Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of hossy-apache@hossy.com
 designates 173.203.212.94 as permitted sender)
From: "Hossy" <hossy-apache@hossy.com>
To: <users@httpd.apache.org>
Date: Sun, 13 Mar 2011 10:44:06 -0500
Message-ID: <011601cbe195$7cc89d10$7659d730$@hossy.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: Acvhk4DW7gtm3sjBTmaUmmvvOdHJtQ==
Content-Language: en-us
Subject: [users@httpd] SSL Directives

I'm seeking validation on an issue I'm discussing regarding the use of the
SSLCACertificateFile and SSLCertificateChainFile directives.

What I'm trying to do: Install an SSL certificate on my web site (for use
with HTTPS) and provide the certificate chain from the server.
What I'm not trying to do: Allow web site users to authenticate to my site
via their own certificates.

I'm being told by cPanel/WHM support that the two directives can be used
interchangeably when applying an SSL certificate to a site for Web Server
Authentication for the purposes of returning the certificate chain.  Even
through the WHM interface, when it asks for the "ca bundle," it adds the
SSLCACertificateFile directive to the httpd.conf for the resulting file.

Through my testing with openssl s_client and
http://www.sslshopper.com/ssl-checker.html, I'm seeing that when using the
SSLCACertificateFile directive, only the server certificate is returned.
However, when I change to the SSLCertificateChainFile directive, both the
Intermediate and CA certificates are returned in addition to the server
certificate.

I'm reading through the documentation on mod_ssl
(http://httpd.apache.org/docs/2.0/mod/mod_ssl.html) and under the
SSLCertificateChainFile directive, it says, "This should be used
alternatively and/or additionally to SSLCACertificatePath for explicitly
constructing the server certificate chain which is sent to the browser in
addition to the server certificate."  And under SSLCACertificateFile, it
says, "This can be used alternatively and/or additionally to
SSLCACertificatePath."  So I'm confused.

Can anyone explain why using SSLCertificateChainFile causes the server
certificate chain to be sent to the browser while using SSLCACertficateFile
doesn't despite the apparent link in the documentation?


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org