Client certificate is issued by CA one, server certificate is issued by CA two, both CA one and CA two are root CA. Can client and server authenticate each other in tls?



There is nothing in the TLS protocol that forbids this.

For the load balancer that I have experience with, the Citrix NetScaler, you manually configure what CA(s) to accept for the client certificates.

So you might have a cerificate for the server that's bought from a regular public CA and you might configure the accepted client certificate to be from one specific internal CA that you run yourself.

That way you can issue the client certificates yourself and infuse them with data fields that you care about. Such as e.g. client's Windows username or e-mail address or something like a flag "is member of accounting department".

The server has no way of communicating "that's a nice certificate you just showed me, unfortunately it's not from the CA that I was looking for". Instead the server just has to abort the handshake - leaving the client guessing why this didn't work. (I think that's how it works at least.)

(There is a TLS extension for the other direction. It allows the client to tell the server "Okay, I only know these three CAs: x, y and z. You better have a server certificate signed by one of them." It's called "Trusted CA indication" See: https://www.rfc-editor.org/rfc/rfc6066#section-6 -- But I think it only works for clients to tell servers about trusted CAs. And not the other way around. Unsure.)

  • 2
    The server can send the list of accepted CA inside the CertificateRequest field certificate_authorities, see RFC 5246 section 7.4.4. This is actually used in practice and clients can use it to pick the expected certificate if multiple client certificates are available. And the server should send an alert unknown_ca back if the client certificate does not match the expected CA but some implementations just close the connection instead. Jul 23 '17 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.