如何在双向 TLS/gRPC 中包含颁发/中间 CA 证书

Question

I am working in C++ adopting mTLS for communication in a peer network. I have a private root CA and one issuing CA. The gRPC server struct for a secure TLS channel looks as follows:

 struct SslServerCredentialsOptions {
   explicit SslServerCredentialsOptions(
       grpc_ssl_client_certificate_request_type request_type)
       : force_client_auth(false), client_certificate_request(request_type) {}
  
   struct PemKeyCertPair {
     std::string private_key;
     std::string cert_chain;
   };
   std::string pem_root_certs;
   std::vector<PemKeyCertPair> pem_key_cert_pairs;
  
   grpc_ssl_client_certificate_request_type client_certificate_request;
 };

All peers have key pairs signed by the issuing CA. The issuing CA cert is signed by the root CA.

My question: where does the issuing CA certificate go?

1. Do I append it to pem_root_certs or:
2. Append to cert_chain ?

Follow on: when the issuing CA cert/key is rotated and I need to handle a peer that may have 1 of 2 possible issuing CA certs active - where does that go?

Thanks!!

Answer 1

I think it should be appended to cert_chain .

For the follow-up, from a client (or server)'s perspective, it does not matter which issuing CA cert is used for the peer's cert because in both cases, the peer's cert will be chained up to the root CA cert.