Different server and client CAs

varnav

Hello!

Manual says:

Sign server certificates with one CA and client certificates
with a different CA. The client config "ca" directive should
reference the server-signing CA while the server config "ca"
directive should reference the client-signing CA.

What is the best way to accomplish this?
What are drawbacks of using the same CA?

Pippin

What are drawbacks of using the same CA?

Imagine it gets compromised.

Manual says:

To avoid a possible Man-in-the-Middle attack where an authorized
client tries to connect to another client by impersonating the
server, make sure to enforce some kind of server certificate
verification by clients. There are currently four different ways
of accomplishing this

Traffic

varnav wroteManual says:

Quote:
Sign server certificates with one CA and client certificates
with a different CA.

Just curious .. where does it say this .. URL is ?

Pippin

To satisfy curiosity (-:
https://openvpn.net/index.php/open-source/documentation/miscellaneous/77-rsa-key-management.html

IMPORTANT

To avoid a possible Man-in-the-Middle attack where an authorized
client tries to connect to another client by impersonating the
server, make sure to enforce some kind of server certificate
verification by clients. There are currently four different ways
of accomplishing this, listed in the order of preference:

(1) ..........
(2) ..........
(3) ..........
(4) Sign server certificates with one CA and client certificates
with a different CA. The client config "ca" directive should
reference the server-signing CA while the server config "ca"
directive should reference the client-signing CA

Traffic

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Pippin

Welcome, I use 1, 2, 3 too.