate']
</code></pre>

<p>I don't know what I did wrong, maybe there is someone who already implemented this and can drop a hint.</p>
