2

How can we identify which root CA client used when there are multiple root CAs on the server?

We can compare the public keys of the client certificate and the root certificate but if we have many root certificates this is an unnecessary overhead.

Is there any way to find out from the client certificate (x.509) which root CA (alias) is used?

Edited to add this clarification:

if the intermediate certificates in the certificate chain are not available/accessible and if the same CA issued all the multiple root certificates(e.g. different tenants), is there any other approach to match the incoming client certificate to the corresponding root certificate on the server?

4

Yes. The Issuer field in the x509 certificate is used to specify the Subject of the next certificate up in the certificate path. If you continue to recurse up the certificate chain, you'll eventually arrive at the Subject name of the root certificate.

  • Thank you. if the intermediate certificates in the certificate chain are not available/accessible and if the same CA issued all the multiple root certificates(e.g. different tenants), is there any other approach to match the incoming client certificate to the corresponding root certificate on the server? – Nerdyme Jul 24 '15 at 13:49
  • 1
    I'm not sure I fully understand your question. But generally speaking, you would need the intermediate certificates in order to traverse through the certificate chain. Moreover, without the intermediate certificates, you would have no way of validating the certificate signatures, since each certificate is used to sign the the next certificate in the chain, starting from the root cert. Having said that however, often times chains may be only two are three nodes long, and signing certificates are often available from CA's web servers. – mti2935 Jul 24 '15 at 15:50
4

It's actually not as complicated as that, your OS' Certificate Browser will do all the key checking for you. As an example, here's the cert for *.stackexchange.com viewed through the Windows Certificate Viewer. (I clicked the lock icon in Chrome, and "Certificate information")

Windows Certificate Viewer - General

Notice that the Issued by: field lists the display name of the issuing CA. This name is not necessarily unique, so for more details, go to the Details tab and find the Issuer field:

Windows Certificate Viewer - Details

This lists the full Distinguished Name (DN) of the issuing CA, which will be unique within their organization, but could be spoofed I guess. To check the actual certificates

Windows Certificate Viewer - Certificate Path

Here you can open up each of the certs in the chain and inspect them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.