<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Interesting. That entails I trust an intermediate in my certificate chain for connections from peers, which on the face of it doesn't seem correct, as it widens the collection of trusted peers unnecessarily. Couldn't there be cases where you only want to trust peers from a certain CA (e.g., an issuing authority that is strictly below your own issuer), but not your own issuer? <div class=""><br class=""></div><div class="">E.g., something like<br class=""><div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><font face="Menlo" class="">CA</font></div><div class=""><font face="Menlo" class="">+- ICA1</font></div><div class=""><font face="Menlo" class=""> +- server</font></div><div class=""><font face="Menlo" class=""> +- ICA2</font></div><div class=""><font face="Menlo" class=""> +- client</font></div></blockquote><div class=""><br class=""></div><div class="">but where you only want to accept connections from ICA2.</div><div class=""><br class=""></div><div class="">(I don't have this particular problem, but it does come to mind.)</div><div class=""><br class=""></div><div class="">Semantically it's a little strange, too, but that can always be fixed with documentation.<div class=""><div class=""><br class=""></div><div class="">Is this because the implementation depends on OpenSSL, or just the design? If the latter, I would suspect that changing the behavior to specify own certificate chains outside of the trust store would introduce nontrivial upgrade issues for existing users, unwitting, or otherwise.</div><div class=""><br class=""></div><div class=""><div class="">-Fred<br class=""><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 18, 2018, at 5:58 PM, Ingela Andin <<a href="mailto:ingela.andin@gmail.com" class="">ingela.andin@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="gmail_extra" style="font-family: Verdana; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">All intermediate CA:s should be placed in the cacertfile option together with trusted ROOT certs, this way of configuring has been inherited from OpenSSL.</div><br class="Apple-interchange-newline"></div></blockquote></div><br class=""></div></div></div></div></div></div></body></html>