I would like to ask if it is possible to use different CA for the client certificate and the web certificate?

For example, I would use Verisign to sign my web certificate while I use my Self Sign certificate for the client certificate. I am just concerned that I need to pay a CA for each new client certificate that I would want to register.

How do you set that up in Apache server? Is this possible? Do I need to set the SSLCACertificateFile?

1 Answer 1


The server certificate is sent by the server, to be validated by the client. The client certificate is sent by the client, to be validated by the server. They live in different worlds and have no need whatsoever to relate to the same certificate authority.

For client certificate validation with Apache, see this documentation. The server will need to validate the client certificate with regards to some trusted CA; you use SSLCACertificateFile or SSLCACertificatePath to configure these CA. It is possible to put a specific client certificate there directly, too (that's called "direct trust"). You will probably want to add a SSLRequire clause: validating a certificate is well and jolly, but often you want to grant access to a specific client, as in "human user", not just to anybody who could obtain a certificate from a given CA. The certificate, once validated, gives you some strong guarantee that the client's identity is really the one specified in the certificate, but it is still up to you to device whether a specific identity is to be accepted or not; and SSLRequire is the main tool for configure that.

  • "It is possible to put a specific client certificate there directly, too (that's called "direct trust")." What is the purpose of placing a specific client certificate? Let's say the client's chain is root -> A -> B -> leaf . If only the client's leaf is in SSLCACertificateFile and the server is set to SSLVerifyClient require, then Apache will fail with unable to get local issuer certificate, i.e. it requires full chain validation. If 'root' is included in SSLCACertificateFile then 'leaf's inclusion doesn't change anything either way.
    – ChaimKut
    Mar 5, 2017 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .