title: SSLCACertificatePath in httpd
body: <p>I am trying to use the SSLCACertificatePath directive in httpd to point to a collection of roots and intermediates for client certificate validation. </p>
  
  <p>I am able to use a full, concatenated PEM-encoded file without any difficulty (using the SSLCACertificateFile directive), but I would prefer to be able to point to a directory rather than building one massive file.</p>
  
  <p>I have followed the instructions in the httpd manual (and <a href="http://mail-archives.apache.org/mod_mbox/httpd-users/201107.mbox/%3C4E263151.6080208@catseye.org%3E" rel="noreferrer">documented here</a>) including making hashes of all the files as follows:</p>
  
  <ol>
  <li>Took my giant pem file and split out all the individual certificates (about 40 or so) using an <code>awk</code> command</li>
  <li><p>For each pem file, ran:</p>
  
  <pre><code>openssl x509 -noout -hash -in NAME-OF-CA-FILE
  </code></pre>
  
  <p>to get the hash</p></li>
  <li>Created sym links to the pem files named HASH.X (like fa0db041.0, fa0db041.1, etc.)</li>
  </ol>
  
  <p>When I point httpd to that directory, I end up getting the following errors when I attempt to do client certificate validation:</p>
  
  <pre><code>AH02039: Certificate Verification: Error (20): unable to get local issuer certificate
  AH02039: Certificate Verification: Error (19): self signed certificate in certificate chain
  </code></pre>
  
  <p>So it's like it isn't finding the intermediates and roots.</p>
  
  <p>Again, this all works when using the combined PEM.</p>
  
  <p>Any advice?</p>