Confusedly Using SSLCaCertificateFile

Question

There is something that I cannot understand with the SSLCACertificateFile parameter in Apache SSL conf. For example, I have a ROOT certificate "A" that issued an intermediate certificate "B". Then I produced a couple of leaf certificates using B, for example, "L1", "L2".

Now, according to the documentation, if I want to trust only L1 and L2, I have to put "B" and "A" in the file specified by SSLCACertificateFile (if I put only the certificate "B", Apache gives the -find-issuer error inability).

Now let's create another certificate "C" obtained from "A" (root). Can apache trust a partner using a C certificate? For me it is “yes, it will be”, because Apache will find the issuer “C” inside the SSLCACertificateFile, it is “A”! But I do not want to trust C, I only want to trust L1 and L2.

Did I miss something?

thank you very much!

Answer 1

The core of the TLS stack used by Apache is OpenSSL. OpenSSL requires, by default, a self-signed root certificate as the final trust anchor, which means that adding just the intermediate CA certificate to the trust store is not enough. Since OpenSSL 1.0.2 there is a flag X509_V_FLAG_PARTIAL_CHAIN ​​that will make this possible, but I do not see it in the Apache source code.

Thus, if you have no control over the root certification authority and the intermediate CA, there is no way to configure Apache to only trust the intermediate certification authority, but not any other certificates directly or indirectly issued by the root certification authority.

But if you have control over the CA B intermediate certificate (i.e., you have a private key), then you can issue another CA B2 certificate with the same question and private key B, but make it self-signed. Since the subject and public key are the same as in B, each certificate issued by B can be successfully verified using B2. And since B2 is self-signed, you can put it as the only trust in the SSLCACertificateFile, which only accepts certificates issued by B / B2, but not other certificates issued by root A.