花了一些时间尝试使用CA来计算客户端SSL证书，但没有运气。 当我创build一个自签名客户端证书并configurationapache（2.2.15）它一切正常，但是当我使用购买的CA证书，它不起作用。 以下是我迄今为止所做的。
Self signed root CA: #Create root cert and key openssl req -newkey rsa:2048 -nodes -keyform PEM -keyout ca.key -x509 -days 3650 -outform PEM -out ca.cer #create client CSR openssl genrsa -out client.key 2048 openssl req -new -key client.key -out client.req #Sign csr with root key openssl x509 -req -in client.req -CA ca.cer -CAkey ca.key -days 1095 -outform PEM -out client.cer -CAcreateserial -CAserial serial.seq #convert to pem openssl pkcs12 -export -inkey client.key -in client.cer -out client.p12 openssl pkcs12 -in client.p12 -out client.pem -clcerts #Apache config SSLVerifyClient require SSLVerifyDepth 1 SSLCACertificateFile /etc/httpd/certs/ca.cer SSLCertificateFile /etc/httpd/certs/xxx.crt SSLCertificateKeyFile /etc/httpd/certs/xxx.key SSLCertificateChainFile /etc/httpd/certs/xxx.bundle.crt #test echo "" |openssl s_client -connect <test-domain>:443 -cert <path tocert>/client.pem | openssl x509 -noout -dates Enter pass phrase for /home/david/ssl-cert/CA/2nd/client.pem: depth=3 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority verify return:1 depth=2 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Root Certificate Authority - G2 verify return:1 depth=1 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2 verify return:1 depth=0 OU = Domain Control Validated, CN = *.xxx.com verify return:1 DONE notBefore=Apr 22 17:37:39 2016 GMT notAfter=Apr 22 17:37:39 2019 GMT 在从GoDaddy收到的zip文件中，有两个文件： xxx.crt: issued cert for my domain ＆ gd_bundle_g2-g1.crt intermediate and root cert bundle xxx.crt: issued cert for my domain 。 我尝试使用xxx.crt签署client.cer并将SSLCACertificateFile指向该文件，但testing失败
verify return:1 140519333410720:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:s3_pkt.c:1493:SSL alert number 48 140519333410720:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
而在Apache日志中，您可以看到错误Certificate Verification: Error (20): unable to get local issuer certificate
直接使用gd_bundle_g2-g1.crt不起作用，因为我对这个域的密钥不匹配。 如果我把这个文件与ssl证书结合起来，我可以签署它，但最终结果与testing是一样的。 所以问题是，我如何与已经从GoDaddy购买的软件包签订客户端证书？