Security

Clarification of Public CA Certificate from a Certificate Chain/Intermediate

Path Finder

I am following the directions in "Community:Splunk2Splunk_SSL_3rdPartyCA" and for the most part it is fairly easy to follow.

I would like, however, to get clarification on the term "myCAPublicCertificate.pem".

Our enterprises' Certificate Authority provides 2 intermediate CA's plus a Root CA. For purposes here I will call them intermediateCA1.pem, intermediateCA2.pem and rootCA.pem; in order of hierarchy.

In the instructions it talks about copying "the" myCAPublicCertificate.pem to our certificate directory, and adding rootCA paths to "the" myCAPublicCertificate.pem in the certificate directory; to what does the "myCAPublicCertificate.pem" refer to?

  1. The rootCA.pem only
  2. intermediateCA1.pem only (since its the first one in hierarchy)
  3. A concatenated Public CA (#cat intermediateCA1.pem intermediateCA2.pem rootCA.pem > myCAPublicCertificate.pem)
1 Solution

SplunkTrust
SplunkTrust

I've not done this with Splunk but based on past experience with how OpenSSL (and other SSL stacks) handle this, all the clients need is the (actual) root cert. It is up to the server to provide the rest of the chain from the server's cert itself and the necessary intermediates. So your myCAPublicCertificate.pem should only have the root cert in it. But, as the doc says, make sure the server cert, intermediates, and root are all in the server's myServerCertificate.pem file.

From that doc:

IMPORTANT : If there is a certificate chain involved, the public certificates that constitute that chain should be listed in the PEM file in decreasing order of hierarchy right after the server private key. The chain should end with the certificate authority public key, sometimes referred to as the root certificate. 

View solution in original post

SplunkTrust
SplunkTrust

I've not done this with Splunk but based on past experience with how OpenSSL (and other SSL stacks) handle this, all the clients need is the (actual) root cert. It is up to the server to provide the rest of the chain from the server's cert itself and the necessary intermediates. So your myCAPublicCertificate.pem should only have the root cert in it. But, as the doc says, make sure the server cert, intermediates, and root are all in the server's myServerCertificate.pem file.

From that doc:

IMPORTANT : If there is a certificate chain involved, the public certificates that constitute that chain should be listed in the PEM file in decreasing order of hierarchy right after the server private key. The chain should end with the certificate authority public key, sometimes referred to as the root certificate. 

View solution in original post

Path Finder

Awesome, thanks. Verified. I think I had read that so many times that I missed the inference ... over-thinking it.

0 Karma