I have a question about the directive SSLCACertificateFile.

My clients certificates are signed by an intermediate CA but in the file configured in the directive SSLCACertificateFile only contains the root CA and it works! Apache validates user's certificates. How is that possible? How does Apache manage to verify the client certificate without the intermediate certificate?

Thanks in advance

migrated from stackoverflow.com Jun 18 '12 at 3:47

This question came from our site for professional and enthusiast programmers.


The Client Certificate message doesn't only contain a single certificate, but a certificate chain.

The most likely cause of success here is that the clients will have sent the intermediate certificates as part of their chain. They're also more likely to send these intermediate certificates if the server only advertises that it's willing to accept certificates issued using the root CA certificate in the Certificate Request message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy