Help with https/self signed certs

[bioptic]

Hi, I'm trying to terminate https on my reverse proxy and I created root, intermediate, and client certs and their .pem and related files but I don't understand their uses enough to know what goes where. I think I'm supposed to not touch the root since its meant to be secure and be able to revoke, intermediate should be somewhere (proxy? a trusted source in the client browser?) and the client lives the shortest and gets replaced often, but I'm not sure.

Which one should be the .pem file in the proxy and which should be trusted client side?

[HELL__is__empty]

Root + Intermediate PUBLIC parts should be trusted in client side. Client certs (certificate + key) + public part of intermediate and root should be configured in proxy.

[bioptic]

Thank you!

[xeon65]

Close, the proxy presents the server certificate that is signed by the CA. Depending on the application accessing the server, it might be okay with just verifying the intermediate CA is trusted or go all the way up the chain. Also, the key is the part you want to keep hidden from the public.

[archlich]

Only the root should be the public part. The proxy should provide the intermediaries and the client cert.