Clarification of Public CA Certificate from a Certificate Chain/Intermediate

[jason_hubbard]

I am following the directions in "Community:Splunk2Splunk_SSL_3rdPartyCA" and for the most part it is fairly easy to follow.

I would like, however, to get clarification on the term "myCAPublicCertificate.pem".

Our enterprises' Certificate Authority provides 2 intermediate CA's plus a Root CA. For purposes here I will call them intermediateCA1.pem, intermediateCA2.pem and rootCA.pem; in order of hierarchy.

In the instructions it talks about copying "the" myCAPublicCertificate.pem to our certificate directory, and adding rootCA paths to "the" myCAPublicCertificate.pem in the certificate directory; to what does the "myCAPublicCertificate.pem" refer to?

1. The rootCA.pem only
2. intermediateCA1.pem only (since its the first one in hierarchy)
3. A concatenated Public CA (#cat intermediateCA1.pem intermediateCA2.pem rootCA.pem > myCAPublicCertificate.pem)

[dwaddle · Accepted solution]

I've not done this with Splunk but based on past experience with how OpenSSL (and other SSL stacks) handle this, all the clients need is the (actual) root cert. It is up to the server to provide the rest of the chain from the server's cert itself and the necessary intermediates. So your myCAPublicCertificate.pem should only have the root cert in it. But, as the doc says, make sure the server cert, intermediates, and root are all in the server's myServerCertificate.pem file.

From that doc:

IMPORTANT : If there is a certificate chain involved, the public certificates that constitute that chain should be listed in the PEM file in decreasing order of hierarchy right after the server private key. The chain should end with the certificate authority public key, sometimes referred to as the root certificate. 

[jason_hubbard]

Awesome, thanks. Verified. I think I had read that so many times that I missed the inference ... over-thinking it.