5.1 Identity Certificate Chaining

In the dds.sec.auth.identity_certificate property (see Table 5.2 DDS Security Properties for Configuring Authentication), you may put a chain of certificates in the Identity Certificate by concatenating individual certificates and specifying the concatenated result as a single file or string. The Identity Certificate will be verified against the Identity CA using the following procedure; see Figure 5.1: Identity Certificate Chaining:

• The current certificate is the first certificate in the Identity Certificate chain.
• Perform the following steps up to and including the case when the current certificate is the last certificate in the Identity Certificate chain:
• If the current certificate is signed by the Identity CA or any of the CAs in the list of authentication.alternative_ca_files, then the verification succeeds immediately.
• Otherwise:
• If a next certificate exists in the chain and the current certificate is signed by that next certificate, then the next certificate becomes the current certificate.
• Otherwise, verification fails immediately.

Figure 5.1: Identity Certificate Chaining

© 2020 RTI