Changes between Initial Version and Version 1 of Using_Certificate_Chains

Timestamp:

12/17/10 10:31:33 (13 years ago)

Author:

JJK

Comment:

--

Using_Certificate_Chains

@@ +1 @@
+= What are certificate chains? =
+Certificate chains are (daisy) chained certificates. They are most often used in secure web servers, where the 'root CA' is a globally known CA certificate , such as GlobalTrust or VeriSign.
+
+A certificate chain can be depicted using ASCII art:
+{{{
+  root-CA
+    + sub-CA1
+        + sub-CA2
+            + SSL server certificate
+            + SSL client certificate
+}}}
+The dependency of the "SSL server certificate" on the "sub-CA2" certificate, which in turn depends on the "sub-CA1" certificate which depends on the "root-CA" certificate is what makes this a certificate '''chain'''
+
+= Certificate chains versus stacked certificates =
+A certificate chain has a dependency between the different elements. A stacked certificate means that a bunch of certificates have been stacked together. OpenVPN supports both. When using certificates signed by multiple CAs it is often sufficient to simply stack the different CA certificates together:
+{{{
+  $ cat ca1.crt ca2.crt ca3.crt > stacked.crt
+}}}
+and use them in the OpenVPN configuration using
+{{{
+  ca stacked.crt
+}}}
+
+'''Imporant notice''': All certificates which are signed by '''any''' of the CA certificates found in the 'stacked.crt' file are considered valid. Thus, be very careful when adding CA certificates to a stacked certificate.
+
+Certificate ''chains'' are very similar but here the client (or server) certificate itself and its sub-CA certificates are stacked together, as will be explained in the following section.
+
+= How to use certificate chains in OpenVPN =
+
+1. Consider the following CA setup:
+ * the 'root CA' certificate is 'ca.crt'
+ * the server certificate is signed by the root CA
+ * a separate sub-CA or intermediary CA is created, which is also signed by the root CA
+ * the client certificates are signed by the sub-CA. 
+This can be depicted using some ASCII-art:
+{{{
+ca.crt --- server.crt
+       +-- sub-ca.crt --- client.crt
+}}}
+
+2. Create a chained certificate by concatenating the client.crt and sub-ca.crt file in the right order:
+{{{
+  $ cat client.crt sub-ca.crt > chained.crt
+}}}
+
+3. Configure the OpenVPN server using
+{{{
+  ca   ca.crt
+  cert server.crt
+}}}
+
+4. Configure the clients using
+{{{
+  ca   ca.crt
+  cert chained.crt
+}}}
+
+then the server will accept connections from the client even though it does not directly have access to the sub-ca.crt file.