I am very interested in setting up multi stapling and I can not find a lot of documentation on it, or in any case, recent information.

I have a certificate authority (CA) and a root CA above. They work with the Freeipa tool (and Freeipa uses Dogtag). I have a https server too.

The root CA issues a certificate for the subordinate CA. The subordinate CA issues a certificate for the https server. This server delivers the service for an external client. I would like the client to check the validity of all certificates using ocsp stapling.

In my https server I have added the lines following in /etc/httpd/conf.d/ssl.conf :

SSLUseStapling on  
SSLStaplingCache shmcb:/run/httpd/sslcache(512000)

It works with single stapling; the client can check the certificate for the first CA. I would like the client to check the validity of all certificates.

I suppose it is not enough to add the certificate of the all CAs to the ssl.conf file of the https server. And the https server must issue a certificate with the urls of both CAs written in the field Authority information access.

Concretely what should I add to simple stapling? And how to check that it works? Does Freeipa/Dogtag support multi stapling?

Subsidiary question: is multi stapling supported by browsers?
I guess so because it is common to have a hierarchy of CAs in the internet world but I would like to have more details.

Thank you very much.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.