title: 2 Way SSL using Apache - Certificate questions
body: <p>I've been googling like mad trying to figure this out, but the answer doesn't seem to be clear, or at least, it seems like there are contradictory answers.</p>
  
  <p>I'm tasked with setting up an Apache web server with 2Way SSL authentication. We use verisign to get our certificates, so we have a certificate for the web instance with the correct hostname details, signed by verisign, and an intermediate certificate from verisign. This all works very well.</p>
  
  <p>Now, we need to set up a 2Way SSL connection. The initial expectation is that the client will manage their own certificates, and provide them to us for authentication. More than one client may be connecting, and they should each have access to different resources when they connect.</p>
  
  <p>From what I've read, I'm not sure how this would be done... </p>
  
  <p>This is a pretty good overview, but in this situation, they are using self-signed certificates: <a href="https://security.stackexchange.com/questions/34897/configure-ssl-mutual-two-way-authentication">https://security.stackexchange.com/questions/34897/configure-ssl-mutual-two-way-authentication</a> </p>
  
  <p>Using these details, it would seem like we would have to make the trusted CA point to the certificate authority that signs the client's certificate. </p>
  
  <p>Is it possible to use the client certificate as the trusted CA (even though it isn't self signed, but signed by a CA) or would we have to put a trusted CA from their signer (and at that point, would a CA bundle that includes all the client certificate authority CAs work?) on the server and then use the SSLRequire statements to limit access to specific details of the certificate?</p>
  
  <p>As a followup, can we use the SSL Certificate that we get from verisign to sign client certificates?</p>