Simple OpenVPN Setup with SSL Authentication.
SSL-Setup: Root-CA > Intermediate-CA > Issuing-CA
All certificates (vpn-server and -clients) are issued by the "Issuing-CA".
I tried to use the certificate of the Issuing-CA as OpenVPN ca ca.pem parameter in the openvpn (server- and client-) config.
This did not work.
I had to add the complete certificate chain to the ca.pem.
Then it worked.
I thought the ca parameter specifies trusted CAs. I do not want to include the whole certificate chain since I do not see the necessity for this! Contrary - this seems dangerous to me - since the Root-CA and the Intermediate CA can issue certificates for CNs that are used in the VPN! I would classify this as a security risk.
Is there a way to set a trust anchor to a non-root-CA?
0 Answers