ocserv with StartSSL server and client certificate

[Michael Köhler]

Hi,

I want to get ocserv with certificates from StartSSL running but it doesn´t work.
The special thing with StartSSL is that they use Sub-CAs for signing server and client certificates. So I´ve a server certificate from sub.class2.server.ca.pem and client certificates from sub.class1.server.ca.pem and sub.class2.server.ca.pem. So what should I do to get ocserv running?

I´ve created a server certificate with certificate chain inside (cat server.pem sub.class2.server.ca.pem ca.pem > /etc/ocserv/ssl/server-chain-cert.pem) and the config settings:

	server-cert = /etc/ocserv/ssl/server-chain-cert.pem
	server-key = /etc/ocserv/ssl/server-key.pem

Then I created a CA chain certificate for all client certificates with sub.class1.server.ca.pem (cat sub.class1.server.ca.pem ca.pem > /etc/ocserv/ssl/ca-sub1-chain-cert.pem).

	ca-cert = /etc/ocserv/ssl/ca-sub1-chain-cert.pem

But now I don´t know how I could enable the login access for individual user with certificate from sub.class1.server.ca.pem? And how could I include client certificates from sub.class2.server.ca.pem?

Anybody got an idea how I could solve the problem?!

Thanks,
Michael