I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with

CACertificate-1.cer  (RapidSSL SHA256 CA - G3)
CACertificate-2.cer  (GeoTrust Global CA)
ServerCertificate.cer (Actual Certificate)

But I am stuck at the point where I need to create client's certificate. The cafesoft.com tutorial I am following makes use of the CA's certificate key to generate/sign the client's certificate. Obviously I don't have the CA's Certificate key. How to go about this? Should I just gave up and use a self signed CA or there is a way to do this?

Thanks in advance,

  • Startssl can sign a client cert for free. They charge to revoke though, FYI Commented Jun 18, 2015 at 1:53
  • I doubt it's still free. I actually contacted them I was suggested this startssl.com/?app=7 since I am not expecting to have more than 50 client this year Commented Jun 18, 2015 at 12:06

2 Answers 2


The server certificate and the CA certificate used for authenticating your clients are two different things.

First, you need to have your server certificate installed (SSLCertificateFile and SSLCertificateFileKey). You should already have that.

At this point, you have your server presenting his certificate to clients.

Now, you need to generate a CA (self-signed) and tell your Apache instance that this is the CA you want to use for authenticating clients. (SSLCACertificateFile and SSLVerifyClient require)

You just have to sign your clients csr with your newly created CA.



You need a client certificate for each user (or client app if your app is authenticating to the server) that will use mutual auth SSL. You can purchase client certs from an existing CA or create a self-signed CA cert and issue your own certs. If you have many users, purchasing certs can be expensive.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .