受信任的根 CA 是否应该成为证书链的一部分？
Should the trusted Root CA be a part of the certificate chain?
我正在不同主机上的服务之间设置双向 SSL 通信。假设我有自己的 CA，称为 A。A 通过集中式 jks 受到我所有服务的信任。现在假设我有 A 签名的证书 B。当服务发送证书时，他们应该发送整个链 B - A，还是只发送 B？我相信两者都适用于大多数实现。
我试图在网上查找有关此内容的规范信息，但一无所获。
感谢帮助
受信任的根 CA 背后的理念是它是受信任的。您是否希望浏览器仅因为包含根 CA 就信任服务器发送的任何内容？不！
因此根 CA 必须已经在客户端并且必须在那里被信任。它不应该被服务器包含在证书链中，但是如果你这样做，浏览器会简单地忽略它。
the server should send the exact chain that is to be used; the server
is explicitly allowed to omit the root CA, but that's all.
参考（RFC 5246 - TLS v1.2, sec. 7.4.2. - Server Certificate）：
certificate_list
This is a sequence (chain) of certificates. The sender's
certificate MUST come first in the list. Each following certificate
MUST directly certify the one preceding it. Because certificate
validation requires that root keys be distributed independently, the
self-signed certificate that specifies the root certificate
authority MAY be omitted from the chain, under the assumption that
the remote end must already possess it in order to validate it in
any case.
我正在不同主机上的服务之间设置双向 SSL 通信。假设我有自己的 CA，称为 A。A 通过集中式 jks 受到我所有服务的信任。现在假设我有 A 签名的证书 B。当服务发送证书时，他们应该发送整个链 B - A，还是只发送 B？我相信两者都适用于大多数实现。
我试图在网上查找有关此内容的规范信息，但一无所获。
感谢帮助
受信任的根 CA 背后的理念是它是受信任的。您是否希望浏览器仅因为包含根 CA 就信任服务器发送的任何内容？不！
因此根 CA 必须已经在客户端并且必须在那里被信任。它不应该被服务器包含在证书链中，但是如果你这样做，浏览器会简单地忽略它。
the server should send the exact chain that is to be used; the server is explicitly allowed to omit the root CA, but that's all.
参考（RFC 5246 - TLS v1.2, sec. 7.4.2. - Server Certificate）：
certificate_list
This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority MAY be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.