I am creating a c++ secure client-server application using openssl library. I am still not clear about some aspects of the SSLHandshake procedure
I have enabled Mutual TLS in-order verify the both the peers are trusted. I have 2 set of certificates and private keys. Both the sets have the same root certificate but different intermediate signers.
root CA ---> Intermediate CA1 ---->domain certificate1 (set 1)
root CA ---> Intermediate CA2 ---->domain certificate2 (set 2)
I have set the SSL_set_verify with VERIFY_PEER_CERT in both applications. I have not set the verification depth.
Server's call stack
- Server gets the root CA and add it to the trusted certificate store
- Server then get the PEM encoded certificate string in following format
-----BEGIN CERTIFICATE----- Domain certificate 1 -----END CERTIFICATE ----- -----BEGIN CERTIFICATE----- Intermediate certificate by CA1 -----END CERTIFICATE -----
Server reads the Domain certificate 1 from the PEM string and call the SSL_CTX_use_certificate
Server reads the Intermediate certificate from the string and add it to the extra_chain_certs using SSL_CTX_add_extra_chain_cert
3.Server loads the private key
Client's call stack
- Client gets the root CA and add it to the trusted certificate store
- Client then get the PEM encoded certificate string in following format
-----BEGIN CERTIFICATE----- Domain certificate 2 -----END CERTIFICATE ----- -----BEGIN CERTIFICATE----- Intermediate certificate by CA2 -----END CERTIFICATE -----
Client reads the Domain certificate 2 from the PEM string and call the SSL_CTX_use_certificate
Client reads the Intermediate certificate 2 from the string and add it to the extra_chain_certs using SSL_CTX_add_extra_chain_cert
3.Client loads the private key
Both parties will follow the SSLHandshake I need some clarification on the following.
Will the client/server completes is certificate chain using trusted certs and extra certs?
During SSLHandshake what shall the peer present? Only the domain certificate or the whole chain?
Will the SSLHandshake succeed because peer's intermediate CA is not present in local certificate store?
Does only having the root CA in store enough to verify the certificate chain presented by the peer?
If I am to create multiple clients from the same application, can I use the same context initialized with set 2 to connect multiple servers which are signed by same root CA?