This question already has an answer here:
I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated.
I've got three CAs to sign client certificates:
- root CA: Self-signed.
- testers CA: Signed by root CA.
- production CA: Signed by root CA.
I want my server to trust all clients directly signed by root CA and directly signed by the testers CA, but deny any certificate signed by the production CA. I tried:
- root CA and testers CA in server's trust store: Production CA signed certificates pass because the root CA is trusted.
- testers CA only in server's trust store: Certs directly signed by root CA gets denied.
Is there any way to do this?
PD: Sorry about cross-posting this from stackoverflow (https://stackoverflow.com/questions/29097058/trust-ca-and-parent-ca-but-not-other-derivative-cas). They told me this is probably a better place to get an answer.