SSLCACertificateFile 与 SSL證 icateChainFile 的区别

我在我的 Web 服务器上提供 SSL 页面，我有一个问题。 SSLACertificateFile 和 SSL證 icateChainFile 有什么区别？

当我使用 SSL證 icateChainFile 时，我收到来自日本手机浏览器的警告，但是当我使用 PC 浏览器(如 IE，FF)时，没有问题。 另一方面，SSLCACertificateFile 对两种浏览器都没有造成任何问题。

浏览器连接到 apache 时有什么区别吗？

102037 次浏览
小开

SSLCertificateChainFile was a correct option to choose but this directive became obsolete as of Apache 2.4.8. This directive caused the listed file to be sent along with the certificate to any clients that connect.

SSLCACertificateFile (hereafter "CACert") supersedes SSLCertificateChainFile (hereafter "Chain"), and additionally permits the use of the cert in question to sign client certificates. This sort of authentication is quite rare (at least for the moment), and if you aren't using it, there's IMHO no reason to augment its functionality by using CACert instead of Chain. On the flipside, one could argue that there's no harm in the additional functionality, and CACert covers all cases. Both arguments are valid.

Needless to say, if you ask the cert vendor, they'll always push for CACert over Chain, since it gives them another thing (client certs) that they can potentially sell you down the line. ;)

小开

Actually, both may be valid options.

Use SSLCertificateChainFile to publish your certificate signed by public certificate authority (VeriSign, RapidSSL, etc.)

Use SSLCACertificateFile to provide your 'private' CA, that can issue client certificates, that you can distribute to some selected users. These client certificates are actually great for authentication (compared with the basic password authentication), and typically are not required to be distributed by a public CA (hence you can save some money).

So, if you want to add secure authorization to some portion of your web site, do this:

<Directory /var/www/html/authorized>
SSLVerifyClient require
SSLVerifyDepth  5


SSLOptions +StrictRequire
SSLUserName SSL_CLIENT_S_DN_CN
SSLRequireSSL
</Directory>

Just for short explanation SSLUserName SSL_CLIENT_S_DN_CN will set the authenticated user name to certificate's CommonName, versus the whole x509 '/OU=Foo/CN=...' subject.


提交答案