This question already has an answer here:

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated.

I've got three CAs to sign client certificates:

  • root CA: Self-signed.
  • testers CA: Signed by root CA.
  • production CA: Signed by root CA.

I want my server to trust all clients directly signed by root CA and directly signed by the testers CA, but deny any certificate signed by the production CA. I tried:

  • root CA and testers CA in server's trust store: Production CA signed certificates pass because the root CA is trusted.
  • testers CA only in server's trust store: Certs directly signed by root CA gets denied.

Is there any way to do this?

PD: Sorry about cross-posting this from stackoverflow (https://stackoverflow.com/questions/29097058/trust-ca-and-parent-ca-but-not-other-derivative-cas). They told me this is probably a better place to get an answer.

marked as duplicate by gowenfawr, Community Mar 17 '15 at 15:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Thanks, didn't found that. So the only way is to implement my own chain validation (not standard x509 chain validation) or change to a CA hierarchy that fits better. – roirodriguez Mar 17 '15 at 15:09
  • Yes, I'd advise you to set up a separate root for your testing certs. – gowenfawr Mar 17 '15 at 15:18