5.1 Identity Certificate Chaining
In the dds.sec.auth.identity_certificate property (see Table 5.2 DDS Security Properties for Configuring Authentication), you may put a chain of certificates in the Identity Certificate by concatenating individual certificates and specifying the concatenated result as a single file or string. The Identity Certificate will be verified against the Identity CA using the following procedure; see Figure 5.1: Identity Certificate Chaining:
- The current certificate is the first certificate in the Identity Certificate chain.
- Perform the following steps up to and including the case when the current certificate is the last certificate in the Identity Certificate chain:
- If the current certificate is signed by the Identity CA or any of the CAs in the list of authentication.alternative_ca_files, then the verification succeeds immediately.
- Otherwise:
- If a next certificate exists in the chain and the current certificate is signed by that next certificate, then the next certificate becomes the current certificate.
- Otherwise, verification fails immediately.
Figure 5.1: Identity Certificate Chaining
© 2020 RTI