Right now I need to import the Root-CA's cert, the Intermediate-CA's cert and the Client cert on the client for it to be able to connect to the server. The server has access to the Root-CA's cert via the SSLCACertificateFile directive.

I suppose that right now the server cannot verify the Intermediate-CA because it does not have access to it's cert. So it queries the client. Is that right?

If that is so: How can I give the server the ability to verify the trust chain on it's own? Maybe an URL in the signers certificate? Adding more than one SSLCACertificateFile directive didn't work.

  • An URL in the certificate won't work. As far as I've seen there is no way to include an URL and then let the server retrieve the certificate from it. And if you think a few minutes about it, you may understand why that is not a good idea (think DoS, for instance). May 5, 2018 at 19:49
  • Server can't 'query' client for individual cert(s); if server requests client auth, client has one chance to send full chain (optionally excluding root, as Steffen says). You may be using Apache httpd although you don't say so; different servers can be different and in particular Java servers like Tomcat (non-APR) could have the intermediate as anchor. @MaartenBodewes: AIA.caIssuers is a suitable place for this URL, but useful only if receiver implements it; AFAIK Apache doesn't, and it delegates most work to OpenSSL which definitely doesn't. May 6, 2018 at 7:14

1 Answer 1


Providing the full chain (that is all intermediate certificates but not the root certificate) is actually the normal way to exchange certificates since the other party is only expected to have the trusted root certificate. This is true for both client and server certificates.

Still, it should be possible to provide chain certificates which the client does not send within the same CA file where the server has the trusted root CA(s) used for client authentication. Note that with SSLCACertificateFile you specify a file which can contain several certificates (simply concatenated) and not only a single one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .