6

I have a scenario where in the client send send a client certificate issued from trusted root. The path of the client cert is like : Trusted Root |-----Intermediate Issuer |---- Client certificate

The server authenticates the client based on WCF client authentication "ChainTrust", serviceHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.ChainTrust;

We have the Trusted Root cert in the server, do the server also need to have the Intermediate Issuer Certificate for client authentication?

Any help and suggestion will be helpful?

Improve this question
1
  • I have a set up where the client sends only the client cert and the server does not have the intermediate issuer cert in its store,(only the trusted root), but the trust chain authentication passes. How is that possible if the intermediate certificate is necessary?
    – Abhi
    Oct 30, 2015 at 7:37

1 Answer 1

Reset to default
4

To validate the certificate of the client the server must be able to build the trust chain. That means that either the server needs to know all intermediate certificates already or the client has to include these together with its own certificate. This is no different from checking the server certificate at the client.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .