Difference Between SSLCACertificateFile and SSLCertificateChainFile

Question

I provide SSL pages on my web server, and I have a question. What is the difference between SSLCACertificateFile and SSLCertificateChainFile?

When I use SSLCertificateCh

Answer 1

Actually, both may be valid options.

Use SSLCertificateChainFile to publish your certificate signed by public certificate authority (VeriSign, RapidSSL, etc.)

Use SSLCACertificateFile to provide your 'private' CA, that can issue client certificates, that you can distribute to some selected users. These client certificates are actually great for authentication (compared with the basic password authentication), and typically are not required to be distributed by a public CA (hence you can save some money).

So, if you want to add secure authorization to some portion of your web site, do this:

<Directory /var/www/html/authorized>
  SSLVerifyClient require
  SSLVerifyDepth  5

  SSLOptions +StrictRequire
  SSLUserName SSL_CLIENT_S_DN_CN
  SSLRequireSSL
</Directory>

Just for short explanation SSLUserName SSL_CLIENT_S_DN_CN will set the authenticated user name to certificate's CommonName, versus the whole x509 '/OU=Foo/CN=...' subject.

Answer 2

SSLCertificateChainFile was a correct option to choose but this directive became obsolete as of Apache 2.4.8. This directive caused the listed file to be sent along with the certificate to any clients that connect.

SSLCACertificateFile (hereafter "CACert") supersedes SSLCertificateChainFile (hereafter "Chain"), and additionally permits the use of the cert in question to sign client certificates. This sort of authentication is quite rare (at least for the moment), and if you aren't using it, there's IMHO no reason to augment its functionality by using CACert instead of Chain. On the flipside, one could argue that there's no harm in the additional functionality, and CACert covers all cases. Both arguments are valid.

Needless to say, if you ask the cert vendor, they'll always push for CACert over Chain, since it gives them another thing (client certs) that they can potentially sell you down the line. ;)