I am very interested in setting up multi stapling and I can not find a lot of documentation on it, or in any case, recent information.
I have a certificate authority (CA) and a root CA above. They work with the Freeipa tool (and Freeipa uses Dogtag). I have a https server too.
The root CA issues a certificate for the subordinate CA. The subordinate CA issues a certificate for the https server. This server delivers the service for an external client. I would like the client to check the validity of all certificates using ocsp stapling.
In my https server I have added the lines following in
SSLUseStapling on SSLStaplingCache shmcb:/run/httpd/sslcache(512000)
It works with single stapling; the client can check the certificate for the first CA. I would like the client to check the validity of all certificates.
I suppose it is not enough to add the certificate of the all CAs to the ssl.conf file of the https server. And the https server must issue a certificate with the urls of both CAs written in the field Authority information access.
Concretely what should I add to simple stapling? And how to check that it works? Does Freeipa/Dogtag support multi stapling?
Subsidiary question: is multi stapling supported by browsers?
I guess so because it is common to have a hierarchy of CAs in the internet world but I would like to have more details.
Thank you very much.