So I followed this for setting up client ssl certs using openssl: http://drumcoder.co.uk/blog/2011/oct/19/client-side-certificates-web-apps/

It basically walks through creating a new CA key, and then creating both a server.crt and client.crt and signing them with the CA key.

I have two questions:

1) I couldn't get it working until I added ssl_verify_depth 2;. I found that on discussions about using intermediate CAs, but I did not think this was an intermediate CA, rather a root that I just created. What gives?

2) I already have a server.crt signed by a trusted CA that I payed for. Obviously I can't sign client certs with that CA's private key, but I can sign them with the server's key, and the server.crt is signed by the CA. Though from what I've read, TLS does not support this kind of thing. Is is at all possible to authenticate clients over TLS by signing certs with the servers key, rather than a CA's (which signs both server and client)?

  • so this addresses my second question. But it's an unfortunate oversight in the design of these specs that client side certs could not be signed by server keys (as non CAs but in need of granting authentication). how are we expected to do reasonable pubkey based webapp logins? sigh :(
    – Ethan
    Oct 23, 2014 at 18:38
  • on nginx, just found the ssl_verify_client optional_no_ca option which I believe addresses this! nginx.org/en/docs/http/…
    – Ethan
    Oct 23, 2014 at 19:06


Browse other questions tagged .