0

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and server certificates are implemented and required for authentication. Everything is working great but I had some questions about integrating a third device.

I have a firewall that is going to look for a client certificate in order to authenticate users. The clients already have the root CA certificate uploaded to their trust store (ie the root CA that issued the Intermediate CA that issued the client cert).

In order for the firewall to authenticate users, I believe I need to add the Root CA certificate to the firewall trust store as well so that when a client presents a client certificate, the firewall can trust the client possesses a certificate that has a chain of trust back to the Root CA. This is where I am a little confused. I am fairly certain that I add the Root CA cert to the firewall but I am also wondering if the Issuing CA certificate needs to be added as well or not at all.

From this I have two questions:

The firewall received a signed certificate from the Intermediate CA and the client did as well. Do I need to add the Root CA certificate or the Intermediate CA certificate to the firewall trust store?

More importantly, why? Why is the Root CA certificate added and not the Issuing CA certificate? I think I know why but I don't know all the details, if someone could break down the details and go through what the exact process the firewall would go through to validate the client certificate.

  • Wording question: the root CA is signed by the intermediate CA? – Mike Ounsworth Aug 24 '18 at 13:43
  • Yes, the intermediate is signed by the Root CA – bm07 Aug 24 '18 at 13:46
  • So the intermediate is signed by the root. That makes more sense. – Mike Ounsworth Aug 24 '18 at 13:46
  • In any TLS connection, the party sending a certificate is expected to send the full certification chain (only the root is optional) that is all intermediary certificates and the final client one. Intermediate CAs should not be installed in trust stores, as there are not ultimately trusted. – Patrick Mevzek Aug 24 '18 at 14:56
1

I won't give a full explanation of how certificate validation works as there are already a number of great answers on this site if you search "how does certificate validation work".


Your questions:

The firewall received a signed certificate from the Intermediate CA and the client did as well. Do I need to add the Root CA certificate or the Intermediate CA certificate to the firewall trust store?

The only real answer here is "Depends how your firewall works, the manual should tell you". Usually you trust a root CA.

More importantly, why? Why is the Root CA certificate added and not the Issuing CA certificate? I think I know why but if someone could break down the details and go through what the exact process the firewall would go through to validate the client certificate.

For the exact process, see any of the other excellent answers on this site.

For an intuition, ask your self why you set up a root CA and an Intermediate CA in the first place? Why didn't you just make a root and issue your client certs off that? Usually the answer is that you want the ability to revoke the Intermediate CA if it gets compromised. If you tell your programs to explicitely trust the Intermediate CA, then even if you revoke it at the root, the software will continue to trust it, because you told it to. You may also run in to technical problems as many cert validation engines get unhappy if the cert chain doesn't end with a self-signed cert.

  • 1
    Good point. Yes, the reason I created the two tier is so I could revoke the intermediate CAs. Didn't even realize this would create problems if I added the intermediate CA to the firewall and had to revoke it later on. – bm07 Aug 24 '18 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.