避免客户端需要CAfile

我正在尝试configuration我的apache，它提供所有的证书文件，以得到一个积极的validation。
要清楚的是没有任何浏览器的问题，我正在谈论openssl s_client和curl 。

以openssl s_client为例，运行如下：

 CONNECTED(00000003) depth=1 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN = StartCom Class 1 Primary Intermediate Server CA verify error:num=20:unable to get local issuer certificate verify return:0 --- Certificate chain 0 s:/C=DE/CN=xxx i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA 1 s:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority --- Server certificate ... subject=/C=DE/CN=xxx issuer=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA --- No client certificate CA names sent --- SSL handshake has read 4602 bytes and written 518 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : DHE-RSA-AES256-GCM-SHA384 Session-ID: C45A306052F9815DF5ED7CDC7B6AD21FE4E54AC47A7B51BF3BF433748DECB318 Session-ID-ctx: Master-Key: 8396742DE006FC8CEAEDE280B2CD839D0575D1FAD51498C855825BED82D484CC28F8F1D9F549512F08182FCD3BFF3FCD Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 67 85 0d a9 99 68 b2 cc-d6 fb a6 8f ee ba 67 4f g....h........gO 0010 - 09 c1 e9 a3 1d 3e a0 49-96 54 7f df cf 0d fb ef .....>.IT..... 0020 - 57 3c c3 b4 8b e2 d9 b2-c1 92 db c7 c1 0c 3f 4b W<............?K 0030 - 1c 3b 14 f4 bf 8d 94 09-7f 00 f7 20 9a 2b 6f f0 .;......... .+o. 0040 - 34 48 d2 68 a5 e5 a0 58-3c 84 8b aa 3b 9a 27 27 4H.h...X<...;.'' 0050 - 16 4b cd 3d cb 74 40 b8-08 96 a4 95 52 86 f4 aa [email protected]... 0060 - d9 38 fb 9f 3f fc a8 ab-b9 c9 72 20 cd 3c 75 06 .8..?.....r .<u. 0070 - 2e b6 81 df bb e1 a6 b7-f4 bb 52 e1 8c ba 20 42 ..........R... B 0080 - e5 db 5c 48 cd 30 d6 f2-23 24 c6 be 6c 23 09 fa ..\H.0..#$..l#.. 0090 - 9a cf 44 78 13 e7 f6 3e-7d c1 4e e3 1f 81 08 46 ..Dx...>}.N....F 00a0 - 49 3c 0e 80 00 d4 f5 f1-ad 95 99 9d 6f 33 e9 62 I<..........o3.b 00b0 - b2 82 14 a2 5d 82 95 49-88 8c 54 e2 d4 64 a6 1d ....]..I..T..d.. 00c0 - e0 0f 75 88 57 ec 9a 81-41 0c 7b 71 81 8a 93 34 ..uW..A.{q...4 Start Time: 1411561048 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) --- closed 

我的Apacheconfiguration如下所示：

 SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM SSLCertificateFile /etc/apache2/ssl/....cert.pem SSLCertificateKeyFile /etc/apache2/ssl/....key.pem SSLCertificateChainFile /etc/apache2/ssl/sub.class1.server.ca.pem 

我也尝试使用ca-bundle.pem作为SSLCertificateChainFile和/或SSLCACertificateFile 。
第二个结果是19（证书链中的自签名证书） 。

• httpd始终保持启动本身，cpu负载非常高
• 几分钟后，什么东西吃我的硬盘上的VPS服务器？
• APACHE2：如何为请求的特定目录写入日志？
• IP作为访问控制的一种方法？ （IP欺骗的可能性）
• 在Vagrant框中，Apache虚拟主机被忽略

我如何configurationapache来提供“正确的”CA文件以绕过在客户端上安装CA证书？

哪里不对？

感谢任何提示。