I've been working on making an SSL server/client on C++ using Boost. To load the certificates, I use the following code for each side:
server.cpp
boost::asio::ssl::context ssl_context(boost::asio::ssl::context::tls);
ssl_context.use_certificate_chain_file("server.crt");
ssl_context.use_private_key_file("server.key", boost::asio::ssl::context::pem);
ssl_context.use_tmp_dh_file("dh2048.pem");
client.cpp
boost::asio::ssl::context ssl_context(boost::asio::ssl::context::tls);
ssl_context.set_verify_mode(boost::asio::ssl::verify_peer);
ssl_context.load_verify_file("server.crt");
If I don't add the ssl_context.load_verify_file("server.crt");
line on the client, I get the following errors from both sides during SSL handshake:
server: handshake: tlsv1 alert unknown ca
client: handshake: certificate verify failed
So, is it safe to distribute the "server.crt" certificate chain file with the client? If not, how should this be done instead?