Forum Discussion
smp_86112
Cirrostratus
CirrostratusManaging SSL Certificate Bundles
We are about changing SSL vendors, and it appears their root is already in the build-in "ca-bundle". However, their intermediates are not. I wanted to get some feedback on the right way to manage thes...
Hamish
Cirrocumulus
CirrocumulusOh... On an earlier question. You never include the root cert. it just wouldnt add any information.
Because the trust of a site cert is a chain, the chain needs to lead to a cert somewherevthat the browser does trust. Including the root in the chain presented by the server is redundent. Because if the client doesnt have it already, it wont trust the chain anyway. And if it does have the root, you dont need to include it...
H