4

I have a Root Certificate Authority and and Intermediate Certificate Authority.

I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with no issues.

Now I have created a client certificate to restrict access to the site to those with certs. This is also working fine to Authenticate or Deny depending if I have installed the cert in my browser.

But I don't believe anything linked my client cert to my server cert. Maybe I missed a switch or option when creating the client certificate?

So if my Intermediate CA was to sign a cert for another server that a different set of clients should be accessing, wouldn't my original client cert authenticate on that server as well?

If that is the case, what would my option be? Create a separate Intermediate Certificate Authority for each server that needed separate clients?

Improve this question

2 Answers 2

Reset to default
4

Instead of setting up multiple CAs, you can just tweak access settings in your Apache configuration. Look at Require directive:

http://httpd.apache.org/docs/2.2/mod/core.html#require

If you set any authentication requirement, then default Require level is implicitly set to "valid-user" (anyone that meets other requirements).

But using Require, optionally combined with AuthGroupFile, you can limit access to users with particular certificates.

For example, you can issue client certificates with embedded email addesses in 2 domains:

[email protected]
[email protected]

Then on first Apache you can allow only users with certificates for *@domain1.com, and on second Apache only users from *@domain2.com.

Improve this answer
2
  • Is it possible to have the multiple CAs and use require? Does the one affect the other?
    – Madness
    Commented Jul 4, 2015 at 18:04
  • It's possible, but Require is rather a way to avoid using multiple CAs.
    – Tomasz Klim
    Commented Jul 4, 2015 at 19:19
0

Server certificates can have multiple chain of trusts (the certificate have multiple roots), and the browser only need to trust one chain to trust the server's certificate.

I don't know whether browser actually supports this for client certificates as well. But if they do, you would be able to ship the client certificate signed with two separate root certificates, and the server can choose which roots that it trusts.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .