# Ssl\_client\_certificate set to a certificate chain?

**URL:** <https://www.ruby-forum.com/t/ssl-client-certificate-set-to-a-certificate-chain/219890>\
**Category:** NGINX\
**Created:** [May 21, 2012, 4:32am UTC](https://www.ruby-forum.com/t/ssl-client-certificate-set-to-a-certificate-chain/219890 "2012-05-21T04:32:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [May 21, 2012, 4:32am UTC](https://www.ruby-forum.com/t/ssl-client-certificate-set-to-a-certificate-chain/219890/1 "2012-05-21T04:32:17Z")

</div>

Hi,  
I fall into this situation: one root CA issued two intermediate CAs,  
one for merchants and another for payment gateways. I set  
ssl\_client\_certificate to intermediate CA of payment gateways, client  
cannot verify itself. I guess it’s because ssl\_client\_certificate is  
not set to a self-signed root CA. So, I changed that parameter to the  
root CA, it works.

## But, theoretically another merchant could connect to my server with it’s certificate signed by merchants intermediate CA. How can I avoid this? I set the parameter to a certificate chain of root CA and payment gateways’s intermediate CA, and tried openssl s\_client -connect server:8443 , openssl says:

Acceptable client certificate CA names  
/CN=UP\_ROOT\_CA  
/CN=UP\_CA

## I don’t know the server would accept a certificate issued by UP\_ROOT\_CA and UP\_CA, or issued by UP\_ROOT\_CA or UP\_CA.

Ren Xiaolei