I have a following hierarchy of certificates. And I need to do a client authentication on Apache.
. └── root (CA) - self signed ├── intermediate 1 (CA) | ├── client1 | ├── client2 └── intermediate 2 (CA) ├── client3 └── client4
Who should store intermediate certificates (a client or a server)?
I would prefer to store just a root CA on the server to validate all client certs against it. The main reason is that list of intermediate CA's can grow and I don't want to update all the time certs stored in Apache configuration.
Is this technically feasible? Does SSL protocol requests clients to send the whole chain?
One thought on this subject. As I understand when a client authenticates a server then the server sends the whole chain to the client. I hope that it's symmetrical and when the server needs to authenticate the client, it's the client responsibility to send the whole chain.