I would like to set up OCSP multi stapling and I can not find a lot of documentation on it, or in any case, recent information.
I have a root certificate authority (CA) and a daughter CA below. Both work with Freeipa (and Freeipa uses Dogtag). I have a https server too.
- The root CA issues a certificate for the daughter CA.
- The daughter CA issues a certificate for the https server.
- The https server delivers the service for an external client.
OCSP simple stapling works : the client can check the certificate for the https server. Now, I would like to check the no-revocation of the daughter CA by stapling too.
My https server is Apache. On it, I have added the lines following in /etc/httpd/conf.d/ssl.conf
:
SSLUseStapling on
SSLStaplingCache shmcb:/run/httpd/sslcache(512000)
And, always in ssl.conf on the https server, I used the SSLCertificateChainFile
with a PEM file containing the daughter CA's certificate and the https server's certificate.
I assume it is not enough to add the root CA's certificate in the PEM file.
And the https server must present a certificate with the urls of both CAs written in the field Authority Information Access. It needs some configuration.
What should I add to simple stapling?
And how to check that it works?
Does Freeipa/Dogtag support OCSP multi stapling?
Subsidiary question: is multi stapling supported by browsers?
I guess so because it is common to have a hierarchy of CAs in the internet world but I would like to have more details and I understood that it's little used.
Thank you very much!