2

I have a Root Certificate Authority and and Intermediate Certificate Authority.

I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with no issues.

Now I have created a client certificate to restrict access to the site to those with certs. This is also working fine to Authenticate or Deny depending if I have installed the cert in my browser.

But I don't believe anything linked my client cert to my server cert. Maybe I missed a switch or option when creating the client certificate?

So if my Intermediate CA was to sign a cert for another server that a different set of clients should be accessing, wouldn't my original client cert authenticate on that server as well?

If that is the case, what would my option be? Create a separate Intermediate Certificate Authority for each server that needed separate clients?

4

Instead of setting up multiple CAs, you can just tweak access settings in your Apache configuration. Look at Require directive:

http://httpd.apache.org/docs/2.2/mod/core.html#require

If you set any authentication requirement, then default Require level is implicitly set to "valid-user" (anyone that meets other requirements).

But using Require, optionally combined with AuthGroupFile, you can limit access to users with particular certificates.

For example, you can issue client certificates with embedded email addesses in 2 domains:

name.surname@domain1.com
name.surname@domain2.com

Then on first Apache you can allow only users with certificates for *@domain1.com, and on second Apache only users from *@domain2.com.

  • Is it possible to have the multiple CAs and use require? Does the one affect the other? – Madness Jul 4 '15 at 18:04
  • It's possible, but Require is rather a way to avoid using multiple CAs. – Tomasz Klim Jul 4 '15 at 19:19
0

Server certificates can have multiple chain of trusts (the certificate have multiple roots), and the browser only need to trust one chain to trust the server's certificate.

I don't know whether browser actually supports this for client certificates as well. But if they do, you would be able to ship the client certificate signed with two separate root certificates, and the server can choose which roots that it trusts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.