This is something people seem to get confused about quite often. A root.crt
file is used to validate a TLS (a.k.a. SSL) certificate presented by the other end of a connection. It is usually the public certificate of the Certificate Authority (CA) that signed the presented certificate, and is used to validate that signature. If a non-root CA was used to sign the other end’s TLS certificate, the root.crt
file must contain at least the root of the CA chain, and enough other elements of the chain that together with the certificate can connect the root to the signing CA.
In the simple and most common case where client certificates are not being used, only the client needs a root.crt
file, to validate the server’s TLS certificate, if using 'verify-ca'
or 'verify-full'
ssl mode. The server doesn’t need and can’t use a root.crt
file when client certificates are not being used.
On the other hand, if you are using client certificates, the server will also need a root.crt
file to validate the client certificates. There is no requirement that same root.crt
be used for both sides. It would be perfectly possible for the server’s certificate to be signed by one CA and the client certificates by another.
If more than one CA is used in a certain context, i.e. if the client connects to servers with certificates signed by more than one CA, or of the server accepts connections from clients with certificates signed by more than one CA, then the certificates of all the CAs can be placed in the root.crt
file, one after the other. The connection will succeed as long as one of the certificates (or certificate chains) in the file is that of the relevant signing authority.