Should I have 3 root CAs, 1 root CA + 3 intermediates, or some other PKI setup for the following situation?
I have three use cases:
- Expose a web API over HTTPS (server certificates)
- Allow clients to authenticate with a client certificate instead of username/password (external client certificates)
- Validate internal servers as clients (internal client certificates)
Every key pair will be used for exactly one of the use cases.
Let us assume I do not need a 3rd party CA and I am instead working with a custom PKI in a closed system. I can see two major ways of supporting this:
- 1 root CA with 3 intermediate CAs (one intermediate for each case)
- 3 root CAs (one root for each use case)
I have attempted to start #1, but I've found that in order to have
openssl s_client test client certificates against a node.js HTTPS server, that I need to validate from intermediate to root, not just intermediate. Which means that client certs between use case 2 and 3 can be interchanged as the root is the trust anchor. I've looked around, but I can not find a way to make the intermediate CA the trust anchor for the node.js HTTPS server.
So, I'm grossly misunderstanding something, I need to move to implementation #2, or a mixture of things.