I am trying to secure three of four virtual hostnames on our Apache server.
We are not taking credit card orders or user's personal information, but are
merely hoping to secure email and calendar web transactions for our users.
We are not running any secure applications on the root host.
I have been testing this week with CA, client, and host certificate
requests, certificates, and keys, and think I have a fairly good beginner's
grasp of the commands and command line options.
My questions are:
1.  Is it necessary to create a CA certificate for each of the secure
virtual hosts, or can one CA certificate for the root be used to sign each
of the keys for all three common names we are trying to secure?
2.  Even though the root host is not conducting secure transactions, am I
correct in configuring the server with a CACertificateFile in the main body
of httpsd.conf and then setting the CACertificateFile for each virtual host
in the <Virtual . . .> section of httpsd.conf?  This sort of assumes the
answer to 1. is  - you need a CA for each virtual host.
3.  Is it necessary to create a client certificate to distribute to our
users, or is it sufficient to have the CA certificate and a server
certificate for the virtual hosts?  Wouldn't a client certificate only be
necessary if we were trying to verify the client's identity?  Would that be
a good idea given our scenario?
Thanks in advance for your help.
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
User Support Mailing List                    openssl-users@openssl.org
Automated List Manager                           majordomo@openssl.org

from localhost (localhost [127.0.0.1])
	by phobos.labs.spamassassin.taint.org (Postfix) with ESMTP id A7FD7454F6
	for <zzzz@localhost>; Thu, 22 Aug 2002 08:27:38 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for zzzz@localhost (single-drop); Thu, 22 Aug 2002 13:27:38 +0100 (IST)
from lugh.tuatha.org (root@lugh.tuatha.org [194.125.145.45]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g7MCJiZ06043 for
    <zzzz-ilug@jmason.org>; Thu, 22 Aug 2002 13:19:44 +0100
from lugh (root@localhost [127.0.0.1]) by lugh.tuatha.org
    (8.9.3/8.9.3) with ESMTP id NAA29323; Thu, 22 Aug 2002 13:18:52 +0100
from email.qves.com ([67.104.83.251]) by lugh.tuatha.org
    (8.9.3/8.9.3) with ESMTP id NAA29282 for <ilug@linux.ie>; Thu,
    22 Aug 2002 13:18:37 +0100
lugh.tuatha.org: Host [67.104.83.251] claimed to
    be email.qves.com
[ILUG] Guaranteed to lose 10-12 lbs in 30 days 10.206
From ilug-admin@linux.ie  Thu Aug 22 13:27:39 2002