So I have a few questions that has been kicking around in my head that I've filled with assumptions that may be incorrect.
- From what I understand, we need private key (in the format signedcert+privatekeycert) in every server in an infrastructure that communicates with another server with SSL. Because the private key needs to be there to decrypt messages received for SSL.
- Verification is done either by trusted authorities, trusted intermediaries based on certain modes of operation: verify-full (verifies both intermediates & roots), verify-ca (just roots). But you still need private keys for every server unless you are doing one-way SSL right?
- What is a chain "bundle"? in some documentation they wrote something like the cert files configured for nginx requires chain bundle. I'm not sure what that means exactly when they said chain bundle in the certificate file between certificate-signed to intermediate CA to root CA. I'm assuming it just means ---begin certificate--- ---begin certificate---- ---begin-certificate---- three certificates in a chain (signed -> intermediate -> root).
Thanks for any help clearing up these misconceptions in my head.