What does the Acceptable client certificate CA names line mean in OpenSSL? When I connect via OpenSSL I can see the server certificate and Acceptable client certificate CA names that's listing various root CA.


This is the list of certificate authorities which are accepted by the server as issuer for the client certificate. The client can use this list to select the appropriate client certificate. See RFC 5246 (TLS 1.2) section 7.4.4:

A list of the distinguished names [X501] of acceptable certificate_authorities ... may specify a desired distinguished name for a root CA or for a subordinate CA; thus, this message can be used to describe known roots as well as a desired authorization space.

  • So this information is sent by the server I'm connecting to?
    – cyzczy
    Oct 7 '16 at 11:19
  • Or is this coming from server I'm running the openSSL command from ?
    – cyzczy
    Oct 7 '16 at 11:24
  • @adam86: As can be seen from the referenced TLS 1.2 standard the information is send within the TLS handshake. Which obviously means that this information is coming from the server you are connected to. Oct 7 '16 at 12:03
  • so basically if I want to connect via openSSL to my test DC I would have to import the root CA cert on the linux box from which I try to connect to the DC and specify that path to it when running the command, is that correct ?
    – cyzczy
    Oct 7 '16 at 13:24
  • @adam86: I don't really understand what you are talking about. But, like I said the list of CA is sent by the server so that the client knows which client certificates the server accepts. There is nothing to import at the client, its only that the client needs to send the requested client certificate back which the client obviously must have. Oct 7 '16 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.