there's something I can't understand with the SSLCACertificateFile parameter on Apache SSL conf. Put for example I have a ROOT cert "A" that issued an intermediate cert "B". Then, I produced a couple of leaf certificates using B, say "L1", "L2".

Now, according to the documentation, if I want to trust only L1 and L2 I should put "B" and "A" inside a file pointed by SSLCACertificateFile (if I put only certificate "B" Apache gives an unable-to-find-issuer error).

Now, let's produce another certificate, "C", derived from "A" (the root). Would apache trust a peer that's using certificate C? To me, it is a "yes, it will" as Apache will find the issuer of "C" inside the SSLCACertificateFile, it is "A"! But I don't want to trust C, I only want to trust L1 and L2.

Am I missing something?

many thanks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.