Re: Correct use of SSLVerifyClient and Sub-Ordinate CAs

Joe Orton <[email protected]> Fri, 14 Dec 2007 11:10:03 +0000

Newsgroups	gmane.comp.apache.mod-ssl.user
Organization	Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in UK and Wales under Company Registration No. 03798903 Directors: Michael Cunningham (USA), Brendan Lane (Ireland), Matt Parson (USA), Charlie Peters (USA)
Message-ID	<[email protected]>

On Mon, Nov 19, 2007 at 09:24:09AM +0000, Anony Mouse wrote:
> I've found myself in the same quandary as this guy [1]. My CA
> structure is as follows.
> 
> - RootCA
>  - SubCA1
>    - SubCA1 Server
>    - SubCA1 Clients
>  - SubCA2
>    - SubCA2 Server
>    - SubCA2 Clients
> 
> I have two HTTPS vhost containers. One which has a server certificate
> issued by SubCA1 and should only accept client certificates from
> SubCA1. Likewise, another for SubCA2, which should only accept client
> certificates from SubCA2.

I think this should work by using:

   SSLCertificateChainFile rootca
   <Vhost for SubCA1>
        SSLCACertificateFile SubCA1
   </Vhost>
   <Vhost for SubCA2>
        SSLCACertificateFile SubCA2
   </Vhost>

joe
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]