Configuring a Web server CA certificate chain

You can add a certificate chain to an Apache Web server. This establishes a chain of trust for a server SSL certificate by providing signing certificate authority (CA) certificates to the Web browsers running the Web UI.

You cannot use a self-signed certificate with a CA certificate chain; the Web server certificate must be issued by a public or private CA. If it was issued by a private CA, you must add the private CA's root certificate to your employees' Web browsers.

The individual server certificate cannot be included in the chain; the root CA certificate is optional. You must bundle the certificates in order: first, the intermediate CA that issued the Web server endpoint certificate being certified, then the other intermediate CAs, and finally the root CA certificate, if it is included.

Each intermediate certificate obtains its authority from the next CA in the chain. Each certificate in the chain is validated to make sure the parent-to-child progression is correct. Although trust is established within the chain, the certificates in the chain are not automatically verified and trusted by the system. You can optionally verify them as described in Manually verifying certificates.

You can include a comment string with information such as the domain and expiration date. The comment is replicated in the comment field of each member certificate.