Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a CA hierarchy like this:

         |                      |
      TEST-CA             PRODUCTION-CA
    _____|_____             ____|____
   |           |           |         |

From the perspective of the production server identified by the PROD-SRV server certificate, how would I setup Apache mod_ssl to require the PROD-CLI client certificate signed by the PRODUCTION-CA and not allow a client with the TEST-CLI certificate signed by the TEST-CA?

Currently I have:

SSLCertificateFile      prod_srv.crt
SSLCertificateKeyFile   prod_srv.pem
SSLCADNRequestFile      prod_ca.crt
SSLCACertificateFile    root_ca.crt

This looks like it is working because the server asks the browser for the PROD CLI certificate but if I provide TEST CLI certificate a valid certificate path is constructed and a test client is accepted onto the production system.

share|improve this question
up vote 2 down vote accepted

Look into the SSLRequire directive - the following rule should look at the Issuer field (i.e. the CA certificate) of the certificate presented, pick out the CN, and match it against the name of your PRODUCTION-CA certificate.

share|improve this answer
Thanks meulop! This solution works when SSLVerifyClient is set to optional. I was hoping there would be a way to implement this simply through defining trust, making the chain validation fail without explicitly checking parts of the certificates. If nobody provides such a solution I shall accept yours in a few days. I appreciate your help! – moosaka Mar 6 '12 at 12:24
Is this solution vulnerable to implicit trust attacks? (i.e. if someone manages to obtain a CA certificate you trust, with the name PRODUCTION-CA.) Can you check against a specific public key here, or maybe there is some other way to tell Apache "only trust certificates issued by this specific CA certificate"? – Mike Jun 12 '12 at 1:02
Never mind. Looks like you'd do it with SSLCACertificateFile set to PRODUCTION-CA. And in your case this might be fine because you have root_ca.crt (your own) specified in the configuration. I was worried about implicit trust from a public CA. I guess from a general security perspective it's better to trust less, so why not use the production CA and just exclude everything else? – Mike Jun 12 '12 at 1:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.