Restrict server trust to specific sub-ca?

rcrcrcr

In the case of client certificates that are signed with a sub-CA, I am unclear as how how to restrict the server to trust only certificates from that specific sub-CA, and not any certificates signed by a different sub-CA under the same root CA.

ie: a root CA with two sub-CAs:

Root CA -->
* Sub-CA 1
* Sub-CA 2

In this case, how do I _only_ allow certs signed by Sub-CA 1?

If I use the root CA certificate for the "ca" on the server, then certs from either sub-ca are authorized, as long as the client includes its sub-ca's cert in the chain.

If I chain the sub-CA 1 and root certs together as "ca" on the server, then certs from sub-ca 1 are authorized without the client's need to include sub-ca 1's cert in the chain, BUT certs from sub-ca 2 are sill also authorized as long as clients include the sub-ca 2cert in the chain.

If I use only the sub-CA 1 certificate for "ca" on the server, then all certs fail.

What am I missing?

Thanks.

Traffic

Please see this:
https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains

rcrcrcr

Thanks, I had actually consulted that doc in advance of posting this thread. I don't believe it addresses the case of restricting access to other certs signed by other sub-ca's off of the same root.

However, in rereading the general OpenVPN documentation, I did find "verify-hash", what I believe is exactly what I was looking for, and works as expected in tests:

--verify-hash hash
Specify SHA1 fingerprint for level-1 cert. The level-1 cert is the CA (or intermediate cert) that signs the leaf certificate, and is one removed from the leaf certificate in the direction of the root. When accepting a connection from a peer, the level-1 cert fingerprint must match hash or certificate verification will fail. Hash is specified as XX:XX:... For example: AD:B0:95:D8:09:C8:36:45:12:A9:89:C8:90:09:CB:13:72:A6:AD:16