I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities.
Validating the subCA works using openssl verify
and also I can see it in Windows.
I can also verfiy the certificate for CUPS1.local in openssl via
openssl verify -CAfile /etc/certs/cacert.pem -untrusted subCA_websites.crt cups1.crt
cups1.crt: OK
Moreover, if I create a chain the certificate is also OK
cat /etc/certs/cacert.pem subCA_websites.crt > chain.pem
openssl verify -CAfile chain.pem cups1.crt
cups1.crt: OK
Now, I also want Windows to see these certificates as valid. And here is the problem: Windows does not see the certificate chain:
However, after installing the certificate of the subCA, the certificate for CUPS1.local is valid.
Hence, maybe I misunderstood some basics: Do I need to install the certificate of every subCA as Trusted Root Certification Authorities? Is there another way to implement the certificate chain into the certificate for CUPS1.local, such that I only need to install the ROOT_CA and not all the subCAs?
Short update: Well, since the certificate was intended for a website (CUPS server) the chain works by combining:
cat cups1.crt subCA_websites.crt /etc/certs/cacert.pem > chain.crt
When I add this chain.crt
to the CUPS server (and also the key-file), I can open the website without error message. I do not need to install the subCA certificate, only the ROOT_CA is fine.
Anyway, out of curiosity I would like to understand if windows can also somehow read the chain?