<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class="">Hello,</span></div><div class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class="">We are developing a custom service that uses TLS certificates. Clients connect to that service and must present their client certificate. The client certificates are signed by a CA managed by our service. Our service's CA cert is in turn signed by a root cert,</span><wbr style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; -webkit-font-smoothing: subpixel-antialiased !important;" class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class=""> and not self signed. We do not want to require the clients to hold the services intermediate cert,</span><wbr style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; -webkit-font-smoothing: subpixel-antialiased !important;" class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class=""> and so they connect just presenting their own client certificate. However,</span><wbr style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; -webkit-font-smoothing: subpixel-antialiased !important;" class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class=""> the erlang SSL application does not seem to allow for this setup. It seems to require that to verify the client certificate,</span><wbr style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; -webkit-font-smoothing: subpixel-antialiased !important;" class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class=""> that the service's cert is self signed (ie a root cert) or that the client provide all intermediate certs in the chain. Is there a way to configure the service with the intermediate cert as the ca,</span><wbr style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; -webkit-font-smoothing: subpixel-antialiased !important;" class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class=""> and not require the client to also send it as part of the chain?</span><div class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class="">Thanks,</span></div><div class=""><span style="color: rgb(51, 51, 51); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; white-space: pre-wrap; background-color: rgb(255, 255, 255);" class="">Erik</span></div></body></html>