Hi, (first at all sorry for my english)
How does modssl verify client certificates? Do I need to have all
certficates in the client certificate chain?
What about this:
I have a root CA and a intermediate CA. The intermediate CA is the
issuer of my clients. I only want those clients to access my server so I
set the intermediate CA in SSLCACertificatePath (I make the symbolic
link too). Do I have to have the root CA certificate in
SSLCACertificatePath (if I set the symbolic link, then I will pass
another clients that I don't want)?
What about my trust in the intermediate CA? If I say that I trust in
such CA, no matter who is the issuer of its certificate, why modssl
keeps complaining about issuer certificate?
I mean that when I make a positive indication about my trust in one CA,
who cares about its certificate issuer.
Maybe the reason is that OpenSSL verifies a client certificate only when
it is possible verify the whole certificate chain until a root CA is
found.
And the last question,
In this way, isn't modssl getting stuck in performance penalties
when verifying the whole certificate chain (until root CA) when maybe
the first or the second is admitted as a client CA?
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
