title: Does Apache needs to know about intermediate certificates for client authentication?
body: <p>I have a following hierarchy of certificates. And I need to do a client authentication on Apache.</p>
  
  <pre><code>.
  └── root (CA) - self signed
      ├── intermediate 1 (CA)
      |   ├── client1
      |   ├── client2
      └── intermediate 2 (CA)
          ├── client3
          └── client4
  </code></pre>
  
  <p>Who should store intermediate certificates (a client or a server)?</p>
  
  <p>I would prefer to store just a root CA on the server to validate all client certs against it. The main reason is that list of intermediate CA's can grow and I don't want to update all the time certs stored in Apache configuration.</p>
  
  <p>Is this technically feasible? Does SSL protocol requests clients to send the whole chain?</p>
  
  <p>One thought on this subject. As I understand when a client authenticates a server then the server sends the whole chain to the client. I hope that it's symmetrical and when the server needs to authenticate the client, it's the client responsibility to send the whole chain.</p>