Recently I ran across someone asking the question 'why have a firewall?'As it turned out, he had several sorts of host-based firewall protection,but in thinking about the question I came up with four broad reasons thatfirewalls can be a good idea:

• because your services and servers suck. You're forced to run thingsthat were written by addled monkeys, in environments that eitherrequire random services of unknown and dubious security impactor just start them up every so often whenever they feel like it.

SSL certificates for hosts are usually not directly signed by yourCA's trust root certificate, the certificate that is in your browser,your mail client, or whatever. Instead there is generally at least oneintermediate certificate (sometimes several), and in order for clientsto accept your host certificate you need to send them not just the hostcertificate but also all of the intermediate certificates in the chainof signatures between you and the CA trust root.

How you configure this depends on the server software, with two general