Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

After implementing a Mutual Certificate Authentication with OpenSSL and Apache Web Server on CentOS platform, I tried this scenario (see this diagram):

                       |  Root CA  |    // Self-Signed Certificate
                     |                 |     
                ----------          ----------
              |  SiteA CA  |       |  SiteB CA  |  //Two Different Intermediate CAs
                ----------           ----------
               |          |                |          |
            -------    -------            -------     -------
         | Server1 | | Client1 |        | Server2 | | Client2 | 
            -------    -------            -------     -------          

So I have a different sites with different domains, e.g.:


After putting rootca.crt in browser and client1.crt which is signed by siteA CA, I had a big problem! Client1 whose certificate is signed by SiteCA1 can enter to both sites A & B! and that's totally mistaken.
How could I do it right?

share|improve this question
Did you try removing rootca.crt and installing a cert from SiteA CA? My understanding of a structure like this is that you trust RootCA and therefore trust things signed by Site A and B. Also, by saying "can enter" do you mean they aren't presented with a notice that a site may be untrusted or are they able to enter using some sort of cached credentials? –  chuck May 16 '13 at 15:36
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.