Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to ask if it is possible to use different CA for the client certificate and the web certificate?

For example, I would use Verisign to sign my web certificate while I use my Self Sign certificate for the client certificate. I am just concerned that I need to pay a CA for each new client certificate that I would want to register.

How do you set that up in Apache server? Is this possible? Do I need to set the SSLCACertificateFile?

share|improve this question
add comment

1 Answer

The server certificate is sent by the server, to be validated by the client. The client certificate is sent by the client, to be validated by the server. They live in different worlds and have no need whatsoever to relate to the same certificate authority.

For client certificate validation with Apache, see this documentation. The server will need to validate the client certificate with regards to some trusted CA; you use SSLCACertificateFile or SSLCACertificatePath to configure these CA. It is possible to put a specific client certificate there directly, too (that's called "direct trust"). You will probably want to add a SSLRequire clause: validating a certificate is well and jolly, but often you want to grant access to a specific client, as in "human user", not just to anybody who could obtain a certificate from a given CA. The certificate, once validated, gives you some strong guarantee that the client's identity is really the one specified in the certificate, but it is still up to you to device whether a specific identity is to be accepted or not; and SSLRequire is the main tool for configure that.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.