Client Authentication
Good Afternoon Everybody, I am not sure if it is the right forum to ask this question. If not please guide me. mod_ssl provides fabulous mechanism of doing client authentication. It does so by issuing client certificates signed by your own CA certificate ca.crt. How we can use mod_ssl ( with client auth) when we we do not have control on whole community i.e people are using certificates that is signed by different CA.? One way I was thinking was to accumulate public certs ( which may not be CA cert) at one place( directory) and give its path to mod_ssl. However I am not sure if this a good practice or even doable practice. Any input will be highly appreciated. Thank you. rn __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List [email protected]
Re: Can i use CA signed cert to create client authentication certificates ?
Hi, Asking every time does make it complicated. I can't remember if the firefox default is to ask or auto supply (and it has changed behavior between 1/2/3 AFAIK), I have it as ask every time. Anyway the ask every time FF behavior isn't very nice for users (auto supply is probably fine for most users). FF will also ask for a cert every session ID change. As you know there isn't an ask once option, which would be very nice. I don't think there is much that can be done to "fix" it other than coding up an "ask once" option in FF (which I haven't got the time to do :( ). Anyway you may also want to use/need the "SSLOptions +OptRenegotiate" if you have portions of the site that do and don't require client certs. It can help greatly with IE. Sometimes IE goes a little funny and renegotiates sessions all the time going from non-client cert to client cert areas. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Thursday, September 25, 2008 9:37:00 AM Subject: Re: Can i use CA signed cert to create client authentication certificates ? Thank you very much Matt . That solved it :). I now have "Client Certificate Authentication" working with a CA signed certificate and a Self Signed CA which in turn signs client certs. If i can only ask for a bit more advice regarding this setup ?. Although I think this problem might be Firefox specific I'm hoping for some advice here. Internet Explorer handles the client certificates fine, prompts me to select certificate on connection to the site and basically just works after that.. But when Firefox is set to "Ask me every time" instead of "auto select client certificate" I keep getting the select certificate pop up several(multiple) times per page request/load from the SSL secured Apache server. There is only one certificate in the select from dialog, but it keeps prompting me and I can see it loading "one" and "one" item(image) on the website. If i switch to "Auto select certificate" it works. But it would be nice not having the browser present the certificate without it being the users choice. And honestly, choosing it once per session per site should be sufficient I should probably mention that the page served up is behind a mod_proxy module. But this content should not differ for Firefox, and certificate selection. Or does the mod_ssl module prompt for a client certificate for each item loaded ? I have googled this but can't find any good answers. Some say it is because of image objects loading. but why. Best regards Jan Stian Gabrielli Original Message --- Hi, Basically... SSLCACertificateFile SelfSignedCA Root Cert (public part) SSLVerifyClient require or optional SSLVerifyDepth 1 (default) and have the setup from the Thwate cert as per normal for the server cert. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Tuesday, September 23, 2008 1:39:16 PM Subject: Re: Can i use CA signed cert to create client authentication certificates ? Ok. This seems like a viable solution. Ie. I use an approved CA signed cert to verify the site auhtentisity, and i use a selfsigned CA root for client certificates. Can you point me in a direction of how i make this work in apache ?. I already have a setup with a Selfsigned CA working for client certificates. Createed SelfSignedCA |-->Create and Sign Apache Cert from SelfSigned CA |-->Create and Sign Client Cert from SelfSigned CA How do I incorporate this with a CA (thawte) signed webserver certificate ?. Best regards Wizkidnono Original Message --- Sounds like your trying to use the thawte apache cert to sign your client certs? The thawte cert won't have the right attributes to sign a client cert and then try to use it. You could use your CA for client certs and Thawte for the server cert. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Monday, September 22, 2008 7:54:37 PM Subject: Can i use CA signed cert to create client authentication certificates ? I am trying to set up apache with mod_ssl , and I have it working with a Self Signed CA. But i can not get it to work with a cert created by thawte.com. Does anyone know if it is possible to do this with a crt signed by a "third" party where one does not have access to their root ca key ?.. Ie. I have generated a : apache_server.key made a apache_server..csr and sent this for signing by thawte.com Recived a apache_server.crt Created a client.key and a client.csr Signed it with my apache_server.key and apache_server.crt Converted the client.key,crt to a pkcs12 file and imported this into my browser but i can
Re: Can i use CA signed cert to create client authentication certificates ?
Thank you very much Matt . That solved it :). I now have "Client Certificate Authentication" working with a CA signed certificate and a Self Signed CA which in turn signs client certs. If i can only ask for a bit more advice regarding this setup ?. Although I think this problem might be Firefox specific I'm hoping for some advice here. Internet Explorer handles the client certificates fine, prompts me to select certificate on connection to the site and basically just works after that.. But when Firefox is set to "Ask me every time" instead of "auto select client certificate" I keep getting the select certificate pop up several(multiple) times per page request/load from the SSL secured Apache server. There is only one certificate in the select from dialog, but it keeps prompting me and I can see it loading "one" and "one" item(image) on the website. If i switch to "Auto select certificate" it works. But it would be nice not having the browser present the certificate without it being the users choice. And honestly, choosing it once per session per site should be sufficient I should probably mention that the page served up is behind a mod_proxy module. But this content should not differ for Firefox, and certificate selection. Or does the mod_ssl module prompt for a client certificate for each item loaded ? I have googled this but can't find any good answers. Some say it is because of image objects loading. but why. Best regards Jan Stian Gabrielli Original Message --- Hi, Basically... SSLCACertificateFile SelfSignedCA Root Cert (public part) SSLVerifyClient require or optional SSLVerifyDepth 1 (default) and have the setup from the Thwate cert as per normal for the server cert. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Tuesday, September 23, 2008 1:39:16 PM Subject: Re: Can i use CA signed cert to create client authentication certificates ? Ok. This seems like a viable solution. Ie. I use an approved CA signed cert to verify the site auhtentisity, and i use a selfsigned CA root for client certificates. Can you point me in a direction of how i make this work in apache ?. I already have a setup with a Selfsigned CA working for client certificates. Createed SelfSignedCA |-->Create and Sign Apache Cert from SelfSigned CA |-->Create and Sign Client Cert from SelfSigned CA How do I incorporate this with a CA (thawte) signed webserver certificate ?. Best regards Wizkidnono Original Message --- Sounds like your trying to use the thawte apache cert to sign your client certs? The thawte cert won't have the right attributes to sign a client cert and then try to use it. You could use your CA for client certs and Thawte for the server cert. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Monday, September 22, 2008 7:54:37 PM Subject: Can i use CA signed cert to create client authentication certificates ? I am trying to set up apache with mod_ssl , and I have it working with a Self Signed CA. But i can not get it to work with a cert created by thawte.com. Does anyone know if it is possible to do this with a crt signed by a "third" party where one does not have access to their root ca key ?.. Ie. I have generated a : apache_server.key made a apache_server..csr and sent this for signing by thawte.com Recived a apache_server.crt Created a client.key and a client.csr Signed it with my apache_server.key and apache_server.crt Converted the client.key,crt to a pkcs12 file and imported this into my browser but i can not make things work. SSL works fine on the server on pages that does not require SSL client auth. A I stated earlier, IT works when I create and self sign a CA, but I cant make it work when I use a 3rd party CA and only have apache_server.key, apache_server.crt , thawte root cert. Best regards Wizkidnono –œ…â'µêßiÇ ê^�$‹š‡l²\0Âj²Éh®,z´®¦š+´Æ¢–)à .+-š‡l²[¬z»&¡Û,–Šà ëh™«^t¸¬´Æ§j«™¨èÂÚ&¢j²Éh® __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED] –œ…â'µêßiÇ ê^�$‹š‡l²\0Âj²Éh®,z´®¦š+´Æ¢–)à.+-š‡l²[¬z»&¡Û,–Šàëh™«^t¸¬´Æ§j«™¨èÚ&¢j²Éh® __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Can i use CA signed cert to create client authentication certificates ?
Hi, Basically... SSLCACertificateFile SelfSignedCA Root Cert (public part) SSLVerifyClient require or optional SSLVerifyDepth 1 (default) and have the setup from the Thwate cert as per normal for the server cert. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Tuesday, September 23, 2008 1:39:16 PM Subject: Re: Can i use CA signed cert to create client authentication certificates ? Ok. This seems like a viable solution. Ie. I use an approved CA signed cert to verify the site auhtentisity, and i use a selfsigned CA root for client certificates. Can you point me in a direction of how i make this work in apache ?. I already have a setup with a Selfsigned CA working for client certificates. Createed SelfSignedCA |-->Create and Sign Apache Cert from SelfSigned CA |-->Create and Sign Client Cert from SelfSigned CA How do I incorporate this with a CA (thawte) signed webserver certificate ?. Best regards Wizkidnono Original Message --- Sounds like your trying to use the thawte apache cert to sign your client certs? The thawte cert won't have the right attributes to sign a client cert and then try to use it. You could use your CA for client certs and Thawte for the server cert. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Monday, September 22, 2008 7:54:37 PM Subject: Can i use CA signed cert to create client authentication certificates ? I am trying to set up apache with mod_ssl , and I have it working with a Self Signed CA. But i can not get it to work with a cert created by thawte.com. Does anyone know if it is possible to do this with a crt signed by a "third" party where one does not have access to their root ca key ?.. Ie. I have generated a : apache_server.key made a apache_server..csr and sent this for signing by thawte.com Recived a apache_server.crt Created a client.key and a client.csr Signed it with my apache_server.key and apache_server.crt Converted the client.key,crt to a pkcs12 file and imported this into my browser but i can not make things work. SSL works fine on the server on pages that does not require SSL client auth. A I stated earlier, IT works when I create and self sign a CA, but I cant make it work when I use a 3rd party CA and only have apache_server.key, apache_server.crt , thawte root cert. Best regards Wizkidnono –œ…â'µêßiÇ ê^�$‹š‡l²\0Âj²Éh®,z´®¦š+´Æ¢–)à .+-š‡l²[¬z»&¡Û,–Šà ëh™«^t¸¬´Æ§j«™¨èÂÚ&¢j²Éh® __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED] –œ…â'µêßiÇ ê^�$‹š‡l²\0Âj²Éh®,z´®¦š+´Æ¢–)à.+-š‡l²[¬z»&¡Û,–Šàëh™«^t¸¬´Æ§j«™¨èÚ&¢j²Éh® __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Can i use CA signed cert to create client authentication certificates ?
Ok. This seems like a viable solution. Ie. I use an approved CA signed cert to verify the site auhtentisity, and i use a selfsigned CA root for client certificates. Can you point me in a direction of how i make this work in apache ?. I already have a setup with a Selfsigned CA working for client certificates. Createed SelfSignedCA |-->Create and Sign Apache Cert from SelfSigned CA |-->Create and Sign Client Cert from SelfSigned CA How do I incorporate this with a CA (thawte) signed webserver certificate ?. Best regards Wizkidnono Original Message --- Sounds like your trying to use the thawte apache cert to sign your client certs? The thawte cert won't have the right attributes to sign a client cert and then try to use it. You could use your CA for client certs and Thawte for the server cert. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Monday, September 22, 2008 7:54:37 PM Subject: Can i use CA signed cert to create client authentication certificates ? I am trying to set up apache with mod_ssl , and I have it working with a Self Signed CA. But i can not get it to work with a cert created by thawte.com. Does anyone know if it is possible to do this with a crt signed by a "third" party where one does not have access to their root ca key ?.. Ie. I have generated a : apache_server.key made a apache_server..csr and sent this for signing by thawte.com Recived a apache_server.crt Created a client.key and a client.csr Signed it with my apache_server.key and apache_server.crt Converted the client.key,crt to a pkcs12 file and imported this into my browser but i can not make things work. SSL works fine on the server on pages that does not require SSL client auth. A I stated earlier, IT works when I create and self sign a CA, but I cant make it work when I use a 3rd party CA and only have apache_server.key, apache_server.crt , thawte root cert. Best regards Wizkidnono –œ…â'µêßiÇ ê^�$‹š‡l²\0Âj²Éh®,z´®¦š+´Æ¢–)à.+-š‡l²[¬z»&¡Û,–Šàëh™«^t¸¬´Æ§j«™¨èÚ&¢j²Éh® __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED] '���iǭ��^�$���l�\0�j ��h�,z+�Ƣ�)�.+-��l�[�z�&��,����h��^t���Ƨj��&�j ��h�
Re: Can i use CA signed cert to create client authentication certificates ?
Sounds like your trying to use the thawte apache cert to sign your client certs? The thawte cert won't have the right attributes to sign a client cert and then try to use it. You could use your CA for client certs and Thawte for the server cert. Regards Matt - Original Message From: Jan Stian Gabrielli <[EMAIL PROTECTED]> To: [email protected] Sent: Monday, September 22, 2008 7:54:37 PM Subject: Can i use CA signed cert to create client authentication certificates ? I am trying to set up apache with mod_ssl , and I have it working with a Self Signed CA. But i can not get it to work with a cert created by thawte.com. Does anyone know if it is possible to do this with a crt signed by a "third" party where one does not have access to their root ca key ?. Ie. I have generated a : apache_server.key made a apache_server.csr and sent this for signing by thawte.com Recived a apache_server.crt Created a client.key and a client.csr Signed it with my apache_server.key and apache_server.crt Converted the client.key,crt to a pkcs12 file and imported this into my browser but i can not make things work. SSL works fine on the server on pages that does not require SSL client auth. A I stated earlier, IT works when I create and self sign a CA, but I cant make it work when I use a 3rd party CA and only have apache_server.key, apache_server.crt , thawte root cert. Best regards Wizkidnono –œ…â'µêßiÇ ê^�$‹š‡l²\0Âj²Éh®,z´®¦š+´Æ¢–)à.+-š‡l²[¬z»&¡Û,–Šàëh™«^t¸¬´Æ§j«™¨èÚ&¢j²Éh® __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Can i use CA signed cert to create client authentication certificates ?
I am trying to set up apache with mod_ssl , and I have it working with a Self Signed CA. But i can not get it to work with a cert created by thawte.com. Does anyone know if it is possible to do this with a crt signed by a "third" party where one does not have access to their root ca key ?. Ie. I have generated a : apache_server.key made a apache_server.csr and sent this for signing by thawte.com Recived a apache_server.crt Created a client.key and a client.csr Signed it with my apache_server.key and apache_server.crt Converted the client.key,crt to a pkcs12 file and imported this into my browser but i can not make things work. SSL works fine on the server on pages that does not require SSL client auth. A I stated earlier, IT works when I create and self sign a CA, but I cant make it work when I use a 3rd party CA and only have apache_server.key, apache_server.crt , thawte root cert. Best regards Wizkidnono â'µêßiÇ ê^$l²\0Âj ²Éh®,z´®¦+´Æ¢)à.+-l²[¬z»&¡Û,àëh«^t¸¬´Æ§j«¨èÚ&¢j ²Éh®
Re: Client Authentication and Access Control
Øyvin Sømme wrote: Joe Orton wrote: On Fri, Jun 03, 2005 at 08:56:56AM +0200, Øyvin Sømme wrote: Method 2 (SSLRequire): The user-id field is just '-'. Can I somehow configure apache/mod_ssl to only store certain elements of the DN (e.g. the CN in the DN) as the user-id in the access-log? mod_ssl in httpd 2.0 supports the "SSLUsername" directive which allows this: http://httpd.apache.org/docs-2.0/mod/mod_ssl.html#sslusername Regards, joe Thanks for a very good suggestion. Seems to be just what I need. So I tried to use the directive 'SSLUserName SSL_CLIENT_S_DN_CN' inside the context. This resulted in *no* change in my log files, the user-id field was still '-'. Any idea why it didn't work? Regards Øyvin I found out the issue: I cannot use 'SSLOptions +FakeBasicAuth' together with 'SSLUserName xxx' (not documented anywhere). Regards. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication and Access Control
Joe Orton wrote: On Fri, Jun 03, 2005 at 08:56:56AM +0200, Øyvin Sømme wrote: Method 2 (SSLRequire): The user-id field is just '-'. Can I somehow configure apache/mod_ssl to only store certain elements of the DN (e.g. the CN in the DN) as the user-id in the access-log? mod_ssl in httpd 2.0 supports the "SSLUsername" directive which allows this: http://httpd.apache.org/docs-2.0/mod/mod_ssl.html#sslusername Regards, joe __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED] Thanks for a very good suggestion. Seems to be just what I need. So I tried to use the directive 'SSLUserName SSL_CLIENT_S_DN_CN' inside the context. This resulted in *no* change in my log files, the user-id field was still '-'. Any idea why it didn't work? Regards Øyvin __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: SSL client authentication
Am Montag, 13. Juni 2005 09:49 schrieb Charles-Edouard Ruault: > Well to prevent access in http you should place a deny directive in the > http related part of your config file. > > deny from all > > I think this will be the only solution. However the documentation says: This directive forbids access unless HTTP over SSL (i.e. HTTPS) is enabled for the current connection. This is very handy inside the SSL-enabled virtual host or directories for defending against configuration errors that expose stuff that should be protected. When this directive is present all requests are denied which are not using SSL. Theredore I believed it would work without any "deny from" entry Regards Harry __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: SSL client authentication
Harry Knitter wrote:
>Am Samstag, 11. Juni 2005 10:34 schrieb Harry Knitter:
>
>
>>I´m trying to setup a system where the client authentication for a special
>>directory should be done via client certificates. I have set up a CA (using
>>OpenSSL) and the according certificate and key files for the CA the server
>>and a client.
>>The client browser (Mozilla Firefox) has all certificates necessary.
>>My vhost-ssl.conf (based on the standard template file) contains the
>>following directory entry
>>
>>
>>SSLVerifyClient require
>>SSLVerifyDepth 1
>>SSLRequireSSL
>>SSLOptions +FakeBasicAuth
>>SSLCACertificateFile /etc/apache2/ssl.crt/ca.crt
>>SSLCipherSuite HIGH:MEDIUM
>>SSLRequire %{SSL_CLIENT_S_DN_O} eq "My Organisation" \
>>and %{SSL_CLIENT_S_DN_OU} eq "My Department"
>>
>>
>>However the browser cannot access the directory. The client is waiting for
>>
>>
>my
>
>
>>server until server timeout.
>>Apaches errror.log (level=info) shows
>>
>>Creating new config (0x5cbfc8) for (null)
>>[Thu Jun 09 17:28:45 2005] [info] Init: Initializing OpenSSL library
>>[Thu Jun 09 17:28:45 2005] [info] Init: Seeding PRNG with 144 bytes of
>>entropy
>>[Thu Jun 09 17:28:45 2005] [info] Loading certificate & private key of
>>SSL-aware server
>>[Thu Jun 09 17:28:45 2005] [info] Init: Generating temporary RSA private
>>keys (512/1024 bits)
>>[Thu Jun 09 17:28:45 2005] [info] Init: Generating temporary DH parameters
>>(512/1024 bits)
>>[Thu Jun 09 17:28:45 2005] [info] Shared memory session cache initialised
>>[Thu Jun 09 17:28:45 2005] [info] Init: Initializing (virtual) servers for
>>SSL
>>[Thu Jun 09 17:28:45 2005] [info] Configuring server for SSL protocol
>>[Thu Jun 09 17:28:45 2005] [info] Server: Apache/2.0.53, Interface:
>>mod_ssl/2.0.53, Library: OpenSSL/0.9.7e
>>[Thu Jun 09 17:28:46 2005] [notice] Apache/2.0.53 (Linux/SUSE) configured --
>>resuming normal operations
>>[Thu Jun 09 17:28:46 2005] [info] Server built: Mar 19 2005 22:42:07
>>[Thu Jun 09 17:33:46 2005] [info] Connection to child 0 established (server
>>www.myserver.com:443, client 192.168.0.253)
>>[Thu Jun 09 17:33:46 2005] [info] Seeding PRNG with 144 bytes of entropy
>>[Thu Jun 09 17:33:46 2005] [info] Initial (No.1) HTTPS request received for
>>child 0 (server www.myserver.com:443)
>>[Thu Jun 09 17:33:46 2005] [info] Requesting connection re-negotiation
>>[Thu Jun 09 17:33:46 2005] [info] Awaiting re-negotiation handshake
>>[Thu Jun 09 17:38:46 2005] [error] Re-negotiation handshake failed: Not
>>accepted by client!?
>>
>>The other directories of the server can be accessed with SSL without any
>>problems.
>>Also the SSLRequireSSL directive doesn´t work as expected. I still can
>>
>>
>access
>
>
>>that directory without using SSL.
>>
>>What´s wrong?
>>(I´m using a version 2.0.53 apache (mod_ssl builtin) on a SuSE 9.3 64-bit
>>system)
>>
>>Thanks for any helpfull hint
>>
>>Harry
>>
>>
>
>I´ve found the solution!
>As being always a little paranoid I had created certificates and keys with a
>4096 bit length. This was too much.
>After creating new certificates and keys with 2048 bit length. Almost
>everything works fine.
>The only problem remaining is that ordinary http-access to my directory is
>still possible, even if SSLRequireSSL is set.
>How can I solve this?
>
>
Well to prevent access in http you should place a deny directive in the
http related part of your config file.
deny from all
>Harry
>__
>Apache Interface to OpenSSL (mod_ssl) www.modssl.org
>User Support Mailing List [email protected]
>Automated List Manager[EMAIL PROTECTED]
>
>
--
Charles-Edouard Ruault
Idtect SA
115 rue Reaumur - 75002, Paris, France
Tel: +33-1-55-34-76-65
Fax: +33-1-55-34-76-75
Web: http://www.idtect.com
GPG key Id C97EDD59
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [email protected]
Automated List Manager[EMAIL PROTECTED]
Re: SSL client authentication
Am Samstag, 11. Juni 2005 10:34 schrieb Harry Knitter:
> I´m trying to setup a system where the client authentication for a special
> directory should be done via client certificates. I have set up a CA (using
> OpenSSL) and the according certificate and key files for the CA the server
> and a client.
> The client browser (Mozilla Firefox) has all certificates necessary.
> My vhost-ssl.conf (based on the standard template file) contains the
> following directory entry
>
>
> SSLVerifyClient require
> SSLVerifyDepth 1
> SSLRequireSSL
> SSLOptions +FakeBasicAuth
> SSLCACertificateFile /etc/apache2/ssl.crt/ca.crt
> SSLCipherSuite HIGH:MEDIUM
> SSLRequire %{SSL_CLIENT_S_DN_O} eq "My Organisation" \
> and %{SSL_CLIENT_S_DN_OU} eq "My Department"
>
>
> However the browser cannot access the directory. The client is waiting for
my
> server until server timeout.
> Apaches errror.log (level=info) shows
>
> Creating new config (0x5cbfc8) for (null)
> [Thu Jun 09 17:28:45 2005] [info] Init: Initializing OpenSSL library
> [Thu Jun 09 17:28:45 2005] [info] Init: Seeding PRNG with 144 bytes of
> entropy
> [Thu Jun 09 17:28:45 2005] [info] Loading certificate & private key of
> SSL-aware server
> [Thu Jun 09 17:28:45 2005] [info] Init: Generating temporary RSA private
> keys (512/1024 bits)
> [Thu Jun 09 17:28:45 2005] [info] Init: Generating temporary DH parameters
> (512/1024 bits)
> [Thu Jun 09 17:28:45 2005] [info] Shared memory session cache initialised
> [Thu Jun 09 17:28:45 2005] [info] Init: Initializing (virtual) servers for
> SSL
> [Thu Jun 09 17:28:45 2005] [info] Configuring server for SSL protocol
> [Thu Jun 09 17:28:45 2005] [info] Server: Apache/2.0.53, Interface:
> mod_ssl/2.0.53, Library: OpenSSL/0.9.7e
> [Thu Jun 09 17:28:46 2005] [notice] Apache/2.0.53 (Linux/SUSE) configured --
> resuming normal operations
> [Thu Jun 09 17:28:46 2005] [info] Server built: Mar 19 2005 22:42:07
> [Thu Jun 09 17:33:46 2005] [info] Connection to child 0 established (server
> www.myserver.com:443, client 192.168.0.253)
> [Thu Jun 09 17:33:46 2005] [info] Seeding PRNG with 144 bytes of entropy
> [Thu Jun 09 17:33:46 2005] [info] Initial (No.1) HTTPS request received for
> child 0 (server www.myserver.com:443)
> [Thu Jun 09 17:33:46 2005] [info] Requesting connection re-negotiation
> [Thu Jun 09 17:33:46 2005] [info] Awaiting re-negotiation handshake
> [Thu Jun 09 17:38:46 2005] [error] Re-negotiation handshake failed: Not
> accepted by client!?
>
> The other directories of the server can be accessed with SSL without any
> problems.
> Also the SSLRequireSSL directive doesn´t work as expected. I still can
access
> that directory without using SSL.
>
> What´s wrong?
> (I´m using a version 2.0.53 apache (mod_ssl builtin) on a SuSE 9.3 64-bit
> system)
>
> Thanks for any helpfull hint
>
> Harry
I´ve found the solution!
As being always a little paranoid I had created certificates and keys with a
4096 bit length. This was too much.
After creating new certificates and keys with 2048 bit length. Almost
everything works fine.
The only problem remaining is that ordinary http-access to my directory is
still possible, even if SSLRequireSSL is set.
How can I solve this?
Harry
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [email protected]
Automated List Manager[EMAIL PROTECTED]
SSL client authentication
I´m trying to setup a system where the client authentication for a special
directory should be done via client certificates. I have set up a CA (using
OpenSSL) and the according certificate and key files for the CA the server
and a client.
The client browser (Mozilla Firefox) has all certificates necessary.
My vhost-ssl.conf (based on the standard template file) contains the
following directory entry
SSLVerifyClient require
SSLVerifyDepth 1
SSLRequireSSL
SSLOptions +FakeBasicAuth
SSLCACertificateFile /etc/apache2/ssl.crt/ca.crt
SSLCipherSuite HIGH:MEDIUM
SSLRequire %{SSL_CLIENT_S_DN_O} eq "My Organisation" \
and %{SSL_CLIENT_S_DN_OU} eq "My Department"
However the browser cannot access the directory. The client is waiting for my
server until server timeout.
Apaches errror.log (level=info) shows
Creating new config (0x5cbfc8) for (null)
[Thu Jun 09 17:28:45 2005] [info] Init: Initializing OpenSSL library
[Thu Jun 09 17:28:45 2005] [info] Init: Seeding PRNG with 144 bytes of
entropy
[Thu Jun 09 17:28:45 2005] [info] Loading certificate & private key of
SSL-aware server
[Thu Jun 09 17:28:45 2005] [info] Init: Generating temporary RSA private
keys (512/1024 bits)
[Thu Jun 09 17:28:45 2005] [info] Init: Generating temporary DH parameters
(512/1024 bits)
[Thu Jun 09 17:28:45 2005] [info] Shared memory session cache initialised
[Thu Jun 09 17:28:45 2005] [info] Init: Initializing (virtual) servers for
SSL
[Thu Jun 09 17:28:45 2005] [info] Configuring server for SSL protocol
[Thu Jun 09 17:28:45 2005] [info] Server: Apache/2.0.53, Interface:
mod_ssl/2.0.53, Library: OpenSSL/0.9.7e
[Thu Jun 09 17:28:46 2005] [notice] Apache/2.0.53 (Linux/SUSE) configured --
resuming normal operations
[Thu Jun 09 17:28:46 2005] [info] Server built: Mar 19 2005 22:42:07
[Thu Jun 09 17:33:46 2005] [info] Connection to child 0 established (server
www.myserver.com:443, client 192.168.0.253)
[Thu Jun 09 17:33:46 2005] [info] Seeding PRNG with 144 bytes of entropy
[Thu Jun 09 17:33:46 2005] [info] Initial (No.1) HTTPS request received for
child 0 (server www.myserver.com:443)
[Thu Jun 09 17:33:46 2005] [info] Requesting connection re-negotiation
[Thu Jun 09 17:33:46 2005] [info] Awaiting re-negotiation handshake
[Thu Jun 09 17:38:46 2005] [error] Re-negotiation handshake failed: Not
accepted by client!?
The other directories of the server can be accessed with SSL without any
problems.
Also the SSLRequireSSL directive doesn´t work as expected. I still can access
that directory without using SSL.
What´s wrong?
(I´m using a version 2.0.53 apache (mod_ssl builtin) on a SuSE 9.3 64-bit
system)
Thanks for any helpfull hint
Harry
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [email protected]
Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication and Access Control
On Fri, Jun 03, 2005 at 08:56:56AM +0200, Øyvin Sømme wrote: > Method 2 (SSLRequire): > > The user-id field is just '-'. > > Can I somehow configure apache/mod_ssl to only store certain elements of > the DN (e.g. the CN in the DN) as the user-id in the access-log? mod_ssl in httpd 2.0 supports the "SSLUsername" directive which allows this: http://httpd.apache.org/docs-2.0/mod/mod_ssl.html#sslusername Regards, joe __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Client Authentication and Access Control
Hi. I have read the instructions at: http://www.modssl.org/docs/2.8/ssl_howto.html#ToC9 and successfully set up a web server which runs HTTPS and requires client certificates for authentication. However, I am not 100% pleased with neither of the *two* methods. What I dislike is the *user-id* part of the information that is stored in the access log: Method 1 (mod_auth): The user-id field is a string converted from the *full* subject DN in the client certificate which in my case (with Verisign class 1 certificates) are typically 230 chars long! Method 2 (SSLRequire): The user-id field is just '-'. Can I somehow configure apache/mod_ssl to only store certain elements of the DN (e.g. the CN in the DN) as the user-id in the access-log? One more thing with method 1: I noted that the syntax in mod_auth/AuthGroupFile is: mygroup: user-id1 user-id2 user-id3 i.e. using space as a separator. The user-id produced in method 1 above contains a lot of spaces. How can this work? Using quotes? Thanks. Oyvin __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication POST Problem
On Sat, Dec 25, 2004 at 10:52:27PM -0500, Cliff Woolley wrote: > On Sat, 25 Dec 2004, Adolfo Bello wrote: > > > I heartily agree. > > Unfortunately, I've been waiting for more than a year for this problem > > to be fixed in Apache 2.0.x :-( > > This bug was opened on 2002-09-06 > > http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12355 > > Usually the trick to getting something really done around here is to keep > reminding somebody until it really gets their attention. :) Anyway I'll > forward this on to [EMAIL PROTECTED], and maybe we'll get a taker. It's a particularly annoying problem. The solution in mod_ssl-for-1.3 is not really ideal (it allows a DoS attack of sorts); I spent some time working on a better solution for 2.0 but it didn't seem feasible in the end. It remains on my list of "hard problems to fix" as time permits... joe __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication POST Problem
On Sat, 2004-12-25 at 22:52 -0500, Cliff Woolley wrote: > On Sat, 25 Dec 2004, Adolfo Bello wrote: > > > I heartily agree. > > Unfortunately, I've been waiting for more than a year for this problem > > to be fixed in Apache 2.0.x :-( > > This bug was opened on 2002-09-06 > > http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12355 > > Usually the trick to getting something really done around here is to keep > reminding somebody until it really gets their attention. :) Anyway I'll > forward this on to [EMAIL PROTECTED], and maybe we'll get a taker. > > --Cliff Wow, that would be really great!!! New hopes to get Back to the Future ;-) Thanks. Adolfo Bello __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication POST Problem
On Sat, 25 Dec 2004, Adolfo Bello wrote: > I heartily agree. > Unfortunately, I've been waiting for more than a year for this problem > to be fixed in Apache 2.0.x :-( > This bug was opened on 2002-09-06 > http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12355 Usually the trick to getting something really done around here is to keep reminding somebody until it really gets their attention. :) Anyway I'll forward this on to [EMAIL PROTECTED], and maybe we'll get a taker. --Cliff __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication POST Problem
On Sat, 2004-12-25 at 21:53 -0500, Cliff Woolley wrote: > On Sat, 25 Dec 2004, Adolfo Bello wrote: > > > It just doesn't work in Apache 2.0.x. > > Use Apache 1.3.x. > > That doesn't sound like very good advice... if something is broken in > Apache 2.0.x, we should just fix it. :-/ > > --Cliff I heartily agree. Unfortunately, I've been waiting for more than a year for this problem to be fixed in Apache 2.0.x :-( This bug was opened on 2002-09-06 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12355 Happy Holidays, Adolfo Bello __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication POST Problem
On Sat, 25 Dec 2004, Adolfo Bello wrote: > It just doesn't work in Apache 2.0.x. > Use Apache 1.3.x. That doesn't sound like very good advice... if something is broken in Apache 2.0.x, we should just fix it. :-/ --Cliff __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication POST Problem
On Sat, 2004-12-25 at 15:37 -0500, David T. Ashley wrote: > Hi, > > I installed Bugzilla, and the directory it is in has the > > VerifyClient require > > and all the Apache directives set in the httpd.conf file. It works fine > (the browsers makes me choose a client certificate) but when I submit a form > into Bugzilla I get an error to the effect that POST is not allowed, and > this appears in the Apache logs: > > [Fri Dec 24 19:59:24 2004] [error] SSL Re-negotiation in conjunction with > POST > method not supported!\nhint: try SSLOptions +OptRenegotiate > > I tried the fix recommended in the log message, but it doesn't work. I > seemed to make it through one form OK, but then the next one got me the same > error message, both displayed by the browser and in the Apache logs. > > Any other suggestions? > > Thanks, Dave. It just doesn't work in Apache 2.0.x. Use Apache 1.3.x. Adolfo Bello __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Client Authentication POST Problem
Hi, I installed Bugzilla, and the directory it is in has the VerifyClient require and all the Apache directives set in the httpd.conf file. It works fine (the browsers makes me choose a client certificate) but when I submit a form into Bugzilla I get an error to the effect that POST is not allowed, and this appears in the Apache logs: [Fri Dec 24 19:59:24 2004] [error] SSL Re-negotiation in conjunction with POST method not supported!\nhint: try SSLOptions +OptRenegotiate I tried the fix recommended in the log message, but it doesn't work. I seemed to make it through one form OK, but then the next one got me the same error message, both displayed by the browser and in the Apache logs. Any other suggestions? Thanks, Dave. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager[EMAIL PROTECTED]
Apache Session Reuse with Client Authentication -- Smart Card
I am away until the 14th April 2004 I will get back to you as soon as i can when I return. If the matter is urgent and concerns OASIS, MUBSWEB or MUBS Online then please contact one of the other members of the OLSU team who will try to help. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Apache Session Reuse with Client Authentication -- Smart Card
Hello, Question: Software: Apache 1.3.29 ModSSL 2.8.16 OpenSSL 0.9.7c OS Sun Solaris 8 Clients IE 5.5 and IE 6.0 Client Certificates stored on hardware token with 10 minute timeout for private key. If a user does not use the private key for 10 minutes, then he/she has to re-enter PIN to access private key stored on smart card. If I set Apache to not require client authentication then I am able to reuse a SSL session ID when connecting via HTTPS. I ran the following test with openssl: openssl s_client -connect localhost:443 -state -reconnect The results basically inform you that session caching is working properly and openssl connects to Apache using the same session ID 5 times. If I modify the httpd.conf file to require client authentication, I get a failure with the above openssl command and when connecting using a certificate. I get REQUEST=SET STATUS=BAD when OpenSSL is trying to write the session id to the DBM cache file on the local system. OpenSSL then attempts to REQUEST=GET and that fails when it tries to use the session ID it was unable to write earlier. If I remove the require client auth in the httpd.conf file, the logging is correct and the openssl command does not fail. The problem is that I have users that may take longer than 10 minutes (Access to private key on smart card timeout after 10 minutes) to complete a form on a web page. If a user accesses the server via the browser, he/she selects a certificate to present, authenticates to smart card with pin and is then allowed access to the web page. If he/she sits there with the browser open for 12 minutes or so and click on a link -- failure. Page not found failure. I look at the debug logs of SSL and see that OpenSSL was trying to reuse the first session key and it failed. As a result, the complete handshake starts over again, but the user is not prompted to enter PIN. Apache does not get a user cert and failure takes place. The ironic thing is that if I wait 12 minutes, enter PIN for smart card prior to clicking on a link, then all works fine. OpenSSL does not reuse the session key, but the repeat of the handshake works. How am I able to configure Apache to reuse the session key when client auth is enabled? Am I missing something? Thanks mail2web - Check your email from the web at http://mail2web.com/ . __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Apache, multiple (ip-based) vhosts and client authentication howto?
I want to setup two webservers with different domains,lets say www.domain1.comand www.domain2.comI want to host these webservers on a single apacheserver using vhosts, but ... There are twodifferent known clients accessing these webservers:client1 and client2.Now I want to issue an certificate certificate1 toclient1 which allows him to authenticate himself towww.domain1.com using SSLVerifyClient require andThe other user get a certificate2 which allows him toauthenticate himself to www.domain2.comclient1 cannot access www.domain2.com and client2cannot access www.domain1.com since they don't havethe apropriate certificatesCould anyone provide me with an example of vhosts.conffile how to do this or at least explain how I couldmake one myself. ThanksDo you Yahoo!? Yahoo! Finance Tax Center - File online. File on time.
Apache, multiple (ip-based) vhosts and client authentication howto?
I want to setup two webservers with different domains, lets say www.domain1.com and www.domain2.com I want to host these webservers on a single apache server using vhosts, but ... There are two different known clients accessing these webservers: client1 and client2. Now I want to issue an certificate certificate1 to client1 which allows him to authenticate himself to www.domain1.com using SSLVerifyClient require and The other user get a certificate2 which allows him to authenticate himself to www.domain2.com client1 cannot access www.domain2.com and client2 cannot access www.domain1.com since they don't have the apropriate certificates Could anyone provide me with an example of vhosts.conf file how to do this or at least explain how I could make one myself. Thanks __ Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time. http://taxes.yahoo.com/filing.html __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication and Chain certs
Guys, just to ley you know that I have solved the problem. The CA cert I was using was bad (wrong extensions set). That is why Apache/mod_ssl was saying that it was an invalid CA cert. Using a different CA solved my problem and I can use client certs to log on fine now ! Many thanks for your help on this. Chris... On Friday 24 October 2003 18:00, Chris Covell wrote: > Many thanks to those of you who have helped me on this. > > Unfortunately I still have the problem. I have also duplicated the problem > on a completely different environment, so I think it is either me, or the > certificates I am using ! > > I have taken all of you advice and set up the web server like this: > > SSLCertificateFile.../conf/ssl.crt/server.crt > SSLCertificateKeyFile .../conf/ssl.key/server.key > SSLCACertificateFile .../conf/ssl.crt/cacert.crt > > SSLVerifyClient require > SSLVerifyDepth 2 > > where the cacert.crt file has both the sub and the root CA certificates in > it. > > The error I am getting in the apache log is: > > mod_ssl: Certificate Verification Error (24): invalid CA certificate > __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication and Chain certs
Many thanks to those of you who have helped me on this. Unfortunately I still have the problem. I have also duplicated the problem on a completely different environment, so I think it is either me, or the certificates I am using ! I have taken all of you advice and set up the web server like this: SSLCertificateFile .../conf/ssl.crt/server.crt SSLCertificateKeyFile .../conf/ssl.key/server.key SSLCACertificateFile.../conf/ssl.crt/cacert.crt SSLVerifyClient require SSLVerifyDepth 2 where the cacert.crt file has both the sub and the root CA certificates in it. The error I am getting in the apache log is: mod_ssl: Certificate Verification Error (24): invalid CA certificate I have checked the certificate and chain via the openssl command: openssl verify -CAfile cacert.crt server.crt and this is fine. Does anybody know where I can get a good description of the conditions that produce the above mod_ssl error ? I don't even know if this is a problem with the certificates on the server, or the certificates passed by the client. Yours hopefully, Chris... __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication and Chain certs
Le 24 Oct, Chris Covell a ecrit : > Hello there Martial, > > many thanks for you quick reply. > >> We also have: root CA -> sub CA -> client or server cert >> >> we have put the root and sub CA in a directory pointed by: >> SSLCACertificatePath >> > > In seperate files ? Yes each Ca is in a separate file. > >> In this directory we have the attatched Makefile that we run to make a >> hash of all CA and link the result of the hash to eatch CA. >> >> This work fine whith apache 1.3.3x to the latest 2.4. > > Did you use "SSLCertificateChainFile" in the httpd.conf ? No, only SSLCACertificatePath /path/to/the/directory-contening-files > > Chris... > __ > Apache Interface to OpenSSL (mod_ssl) www.modssl.org > User Support Mailing List [EMAIL PROTECTED] > Automated List Manager[EMAIL PROTECTED] > -- Martial Chartoire, Service Informatique | E-mail: [EMAIL PROTECTED] Institut de Physique Nucleaire de Lyon | phone : +33 472 448 430 43, BD du 11 Novembre 1918 | fax : +33 472 448 004 F 69622 Villeurbanne Cedex | __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication and Chain certs
I have this setup, this should work... SSLCertificateFile /opt/DKBapache/conf/ssl.crt/server.crt SSLCertificateKeyFile /opt/DKBapache/conf/ssl.key/server.key SSLCACertificateFile /opt/DKBapache/conf/ssl.crt/CA.crt SSLVerifyClient require SSLVerifyDepth 2 The CA.crt file contains the Root and intermediate certs. These are also used at startup to make the server cert chain (our client and server certs have the same root, use SSLCertificateChainFile for the server chain if not). Make sure you you have the SSLVerifyDepth 2 line. Regards Matt --- Chris Covell <[EMAIL PROTECTED]> wrote: > Hello there Martial, > > many thanks for you quick reply. > > > We also have: root CA -> sub CA -> client or > server cert > > > > we have put the root and sub CA in a directory > pointed by: > > SSLCACertificatePath > > > > In seperate files ? > > > In this directory we have the attatched Makefile > that we run to make a > > hash of all CA and link the result of the hash > to eatch CA. > > > > This work fine whith apache 1.3.3x to the latest > 2.4. > > Did you use "SSLCertificateChainFile" in the > httpd.conf ? > > Chris... > __ > Apache Interface to OpenSSL (mod_ssl) >www.modssl.org > User Support Mailing List > [EMAIL PROTECTED] > Automated List Manager [EMAIL PROTECTED] __ Do you Yahoo!? The New Yahoo! Shopping - with improved product search http://shopping.yahoo.com __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication and Chain certs
Chris I had exactly the same issue. The problem was that when I moved to this new type of cert [sub CA], I didn't read all the installation information :-) We used BT Trust Services which provided an 'intermediate certificate' The intermediate cert is required to identified the Root CA. I downloaded it from their site on our server. I used the SSLCertificateChainFile directive first but still the server wouldn't start Error was: [Wed Aug 20 19:41:22 2003] [error] Failed to configure CA certificate chain! I then used: SSLCACertificateFile /www/ssl/oursite.co.uk/intermediate.crt SSLCertificateFile /www/ssl/oursite.co.uk/oursite.crt SSLCertificateKeyFile /www/ssl/oursite.co.uk/oursite.key It works perfectly with Apache 2.0.4x Hope this helps. Regards Bruno Georges On Friday, Oct 24, 2003, at 15:04 Europe/London, Chris Covell wrote: Hello there, can any of you guys help me with this problem please ? I have been using mod_ssl and client authentication via apache for some time now without any problems. My Apache configuration has been the usual: SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key SSLCACertificateFile/etc/httpd/conf/ssl.crt/cacert.crt No worries. Up until now the CA certificate has always been a self signed root CA. But today I need to use a web server cert signed by a sub CA and have my clients authenticated using certs from the sub CA. I did not think that this would be a problem, so I just copied the correct files in to the correct places (sub ca cert to SSLCACertificateFile and server cert to SSLCertificateFile). But I got a page not found error in IE and the Apache error: mod_ssl: Certificate Verification: Error (20): unable to get local issuer certificate OK, so I implemented the SSLCertificateChainFile with a bundle of the two certs in my chain, sub and root. I know openssl can get them because: openssl verify -CAfile chain.crt server.crt works a treat. I have now tried various combinations of chain file content (root ca, sub ca, etc) and even putting the chain certs in the server.crt file, but none of these helps. I am running an "up2date" RedHat 7.2 with out the box apache and mod ssl. Has anyone got an answer for me, please ! I am sure this is possible, and none of the docs seem to sugest that I am going to have any issues. Chris... __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED] Bruno Georges Xbridge Ltd Tel: +44 (0) 207 378 9830 Mob: +44 (0) 787 988 4895 __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication and Chain certs
Hello there Martial, many thanks for you quick reply. > We also have: root CA -> sub CA -> client or server cert > > we have put the root and sub CA in a directory pointed by: > SSLCACertificatePath > In seperate files ? > In this directory we have the attatched Makefile that we run to make a > hash of all CA and link the result of the hash to eatch CA. > > This work fine whith apache 1.3.3x to the latest 2.4. Did you use "SSLCertificateChainFile" in the httpd.conf ? Chris... __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication and Chain certs
We also have: root CA -> sub CA -> client or server cert
we have put the root and sub CA in a directory pointed by:
SSLCACertificatePath
In this directory we have the attatched Makefile that we run to make a
hash of all CA and link the result of the hash to eatch CA.
This work fine whith apache 1.3.3x to the latest 2.4.
--
Martial Chartoire, Service Informatique | E-mail: [EMAIL PROTECTED]
Institut de Physique Nucleaire de Lyon | phone : +33 472 448 430
43, BD du 11 Novembre 1918 | fax : +33 472 448 004
F 69622 Villeurbanne Cedex |##
## Makefile to keep the hash symlinks in SSLCACertificatePath up to date
## Copyright (c) 1998-2001 Ralf S. Engelschall, All Rights Reserved.
##
SSL_PROGRAM=
update: clean
[EMAIL PROTECTED]"$(SSL_PROGRAM)"; \
if [ ".$$ssl_program" = . ]; then \
for dir in . `echo $$PATH | sed -e 's/:/ /g'`; do \
for program in openssl ssleay; do \
if [ -f "$$dir/$$program" ]; then \
if [ -x "$$dir/$$program" ]; then \
ssl_program="$$dir/$$program"; \
break; \
fi; \
fi; \
done; \
if [ ".$$ssl_program" != . ]; then \
break; \
fi; \
done; \
fi; \
if [ ".$$ssl_program" = . ]; then \
echo "Error: neither 'openssl' nor 'ssleay' program found" 1>&2; \
exit 1; \
fi; \
for file in *.crt; do \
if [ ".`grep SKIPME $$file`" != . ]; then \
echo dummy |\
awk '{ printf("%-15s ... Skipped\n", file); }' \
"file=$$file"; \
else \
n=0; \
while [ 1 ]; do \
hash="`$$ssl_program x509 -noout -hash <$$file`"; \
if [ -r "$$hash.$$n" ]; then \
n=`expr $$n + 1`; \
else \
echo dummy |\
awk '{ printf("%-15s ... %s\n", file, hash); }' \
"file=$$file" "hash=$$hash.$$n"; \
ln -s $$file $$hash.$$n; \
break; \
fi; \
done; \
fi; \
done
clean:
[EMAIL PROTECTED] -f [0-9a-fA-F]*.[0-9]*
Client authentication and Chain certs
Hello there, can any of you guys help me with this problem please ? I have been using mod_ssl and client authentication via apache for some time now without any problems. My Apache configuration has been the usual: SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key SSLCACertificateFile/etc/httpd/conf/ssl.crt/cacert.crt No worries. Up until now the CA certificate has always been a self signed root CA. But today I need to use a web server cert signed by a sub CA and have my clients authenticated using certs from the sub CA. I did not think that this would be a problem, so I just copied the correct files in to the correct places (sub ca cert to SSLCACertificateFile and server cert to SSLCertificateFile). But I got a page not found error in IE and the Apache error: mod_ssl: Certificate Verification: Error (20): unable to get local issuer certificate OK, so I implemented the SSLCertificateChainFile with a bundle of the two certs in my chain, sub and root. I know openssl can get them because: openssl verify -CAfile chain.crt server.crt works a treat. I have now tried various combinations of chain file content (root ca, sub ca, etc) and even putting the chain certs in the server.crt file, but none of these helps. I am running an "up2date" RedHat 7.2 with out the box apache and mod ssl. Has anyone got an answer for me, please ! I am sure this is possible, and none of the docs seem to sugest that I am going to have any issues. Chris... __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Antwort: Re: Problem with Reverse Proxy and Client authentication
Hallo Michael, ja, nur Tippfehler. Das Problem ist mittlerweile behoben. ModSSL hatte Schwierigkeiten mit dem Clientzertifikat, was OpenSSL erzeugt hat. Von Hand gepatched funktioniert das jetzt. Mit freundlichen Grüßen -- Steffen Fischer, I/T Architect IBM Deutschland GmbH, Karl-Arnold-Platz 1a, D-40474 Duesseldorf Tel: +49 (0) 211 476-2986 Fax: -2391 Mobile: +49 (0) 175 433 1187 email: [EMAIL PROTECTED] project email: [EMAIL PROTECTED] project phone: +49 (0) 211 826 - 74276 [EMAIL PROTECTED] Gesendet von: [EMAIL PROTECTED] 27.03.03 10:17 Bitte antworten an modssl-users An:[EMAIL PROTECTED] Kopie: Thema: Re: Problem with Reverse Proxy and Client authentication hi steffen >ProxyPass /myapp https://backendserver/app >ProxyPassReverse /myapp/ https://backendserver/app/ any specific reason for the missing trailing slashes in the ProxyPass directive, or is this only a typo? regards michael __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED] |+| |Diese Nachricht ist vertraulich. Sie|This message is confidential and may| |ist ausschliesslich fuer|be privileged. It is| |den im Adressfeld ausgewiesenen |intended solely for the named | |Adressaten bestimmt.|addressee. If you are not the | |Sollten Sie nicht der vorgesehene |intended recipient please inform us.| |Empfaenger sein, so bitten |Any unauthorised| |wir um eine kurze Nachricht. Jede |dissemination, distribution or | |unbefugte Weiterleitung |copying hereof is prohibited. | |oder Fertigung einer Kopie ist |As we cannot guarantee the | |unzulaessig. Da wir nicht die |genuineness or completeness of | |Echtheit oder Vollstaendigkeit der |the information contained in this | |in dieser Nachricht |message, the statements | |enthaltenen Informationen |set forth above are not legally | |garantieren koennen, schliessen wir |binding. In connection | |die rechtliche Verbindlichkeit der |therewith, we also refer to our | |vorstehenden Erklaerungen |governing regulations of| |und Aeusserungen aus. Wir verweisen |concerning signatory authority | |in diesem Zusammenhang |published in the| |auch auf die fuer uns geltenden|standard bank or company signature | |Regelungen ueber die|lists with regard to the| |Verbindlichkeit von |legally binding effect of statements| |Willenserklaerungen mit |made with the intent to | |verpflich
Re: Problem with Reverse Proxy and Client authentication
hi steffen >ProxyPass /myapp https://backendserver/app >ProxyPassReverse /myapp/ https://backendserver/app/ any specific reason for the missing trailing slashes in the ProxyPass directive, or is this only a typo? regards michael __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Problem with Reverse Proxy and Client authentication
Hello, we want to setup a reverse proxy (http in, https to the backend IBM HTTP Server) with client authentication to the backend. On Linux and WinNT 4 SP5 (with Apache 2.044 and OpenSSL 0.97) we are both getting segmentation faults or exits (see below). We checked the communication through openssl directly and it worked. Anyone any hint, we are getting desperate? Thanks! Our configuration: SSLProxyEngine on ProxyRequests On ProxyVia On SSLProxyMachineCertificateFile d:\apache\client_cert.pem SSLProxyVerify optional_no_ca SSLProxyVerifyDepth 10 SSLProxyCipherSuite ALL ProxyPass /myapp https://backendserver/app ProxyPassReverse /myapp/ https://backendserver/app/ ... Apache error_log from WinNT: [Mon Mar 24 11:02:59 2003] [info] Server: Apache/2.0.44, Interface: mod_ssl/2.0.44, Library: OpenSSL/0.9.7a ... [Mon Mar 24 11:24:49 2003] [debug] ssl_engine_kernel.c(1236): Certificate Verification: Verifiable Issuer is configured as optional, therefore we're accepting the certificate [Mon Mar 24 11:24:49 2003] [debug] ssl_engine_kernel.c(1198): Certificate Verification: depth: 0, subject: /C=DE/ST=NRW/L=Duesseldorf/O=Westdeutsche Landesbank-Girozentrale-Duesseldorf/Muenster/OU=WestLB Systems GmbH/OU=Terms of use at www.verisign.com/rpa (c)00/CN=wpdirect.westlb.sko.de, issuer: /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign [Mon Mar 24 11:24:49 2003] [debug] ssl_engine_kernel.c(1236): Certificate Verification: Verifiable Issuer is configured as optional, therefore we're accepting the certificate [Mon Mar 24 11:24:49 2003] [debug] ssl_engine_kernel.c(1766): OpenSSL: Loop: SSLv3 read server certificate A [Mon Mar 24 11:24:49 2003] [debug] ssl_engine_kernel.c(1766): OpenSSL: Loop: SSLv3 read server certificate request A [Mon Mar 24 11:24:49 2003] [debug] ssl_engine_kernel.c(1766): OpenSSL: Loop: SSLv3 read server done A [Mon Mar 24 11:24:49 2003] [debug] ssl_engine_kernel.c(1532): Proxy client certificate callback: (localhost:443) entered [Mon Mar 24 11:24:49 2003] [debug] ssl_engine_kernel.c(1504): Proxy client certificate callback: (localhost:443) found acceptable cert, sending /C=DE/ST=NRW/L=Duesseldorf/O=WPS Bank AG/CN=MYCLIENT [Mon Mar 24 11:24:51 2003] [notice] Parent: child process exited with status 3221225477 -- Restarting. Mit freundlichen Grüßen -- Steffen Fischer, I/T Architect IBM Deutschland GmbH, Karl-Arnold-Platz 1a, D-40474 Duesseldorf Tel: +49 (0) 211 476-2986 Fax: -2391 Mobile: +49 (0) 175 433 1187 email: [EMAIL PROTECTED] project email: [EMAIL PROTECTED] project phone: +49 (0) 211 826 - 74276 Diese Nachricht ist vertraulich. Sie ist ausschliesslich fuer den im Adressfeld ausgewiesenen Adressaten bestimmt. Sollten Sie nicht der vorgesehene Empfaenger sein, so bitten wir um eine kurze Nachricht. Jede unbefugte Weiterleitung oder Fertigung einer Kopie ist unzulaessig. Da wir nicht die Echtheit oder Vollstaendigkeit der in dieser Nachricht enthaltenen Informationen garantieren koennen, schliessen wir die rechtliche Verbindlichkeit der vorstehenden Erklaerungen und Aeusserungen aus. Wir verweisen in diesem Zusammenhang auch auf die fuer die Bank geltenden Regelungen ueber die Verbindlichkeit von Willenserklaerungen mit verpflichtendem Inhalt, die in den bankueblichen Unterschriftenverzeichnissen bekannt gemacht werden. This message is confidential and may be privileged. It is intended solely for the named addressee. If you are not the intended recipient please inform us. Any unauthorised dissemination, distribution or copying hereof is prohibited. As we cannot guarantee the genuineness or completeness of the information contained in this message, the statements set forth above are not legally binding. In connection therewith, we also refer to the governing regulations of WestLB concerning signatory authority published in the standard bank signature lists with regard to the legally binding effect of statements made with the intent to obligate WestLB. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: mod_ssl/mod_jk failure with client authentication on
I realised that I included irrelevant log snipet from the SSL log. Please see the correction below. Aaron Stromas said: > Hi, > > I apologise for cross-posting - I'm really not sure which component is > at fault, looks like mod_ssl but possibly mod_jk. BTW, is there a list > (or some other venue) dedicated to mod_jk? > > My environment is Apache 1.3.22, mod_ssl 2.8.5, OpenSSL 0.9.6b, tomcat > 4.0.3. I have a servlet mounted like this > > JkMount /app/servlet/* ajp13 > JkMount /app/*.jsp ajp13 > >SSLVerifyClient require >SSLVerifyDepth 4 > > > When SSLVerifyClient is set to 'none' all works fine, but when I set it > as above, to 'require', it seems that the SSL connection is repetedly > renegotiated. The mod_jk log stop at this line (I edited out log entry > headers for clarity): > > Attempting to map URI '/app/servlet/ApplicationProxyServlet' > jk_uri_worker_map_t::map_uri_to_worker, Found a context match ajp13 -> > /app/servlet/ > > whilst the ssl engine log shows this > Connection to child 3 established (server > www-sps.sps.fms.treas.gov:443, client 164.95.119.43) > Seeding PRNG with 1160 bytes of entropy > OpenSSL: Handshake: start > OpenSSL: Loop: before/accept initialization > Inter-Process Session Cache: request=GET status=FOUND > id=7A2A7121DDC60F144CA9F233A19E7BD7D88F0DCA06AEB588165EB9F01CA276DE > (session reuse) > OpenSSL: Loop: SSLv3 read client hello A > OpenSSL: Loop: SSLv3 write server hello A > OpenSSL: Loop: SSLv3 write change cipher spec A > OpenSSL: Loop: SSLv3 write finished A > OpenSSL: Loop: SSLv3 flush data > OpenSSL: Loop: SSLv3 read finished A > OpenSSL: Handshake: done > Connection: Client IP: 164.95.119.43, Protocol: SSLv3, Cipher: > EXP1024-RC4-SHA (56/128 bits) > Initial (No.1) HTTPS request received for child 3 (server > www-sps.sps.fms.treas.gov:443) > OpenSSL: Write: SSL negotiation finished successfully > Connection to child 3 closed with standard shutdown (server > www-sps.sps.fms.treas.gov:443, client 164.95.119.43) > Connection to child 4 established (server > www-sps.sps.fms.treas.gov:443, client 164.95.119.43) > Seeding PRNG with 1160 bytes of entropy > OpenSSL: Handshake: start > OpenSSL: Loop: before/accept initialization > [Connection to child 5 established (server > www-sps.sps.fms.treas.gov:443, client 164.95.119.43) > Seeding PRNG with 1160 bytes of entropy > OpenSSL: Handshake: start > OpenSSL: Loop: before/accept initialization > OpenSSL: Loop: SSLv3 read client hello A > OpenSSL: Loop: SSLv3 write server hello A > OpenSSL: Loop: SSLv3 write certificate A > OpenSSL: Loop: SSLv3 write key exchange A > OpenSSL: Loop: SSLv3 write server done A > OpenSSL: Loop: SSLv3 flush data > OpenSSL: Loop: SSLv3 read client key exchange A > OpenSSL: Loop: SSLv3 read finished A > OpenSSL: Loop: SSLv3 write change cipher spec A > OpenSSL: Loop: SSLv3 write finished A > OpenSSL: Loop: SSLv3 flush data > [ more SSL handshake] OpenSSL: Handshake: done Connection: Client IP: 164.95.119.43, Protocol: TLSv1, Cipher: EDH-RSA-DES-CBC3-SHA (168/168 bits) Initial (No.1) HTTPS request received for child 1 (server www-sps.sps.fms.treas.gov:443) Changed client verification type will force renegotiation Requesting connection re-negotiation Performing full renegotiation: complete handshake protocol OpenSSL: Write: SSL negotiation finished successfully Connection to child 0 closed with standard shutdown (server www-sps.sps.fms.treas.gov:443, client 164.95.119.43) I/O: sucked 4708 bytes of input data from SSL/TLS I/O layer for delayed injection into Apache I/O layer OpenSSL: Handshake: start OpenSSL: Loop: SSL renegotiate ciphers OpenSSL: Loop: SSLv3 write hello request A OpenSSL: Loop: SSLv3 flush data Awaiting re-negotiation handshake OpenSSL: Handshake: start OpenSSL: Loop: before accept initialization Inter-Process Session Cache: request=REM status=OK id=38B1D98C2B4A6384FA080BDD4374ACE13881B23AD58834437874A1F03733FCFE (session dead) Write: SSLv3 read client hello B OpenSSL: Exit: error in SSLv3 read client hello B Re-negotiation handshake failed: Not accepted by client!? I/O: injecting 4708 bytes of pre-sucked data into Apache I/O layer OpenSSL: Write: SSLv3 read client hello B OpenSSL: Exit: error in SSLv3 read client hello B SSL error on writing data (OpenSSL library error follows) OpenSSL: error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected record Connection to child 1 closed with standard shutdown (server www-sps.sps.fms.treas.gov:443, client 164.95.119.43) > > > In contrast, when SSLVerifyClient is 'none', mod_jk log shows > > Attempting to map URI '/app/servlet/ApplicationProxyServlet' > jk_uri_worker_map_t::map_uri_to_worker, Found a context match ajp13 -> > /app/servlet/ > Into wc_get_worker_for_name ajp13 > wc_get_worker_for_name, done found a worker > Into jk_worker_t::get_endpoint > In jk_endpoint_t::ajp_get_endpoint, time elapsed since last request = > 534 seconds > Into jk_endpoint_t::service > Into ajp_marshal_into_msgb > ajp_marshal_into_msgb -
mod_ssl/mod_jk failure with client authentication on
Hi, I apologise for cross-posting - I'm really not sure which component is at fault, looks like mod_ssl but possibly mod_jk. BTW, is there a list (or some other venue) dedicated to mod_jk? My environment is Apache 1.3.22, mod_ssl 2.8.5, OpenSSL 0.9.6b, tomcat 4.0.3. I have a servlet mounted like this JkMount /app/servlet/* ajp13 JkMount /app/*.jsp ajp13 SSLVerifyClient require SSLVerifyDepth 4 When SSLVerifyClient is set to 'none' all works fine, but when I set it as above, to 'require', it seems that the SSL connection is repetedly renegotiated. The mod_jk log stop at this line (I edited out log entry headers for clarity): Attempting to map URI '/app/servlet/ApplicationProxyServlet' jk_uri_worker_map_t::map_uri_to_worker, Found a context match ajp13 -> /app/servlet/ whilst the ssl engine log shows this Connection to child 3 established (server www-sps.sps.fms.treas.gov:443, client 164.95.119.43) Seeding PRNG with 1160 bytes of entropy OpenSSL: Handshake: start OpenSSL: Loop: before/accept initialization Inter-Process Session Cache: request=GET status=FOUND id=7A2A7121DDC60F144CA9F233A19E7BD7D88F0DCA06AEB588165EB9F01CA276DE (session reuse) OpenSSL: Loop: SSLv3 read client hello A OpenSSL: Loop: SSLv3 write server hello A OpenSSL: Loop: SSLv3 write change cipher spec A OpenSSL: Loop: SSLv3 write finished A OpenSSL: Loop: SSLv3 flush data OpenSSL: Loop: SSLv3 read finished A OpenSSL: Handshake: done Connection: Client IP: 164.95.119.43, Protocol: SSLv3, Cipher: EXP1024-RC4-SHA (56/128 bits) Initial (No.1) HTTPS request received for child 3 (server www-sps.sps.fms.treas.gov:443) OpenSSL: Write: SSL negotiation finished successfully Connection to child 3 closed with standard shutdown (server www-sps.sps.fms.treas.gov:443, client 164.95.119.43) Connection to child 4 established (server www-sps.sps.fms.treas.gov:443, client 164.95.119.43) Seeding PRNG with 1160 bytes of entropy OpenSSL: Handshake: start OpenSSL: Loop: before/accept initialization [Connection to child 5 established (server www-sps.sps.fms.treas.gov:443, client 164.95.119.43) Seeding PRNG with 1160 bytes of entropy OpenSSL: Handshake: start OpenSSL: Loop: before/accept initialization OpenSSL: Loop: SSLv3 read client hello A OpenSSL: Loop: SSLv3 write server hello A OpenSSL: Loop: SSLv3 write certificate A OpenSSL: Loop: SSLv3 write key exchange A OpenSSL: Loop: SSLv3 write server done A OpenSSL: Loop: SSLv3 flush data OpenSSL: Loop: SSLv3 read client key exchange A OpenSSL: Loop: SSLv3 read finished A OpenSSL: Loop: SSLv3 write change cipher spec A OpenSSL: Loop: SSLv3 write finished A OpenSSL: Loop: SSLv3 flush data In contrast, when SSLVerifyClient is 'none', mod_jk log shows Attempting to map URI '/app/servlet/ApplicationProxyServlet' jk_uri_worker_map_t::map_uri_to_worker, Found a context match ajp13 -> /app/servlet/ Into wc_get_worker_for_name ajp13 wc_get_worker_for_name, done found a worker Into jk_worker_t::get_endpoint In jk_endpoint_t::ajp_get_endpoint, time elapsed since last request = 534 seconds Into jk_endpoint_t::service Into ajp_marshal_into_msgb ajp_marshal_into_msgb - Done sending to ajp13 #261 ajp_send_request 2: request body to send 4708 - request body to resend 0 sending to ajp13 #4714 received from ajp13 #3 sending to ajp13 #4 received from ajp13 #3 sending to ajp13 #4 received from ajp13 #49 ajp_unmarshal_response: status = 200 ajp_unmarshal_response: Number of headers is = 2 ajp_unmarshal_response: Header[0] [Content-Type] = [application/octet-stream] ajp_unmarshal_response: Header[1] [Content-Length] = [17776] received from ajp13 #1028 received from ajp13 #1028 received from ajp13 #1028 received from ajp13 #1028 received from ajp13 #1028 received from ajp13 #1028 received from ajp13 #1028 received from ajp13 #1028 received from ajp13 #1028 ... and the SSL engine log shows Connection to child 1 established (server www-sps.sps.fms.treas.gov:443, client 164.95.119.43) Seeding PRNG with 1160 bytes of entropy OpenSSL: Handshake: start OpenSSL: Loop: before/accept initialization OpenSSL: Loop: SSLv3 read client hello A OpenSSL: Loop: SSLv3 write server hello A OpenSSL: Loop: SSLv3 write certificate A OpenSSL: Loop: SSLv3 write key exchange A OpenSSL: Loop: SSLv3 write server done A OpenSSL: Loop: SSLv3 flush data OpenSSL: Loop: SSLv3 read client key exchange A OpenSSL: Loop: SSLv3 read finished A OpenSSL: Loop: SSLv3 write change cipher spec A OpenSSL: Loop: SSLv3 write finished A OpenSSL: Loop: SSLv3 flush data Inter-Process Session Cache: request=SET status=OK id=7D883EF0B18F9E84BC57C4F02C6E34ADF6FF049BB7091F16B303B79AC906832B timeout=295s (session caching) OpenSSL: Handshake: done Connection: Client IP: 164.95.119.43, Protocol: TLSv1, Cipher: EDH-RSA-DES-CBC3-SHA (168/168 bits) Initial (No.1) HTTPS request received for child 1 (server www-sps.sps.fms.treas.gov:443) OpenSSL: Write: SSL negotiation finished successfully Connection to child 1 closed with standard shutdown (server www-sps.sps.f
Client authentication fails - why (oh why) ?
Hello all, After studying various guides and mail archives for days and days, with no luck, I'm now turning to you. I would really appreciate some advice -- any advice. Thanks in advance! Case & situation: I need to arrange SOAP connection with both client and server side authentication. Currently using Tomcat 4.0.3, Apache 1.3.22, OpenSSL 0.9.6c and mod_ssl 2.8.8. Plus Apache SOAP 2.3. And it's working, as long as I only require server authentication. The server certificate is certified by a CA, which is created by myself. The CA certificate is in the client's keystore and thus the server certificate offered by the server is recognized. Nice and fine. Problem: A client certificate has been certified by the same aforementioned, self-made CA. This certificate is in the client keystore. Apache/modssl correctly sends the CA certificate to the client in the SSL CertificateRequest phase. AFAIK, this should result in the client certificate being accepted. The problem of course is, it never does that. Some data: * The client is Win NT 4, the server is Redhat Linux. * The error message in ssl_engine_log is: OpenSSL: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate [Hint: No CAs known to server for verification?] * httpd.conf includes: SSLCertificateFile [the_correct_path_to]/server.crt SSLCertificateKeyFile [the_correct_path_to]/server.key SSLCACertificateFile [the_correct_path_to]/cacert.pem SSLVerifyClient require SSLVerifyDepth 1 * Because the client authentication fails, server closes the connection, which at the client side results in: Exception while waiting for close java.net.SocketException: Cannot send after socket shutdown: JVM_recv in socket input stream read * Some pondering follows... As far as I understand, having the client certificate in the server keystore is not necessary, as Apache/modssl sends the CA certificate pointed to in SSLCACertificateFile directive. Am I right in that? At least doing so didn't improve the situation. In fact, I don't think Apache looks into the keystore at all... how about that, am I right there? :-) And how about this: does it matter where I create the client certificate, on the server or on the client -- as long as I fill in the same data? And finally: besides the obvious(?) PEM/DER format differences, does it matter if I use openssl or keytool for certificate creation etc.? Now I'd cross my fingers if I did that -- hoping for some replies. Thank you and have a nice day, Renne Tergujeff VTT Information Technology Espoo, Finland __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
client authentication
We have problem with client authentication from some client. On server side we use Apache 1.3.24 with mod_ssl 2.8.8. All client use MS IE 5 or higher and MS Windows 98-2000. >From some client is client authentication without problems, but from some not. I think, certificate on client is installed properly. There is list from ssl logs: [13/Jun/2002 11:18:18 11431] [info] Requesting connection re-negotiation [13/Jun/2002 11:18:18 11431] [info] Awaiting re-negotiation handshake [13/Jun/2002 11:18:18 11431] [error] Re-negotiation handshake failed: Not accepted by client!? [13/Jun/2002 11:18:18 11431] [error] SSL error on writing data (OpenSSL library error follows) [13/Jun/2002 11:18:18 11431] [error] OpenSSL: error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure or [13/Jun/2002 11:06:08 32598] [info] Seeding PRNG with 23177 bytes of entropy [13/Jun/2002 11:06:10 32598] [error] SSL handshake interrupted by system [Hint: Stop button pressed in browser?!] (System error follows) [13/Jun/2002 11:06:10 32598] [error] System: Connection reset by peer (errno: 104) Thanks for any advice Libor __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
AW: Client Authentication Problem
the path for SSLCACertificateFile was wrong. know its working > -Ursprüngliche Nachricht- > Von: Jochen Vogel [mailto:[EMAIL PROTECTED]] > Gesendet: Donnerstag, 6. Juni 2002 13:14 > An: '[EMAIL PROTECTED]' > Betreff: Client Authentication Problem > > > hi, > > i created a CA and a ClientKey witch i imported in my Client. > in httpd.conf i configured > > Alias /test/ "/opt/www/test/" > > Options Indexes > Order allow,deny > Allow from 192.168.0.142 > SSLVerifyClient require > SSLVerifyDepth 1 > > if i try to connect i get the following error. > > ==> ./logs/ssl_engine_log <== > [06/Jun/2002 13:04:06 01186] [info] Connection to child 5 established > (server suse:443, client 192.168.0.142) > [06/Jun/2002 13:04:06 01186] [info] Seeding PRNG with 23177 bytes of > entropy > [06/Jun/2002 13:04:06 01186] [info] Connection: Client IP: > 192.168.0.142, > Protocol: SSLv3, Cipher: EXP-RC4-MD5 (40/128 bits) > [06/Jun/2002 13:04:06 01186] [info] Connection to child 5 closed with > standard shutdown (server suse:443, client 192.168.0.142) > > ==> ./logs/access_log <== > 192.168.0.142 - - [06/Jun/2002:13:04:07 +0200] "GET /test/ > HTTP/1.1" 403 265 > > ==> ./logs/error_log <== > [Thu Jun 6 13:04:07 2002] [error] mod_ssl: Re-negotiation > handshake failed: > Not accepted by client!? > [Thu Jun 6 13:04:07 2002] [error] mod_ssl: SSL error on writing data > (OpenSSL library error follows) > [Thu Jun 6 13:04:07 2002] [error] OpenSSL: error:1409E0E5:SSL > routines:SSL3_WRITE_BYTES:ssl handshake failure > > ==> ./logs/ssl_engine_log <== > [06/Jun/2002 13:04:07 01187] [info] Connection to child 6 established > (server suse:443, client 192.168.0.142) > [06/Jun/2002 13:04:07 01187] [info] Seeding PRNG with 23177 bytes of > entropy > [06/Jun/2002 13:04:07 01187] [info] Connection: Client IP: > 192.168.0.142, > Protocol: SSLv3, Cipher: EXP-RC4-MD5 (40/128 bits) > [06/Jun/2002 13:04:07 01187] [info] Initial (No.1) HTTPS > request received > for child 6 (server suse:443) > [06/Jun/2002 13:04:07 01187] [info] Requesting connection > re-negotiation > [06/Jun/2002 13:04:07 01187] [info] Awaiting re-negotiation handshake > [06/Jun/2002 13:04:07 01187] [error] Re-negotiation handshake > failed: Not > accepted by client!? > [06/Jun/2002 13:04:07 01187] [error] SSL error on writing > data (OpenSSL > library error follows) > [06/Jun/2002 13:04:07 01187] [error] OpenSSL: error:1409E0E5:SSL > routines:SSL3_WRITE_BYTES:ssl handshake failure > [06/Jun/2002 13:04:07 01187] [info] Connection to child 6 closed with > unclean shutdown (server suse:443, client 192.168.0.142) > > ==> ./logs/ssl_request_log <== > [06/Jun/2002:13:04:07 +0200] 192.168.0.142 SSLv3 (NONE) "GET /test/ > HTTP/1.1" 265 > > ==> ./logs/access_log <== > 192.168.0.142 - - [06/Jun/2002:13:04:09 +0200] "GET /test/ > HTTP/1.1" 403 265 > > ==> ./logs/error_log <== > [Thu Jun 6 13:04:09 2002] [error] mod_ssl: Certificate > Verification: Error > (20): unable to get local issuer certificate > [Thu Jun 6 13:04:09 2002] [error] mod_ssl: Re-negotiation > handshake failed: > Not accepted by client!? > [Thu Jun 6 13:04:09 2002] [error] mod_ssl: Certificate > Verification: Error > (20): unable to get local issuer certificate > [Thu Jun 6 13:04:09 2002] [error] mod_ssl: SSL error on writing data > (OpenSSL library error follows) > [Thu Jun 6 13:04:09 2002] [error] OpenSSL: error:140890B2:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > > ==> ./logs/ssl_engine_log <== > [06/Jun/2002 13:04:09 01188] [info] Connection to child 7 established > (server suse:443, client 192.168.0.142) > [06/Jun/2002 13:04:09 01188] [info] Seeding PRNG with 23177 bytes of > entropy > [06/Jun/2002 13:04:09 01188] [info] Connection: Client IP: > 192.168.0.142, > Protocol: SSLv3, Cipher: EXP-RC4-MD5 (40/128 bits) > [06/Jun/2002 13:04:09 01188] [info] Initial (No.1) HTTPS > request received > for child 7 (server suse:443) > [06/Jun/2002 13:04:09 01188] [info] Requesting connection > re-negotiation > [06/Jun/2002 13:04:09 01188] [info] Awaiting re-negotiation handshake > [06/Jun/2002 13:04:09 01188] [error] Certificate > Verification: Error (20): > unable to get local issuer certificate > [06/Jun/2002 13:04:09 01188] [error] Re-negotiation handshake > failed: Not > accepted by client!? > [06/Jun/2002 13:04:09 01188] [error] Certificate > Verification: Error (20): > unable to get local issuer certificate > [06/Jun/2002 13:04:09 01188] [error] SSL
Client Authentication Problem
hi, i created a CA and a ClientKey witch i imported in my Client. in httpd.conf i configured Alias /test/ "/opt/www/test/" Options Indexes Order allow,deny Allow from 192.168.0.142 SSLVerifyClient require SSLVerifyDepth 1 ./logs/ssl_engine_log <== [06/Jun/2002 13:04:06 01186] [info] Connection to child 5 established (server suse:443, client 192.168.0.142) [06/Jun/2002 13:04:06 01186] [info] Seeding PRNG with 23177 bytes of entropy [06/Jun/2002 13:04:06 01186] [info] Connection: Client IP: 192.168.0.142, Protocol: SSLv3, Cipher: EXP-RC4-MD5 (40/128 bits) [06/Jun/2002 13:04:06 01186] [info] Connection to child 5 closed with standard shutdown (server suse:443, client 192.168.0.142) ==> ./logs/access_log <== 192.168.0.142 - - [06/Jun/2002:13:04:07 +0200] "GET /test/ HTTP/1.1" 403 265 ==> ./logs/error_log <== [Thu Jun 6 13:04:07 2002] [error] mod_ssl: Re-negotiation handshake failed: Not accepted by client!? [Thu Jun 6 13:04:07 2002] [error] mod_ssl: SSL error on writing data (OpenSSL library error follows) [Thu Jun 6 13:04:07 2002] [error] OpenSSL: error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure ==> ./logs/ssl_engine_log <== [06/Jun/2002 13:04:07 01187] [info] Connection to child 6 established (server suse:443, client 192.168.0.142) [06/Jun/2002 13:04:07 01187] [info] Seeding PRNG with 23177 bytes of entropy [06/Jun/2002 13:04:07 01187] [info] Connection: Client IP: 192.168.0.142, Protocol: SSLv3, Cipher: EXP-RC4-MD5 (40/128 bits) [06/Jun/2002 13:04:07 01187] [info] Initial (No.1) HTTPS request received for child 6 (server suse:443) [06/Jun/2002 13:04:07 01187] [info] Requesting connection re-negotiation [06/Jun/2002 13:04:07 01187] [info] Awaiting re-negotiation handshake [06/Jun/2002 13:04:07 01187] [error] Re-negotiation handshake failed: Not accepted by client!? [06/Jun/2002 13:04:07 01187] [error] SSL error on writing data (OpenSSL library error follows) [06/Jun/2002 13:04:07 01187] [error] OpenSSL: error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure [06/Jun/2002 13:04:07 01187] [info] Connection to child 6 closed with unclean shutdown (server suse:443, client 192.168.0.142) ==> ./logs/ssl_request_log <== [06/Jun/2002:13:04:07 +0200] 192.168.0.142 SSLv3 (NONE) "GET /test/ HTTP/1.1" 265 ==> ./logs/access_log <== 192.168.0.142 - - [06/Jun/2002:13:04:09 +0200] "GET /test/ HTTP/1.1" 403 265 ==> ./logs/error_log <== [Thu Jun 6 13:04:09 2002] [error] mod_ssl: Certificate Verification: Error (20): unable to get local issuer certificate [Thu Jun 6 13:04:09 2002] [error] mod_ssl: Re-negotiation handshake failed: Not accepted by client!? [Thu Jun 6 13:04:09 2002] [error] mod_ssl: Certificate Verification: Error (20): unable to get local issuer certificate [Thu Jun 6 13:04:09 2002] [error] mod_ssl: SSL error on writing data (OpenSSL library error follows) [Thu Jun 6 13:04:09 2002] [error] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned ==> ./logs/ssl_engine_log <== [06/Jun/2002 13:04:09 01188] [info] Connection to child 7 established (server suse:443, client 192.168.0.142) [06/Jun/2002 13:04:09 01188] [info] Seeding PRNG with 23177 bytes of entropy [06/Jun/2002 13:04:09 01188] [info] Connection: Client IP: 192.168.0.142, Protocol: SSLv3, Cipher: EXP-RC4-MD5 (40/128 bits) [06/Jun/2002 13:04:09 01188] [info] Initial (No.1) HTTPS request received for child 7 (server suse:443) [06/Jun/2002 13:04:09 01188] [info] Requesting connection re-negotiation [06/Jun/2002 13:04:09 01188] [info] Awaiting re-negotiation handshake [06/Jun/2002 13:04:09 01188] [error] Certificate Verification: Error (20): unable to get local issuer certificate [06/Jun/2002 13:04:09 01188] [error] Re-negotiation handshake failed: Not accepted by client!? [06/Jun/2002 13:04:09 01188] [error] Certificate Verification: Error (20): unable to get local issuer certificate [06/Jun/2002 13:04:09 01188] [error] SSL error on writing data (OpenSSL library error follows) [06/Jun/2002 13:04:09 01188] [error] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned [06/Jun/2002 13:04:09 01188] [info] Connection to child 7 closed with unclean shutdown (server suse:443, client 192.168.0.142) ==> ./logs/ssl_request_log <== [06/Jun/2002:13:04:09 +0200] 192.168.0.142 SSLv3 (NONE) "GET /test/ HTTP/1.1" 265 thx for help Jochen __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
client authentication
Hi, i´m trying to use Client Authentication with certificates... so I´m using apache_1.3.22 mod_ssl_2.8.5-1.3.22 openssl-0.9.6c and the apache configurations is like this ServerAdmin [EMAIL PROTECTED] DocumentRoot /home/www-data/443.psmi.com.br ServerName 443.psmi.com.br ScriptAlias /cgi-bin/ "/usr/local/apache/cgi-bin/" LogLevel warn ErrorLog /home/log-data/443.psmi.com.br-error_log CustomLog /home/log-data/443.psmi.com.br-access_log common CustomLog /home/log-data/443.psmi.com.br-referer_log referer CustomLog /home/log-data/443.psmi.com.br-agent_log agent ProxyPass / http://172.16.2.159:8080/443/ ProxyPassReverse / http://172.16.2.159:8080/443/ ProxyPass /misc_ http://172.16.2.159:8080/misc_ ProxyPass /p_ http://172.16.2.159:8080/p_ ProxyVia onSSLEngine onSSLCertificateFile /usr/local/apache-ssl/conf/chaves443/public.crtSSLCertificateKeyFile /usr/local/apache-ssl/conf/chaves443/secureprivate.keySSLCACertificatePath /usr/local/apache-ssl/conf/chaves443/SSLCACertificateFile /usr/local/apache-ssl/conf/chaves443/unicert.cerSSLVerifyClient 2SSLVerifyDepth 10 SSLOptions +StdEnvVars SSLOptions +StdEnvVars SetEnvIf User-Agent ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 and after I show my certificate on the broser I get an error window an the log says so: [Wed Jun 5 09:24:32 2002] [error] mod_ssl: Certificate Verification: Error (20): unable to get local issuer certificate[Wed Jun 5 09:24:32 2002] [error] mod_ssl: SSL handshake failed (server 443.psmi.com.br:443, client 172.16.2.47) (OpenSSL library error follows)[Wed Jun 5 09:24:32 2002] [error] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned could someone help me? any idea? thaks a lot -Edgard JanzenElectrical Engineer (Electronic/Telecom.)PSmi Editora Digital Ltda-E-mail: [EMAIL PROTECTED]Home-page: http://www.psmi.com.br/Address: Rua Brasilio Itiberê, 2928 - SobrelojaRebouças - Curitiba - PR - 80250-160Phone/Fax:(41) 333-3699-
RE: [BugDB] Client Authentication BUG with FakeBasicAuth (PR#695)
After discussing this with the author I realized I had misread the patch.
The new code moves the check in question from before the "if (!SC->bEnabled)" to later
in the sequence:
(check used to be here)
/*
* We decline operation in various situations...
*/
if (!sc->bEnabled)
return DECLINED;
if (ap_ctx_get(r->connection->client->ctx, "ssl") == NULL)
return DECLINED;
if (!(dc->nOptions & SSL_OPT_FAKEBASICAUTH))
return DECLINED;
if (r->connection->user)
return DECLINED;
if ((clientdn = (char *)ap_ctx_get(r->connection->client->ctx, "ssl::client::dn"))
== NULL)
{
/*
* Make sure the user is not able to fake the client certificate
* based authentication by just entering an X.509 Subject DN
* ("/XX=YYY/XX=YYY/..") as the username and "password" as the
* password.
*/
if ((cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) {
.
.
.
This fixes the problem where the check fails the second time through on a subrequest
or internal redirect and catches a spoof attempt in the situation when there is no
client certificate DN.
My only question is: Can a user still "spoof" a FakeBasicAuth request when one of the
other four previous "DECLINED" conditions are true?
Another way to approach the problem might be to keep the check where it was, but
enforce it only when (ap_is_initial_req(r)) is true. The spoof can only be attempted
on the initial request - not on any subrequests or internal redirects and will catch
spoof attempts for all of the "DECLINED" conditions.
Anyone with more experience with this code care to comment?
Rick Barry
Compaq Computer Corporation Compaq Secure Web Server Project Team
110 Spit Brook Road OpenVMS System Software Group
Nashua, NH 03062 Business Critical Server Group
(603) 884-0634
-Original Message-
From: Barry, Richard
Sent: Wednesday, April 24, 2002 10:42 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [BugDB] Client Authentication BUG with FakeBasicAuth
(PR#695)
This submission is missing a conditional expression before line 1161.
What test is performed prior to executing the DN/password check in the
new code?
Rick Barry
Compaq Computer Corporation Compaq Secure Web Server Project Team
110 Spit Brook Road OpenVMS System Software Group
Nashua, NH 03062 Business Critical Server Group
(603) 884-0634
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 6:54 AM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: [BugDB] Client Authentication BUG with FakeBasicAuth (PR#695)
Full_Name: Sergio Rabellino
Version: 2.8.8
OS: Solaris 7
Submission from: (NULL) (130.192.239.73)
The "if" in ssl_engine_kernel.c at line 1130 to check against DN/password
authorization
directly form a client, break also the internal redirect done by apache under
some conditions, as the directory indexing ...
So if you use client auth, with fake basic auth and require an index, you get a
301 followed by a 403 (Forbidden)...
Below i've attached a diff patch to correct this behaviour; i've tested it on my
hosts
and all things should be fine now.
Thanks to Nick Miles for pinpointing me to the solution.
Bye.
---snip
1130,1147d1129
< * Make sure the user is not able to fake the client certificate
< * based authentication by just entering an X.509 Subject DN
< * ("/XX=YYY/XX=YYY/..") as the username and "password" as the
< * password.
< */
< if ((cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) {
< if (strcEQ(ap_getword(r->pool, &cpAL, ' '), "Basic")) {
< while (*cpAL == ' ' || *cpAL == '\t')
< cpAL++;
< cpAL = ap_pbase64decode(r->pool, cpAL);
< cpUN = ap_getword_nulls(r->pool, &cpAL, ':');
< cpPW = cpAL;
< if (cpUN[0] == '/' && strEQ(cpPW, "password"))
< return FORBIDDEN;
< }
< }
<
< /*
1158a1141,1161
> {
> /*
> * Make sure the user is not able to fake the client certificate
> * based authentication by just entering an X.509 Subject DN
> * ("/XX=YYY/XX=YYY/..") as the username and "password" as the
> * password.
> */
> if ((cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) {
> if (strcEQ(ap_getword(r->pool, &cpAL, ' '), "Basic")) {
> while (*cpAL == ' ' || *c
RE: [BugDB] Client Authentication BUG with FakeBasicAuth (PR#695)
This submission is missing a conditional expression before line 1161.
What test is performed prior to executing the DN/password check in the
new code?
Rick Barry
Compaq Computer Corporation Compaq Secure Web Server Project Team
110 Spit Brook Road OpenVMS System Software Group
Nashua, NH 03062 Business Critical Server Group
(603) 884-0634
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 6:54 AM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: [BugDB] Client Authentication BUG with FakeBasicAuth (PR#695)
Full_Name: Sergio Rabellino
Version: 2.8.8
OS: Solaris 7
Submission from: (NULL) (130.192.239.73)
The "if" in ssl_engine_kernel.c at line 1130 to check against DN/password
authorization
directly form a client, break also the internal redirect done by apache under
some conditions, as the directory indexing ...
So if you use client auth, with fake basic auth and require an index, you get a
301 followed by a 403 (Forbidden)...
Below i've attached a diff patch to correct this behaviour; i've tested it on my
hosts
and all things should be fine now.
Thanks to Nick Miles for pinpointing me to the solution.
Bye.
---snip
1130,1147d1129
< * Make sure the user is not able to fake the client certificate
< * based authentication by just entering an X.509 Subject DN
< * ("/XX=YYY/XX=YYY/..") as the username and "password" as the
< * password.
< */
< if ((cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) {
< if (strcEQ(ap_getword(r->pool, &cpAL, ' '), "Basic")) {
< while (*cpAL == ' ' || *cpAL == '\t')
< cpAL++;
< cpAL = ap_pbase64decode(r->pool, cpAL);
< cpUN = ap_getword_nulls(r->pool, &cpAL, ':');
< cpPW = cpAL;
< if (cpUN[0] == '/' && strEQ(cpPW, "password"))
< return FORBIDDEN;
< }
< }
<
< /*
1158a1141,1161
> {
> /*
> * Make sure the user is not able to fake the client certificate
> * based authentication by just entering an X.509 Subject DN
> * ("/XX=YYY/XX=YYY/..") as the username and "password" as the
> * password.
> */
> if ((cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) {
> if (strcEQ(ap_getword(r->pool, &cpAL, ' '), "Basic")) {
> while (*cpAL == ' ' || *cpAL == '\t')
> cpAL++;
> cpAL = ap_pbase64decode(r->pool, cpAL);
> cpUN = ap_getword_nulls(r->pool, &cpAL, ':');
> cpPW = cpAL;
> if (cpUN[0] == '/' && strEQ(cpPW, "password"))
> {
> ssl_log(r->server, SSL_LOG_INFO, "WARNING: Old mod_ssl
breakthrough solicited (FakeBasicAuth by DN) !");
> return FORBIDDEN;
> }
> }
> }
1159a1163
> }
1160a1165
>
--snip
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager[EMAIL PROTECTED]
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager[EMAIL PROTECTED]
[BugDB] Client Authentication BUG with FakeBasicAuth (PR#695)
Full_Name: Sergio Rabellino
Version: 2.8.8
OS: Solaris 7
Submission from: (NULL) (130.192.239.73)
The "if" in ssl_engine_kernel.c at line 1130 to check against DN/password
authorization
directly form a client, break also the internal redirect done by apache under
some conditions, as the directory indexing ...
So if you use client auth, with fake basic auth and require an index, you get a
301 followed by a 403 (Forbidden)...
Below i've attached a diff patch to correct this behaviour; i've tested it on my
hosts
and all things should be fine now.
Thanks to Nick Miles for pinpointing me to the solution.
Bye.
---snip
1130,1147d1129
< * Make sure the user is not able to fake the client certificate
< * based authentication by just entering an X.509 Subject DN
< * ("/XX=YYY/XX=YYY/..") as the username and "password" as the
< * password.
< */
< if ((cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) {
< if (strcEQ(ap_getword(r->pool, &cpAL, ' '), "Basic")) {
< while (*cpAL == ' ' || *cpAL == '\t')
< cpAL++;
< cpAL = ap_pbase64decode(r->pool, cpAL);
< cpUN = ap_getword_nulls(r->pool, &cpAL, ':');
< cpPW = cpAL;
< if (cpUN[0] == '/' && strEQ(cpPW, "password"))
< return FORBIDDEN;
< }
< }
<
< /*
1158a1141,1161
> {
> /*
> * Make sure the user is not able to fake the client certificate
> * based authentication by just entering an X.509 Subject DN
> * ("/XX=YYY/XX=YYY/..") as the username and "password" as the
> * password.
> */
> if ((cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) {
> if (strcEQ(ap_getword(r->pool, &cpAL, ' '), "Basic")) {
> while (*cpAL == ' ' || *cpAL == '\t')
> cpAL++;
> cpAL = ap_pbase64decode(r->pool, cpAL);
> cpUN = ap_getword_nulls(r->pool, &cpAL, ':');
> cpPW = cpAL;
> if (cpUN[0] == '/' && strEQ(cpPW, "password"))
> {
> ssl_log(r->server, SSL_LOG_INFO, "WARNING: Old mod_ssl
breakthrough solicited (FakeBasicAuth by DN) !");
> return FORBIDDEN;
> }
> }
> }
1159a1163
> }
1160a1165
>
--snip
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager[EMAIL PROTECTED]
Re: RePost: Error 403 with Client Authentication - modssl 2.8.8
My guess is a bug...I had the same problem for some time, eventually I found a solution in the archives, I believe it was this one: http://marc.theaimsgroup.com/?l=apache-modssl&m=98995735231070&w=2 So comment out that section of code then recompile and all will be ok. Downside to this will be that the checking for the DN as username to normal basic auth will be allowed through. But Im not sure that worked with it anyhow. Nick Quoting Rabellino Sergio <[EMAIL PROTECTED]>: > Sorry for my repost, > but we continue to get an error if requesting an automatic listing from a > directory under Client Authentication with FakeBasicAuth enabled. > We are using successfully an old release (Apache 1.3.14 / ModSSL 2.7.1 / > OpenSSL 0.9.6), now we would to upgrade our apache engine for the > bugfixes, but even with the 1.2.23/2.8.7 or the 1.3.24/2.8.8 releases, we got > errors "Access Forbidden", with the old config files. > Note that we have these errors persistently and ONLY IF client Authentication > is done with a certificate; if we pass a login/password, we > get the Directory Listing or DirectoryIndex as usual. > > So we believe that there is some tricks about mod_ssl unknown to us... or is > a bug ? > > Thanks. > -- > Dott. Sergio Rabellino __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
RePost: Error 403 with Client Authentication - modssl 2.8.8
Sorry for my repost, but we continue to get an error if requesting an automatic listing from a directory under Client Authentication with FakeBasicAuth enabled. We are using successfully an old release (Apache 1.3.14 / ModSSL 2.7.1 / OpenSSL 0.9.6), now we would to upgrade our apache engine for the bugfixes, but even with the 1.2.23/2.8.7 or the 1.3.24/2.8.8 releases, we got errors "Access Forbidden", with the old config files. Note that we have these errors persistently and ONLY IF client Authentication is done with a certificate; if we pass a login/password, we get the Directory Listing or DirectoryIndex as usual. So we believe that there is some tricks about mod_ssl unknown to us... or is a bug ? Thanks. -- Dott. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) Member of the Internet Society http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Error Page for Client Authentication Failure
Hi Is there a possibility in mod_ssl to define an Error Page for the case when a required Client Autentication fails? I haven't come across anything appropriate in the documentation, however I thought there really should be something like this. Bye Tim __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Problems with Client authentication and access control
Hello.
I have successfuly done Client Authentication using client certificates with
apache-openssl-modssl.
SSLVerifyClient none
SSLVerifyClient require
SSLVerifyDepth 5
#SSLCACertificateFile conf/ssl.crt/ca.crt
#SSLCACertificatePath conf/ssl.crt
SSLOptions +FakeBasicAuth
SSLRequireSSL
SSLRequire %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." and \
%{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"}
The definition of SSLCACertificateFile and SSLCACertificatePath are above in
the httpd.conf file.
When i try to connect to https:/www.xxx.xx/secure the server asks for the
certificate, validates it and show index.html in the secure directory.
Everything seem to work fine.
But when i do a http://www.xxx.xx/secure I can still see the index.html.
According to my understanding the index.html in the secure directory should not
be shown. Can anyone help me with this? Is there anything more i should do to
prevent access from http on the secure directory?
Thanx
Haldor Husby.
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager[EMAIL PROTECTED]
Re: .htaccess not processed with client authentication
Mads Toftum wrote: [EMAIL PROTECTED]"> On Fri, Mar 08, 2002 at 09:46:42AM +0800, Angus Lee wrote: Hi, Try to put all these directives in httpd.conf file andalso try to put the SSLRequire directive as follows But I want each user to set their client authentication access control to their directory.Is there any bug with previous versions of mod_ssl which would make client authentication fails? Not in any of the recent versions ... but since you seem to be wanting.htaccess (I missed the beginning of this question) - have you made surethat AllowOverride allows the usage of .htaccess within those directories?http://httpd.apache.org/docs/mod/core.html#allowoverridevhMads Toftum I FOUND A BUG!! At least I think I did... If you have the following http://www.virtual1.com/directory/securedirectory http://www.virtual2.com/directory/securedirectory and on the file system virtual1.com DocumeentRoot is /usr/local/virtual1/directory/securedirectory and virtual2.com DocumentRoot is /usr/local/virtual2/directory/securedirectory --> /usr/local/virtual1/directory/securdierectory the .htaccess file in /usr/local/virtual1/directory/securedirectory will NOT be processed for virtual2.com. I tried this MANY MANY MANY times. Apache 1.3.22. The .htaccess file is not honored via a sym-link. Go figure... Don't dare tell me I'm wrong...this was my experience. If it works for you, great...this is just something to watch out for. I had to remove my Symlinks and copy directory contents to make virtual2.com work. I went up and down my httpd.conf file. BOTH virtual domains work correctly UNTIL I make a directory shared. There was a entry in my httpd.conf for with allow overrides options. I did NOT try /usr/local/shared/securedirectory /usr/local/virtual1/directory/securedirectory --> /usr/local/shared/securedirectory /usr/local/virtual2/directory/securedirectory --> /usr/local/shared/securedirectory I'd be interesting, however, to see what happens. My suspicion is that the .htaccess file won't be processed because of the symlink. I suspect you will also need a /usr/local/shared/securedirectory directory section with allow overrides...but really you shouldn't since the followsymlink options should honor the options of the "Parent" directory. IMHO. JDB -- Signature James Barwick VP Technology ジェームス・バーウィック バイス・プレジデント・テクノロジー Sentient Health Japan, KK Aoyama Palacio Tower 11F 3-6-7 Kita-Aoyama Minatu-ku, Tokyo 107-0061 センティエント・ヘルス・ジャパン株式会社 〒107-0061 東京都港区青山3-6-7 青山パラシオタワー 11階 Tel: (03) 5778-7524 Fax: (03) 5778-7676 mailto:[EMAIL PROTECTED] http://www.sentienthealth.com Tel: (03) 5778-7524 Fax: (03) 5778-7676 mailto:[EMAIL PROTECTED] http://www.sentienthealth.com
Re: .htaccess not processed with client authentication
Hi, > ..htaccess (I missed the beginning of this question) - have you made sure > that AllowOverride allows the usage of .htaccess within those directories? Yes I do have something like this on my httpd.conf file: AllowOverride Options AuthConfig Limit Options Includes ExecCGI Will mod_ssl break when there're too many simutaneous accesses? Angus Lee __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: .htaccess not processed with client authentication
On Fri, Mar 08, 2002 at 09:46:42AM +0800, Angus Lee wrote: > Hi, > > > Try to put all these directives in httpd.conf file and > > also try to put the SSLRequire directive as follows > > But I want each user to set their client authentication access control to their >directory. > > Is there any bug with previous versions of mod_ssl which would make client >authentication fails? > Not in any of the recent versions ... but since you seem to be wanting .htaccess (I missed the beginning of this question) - have you made sure that AllowOverride allows the usage of .htaccess within those directories? http://httpd.apache.org/docs/mod/core.html#allowoverride vh Mads Toftum -- With a rubber duck, one's never alone. -- "The Hitchhiker's Guide to the Galaxy" __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: .htaccess not processed with client authentication
Hi, > Try to put all these directives in httpd.conf file and > also try to put the SSLRequire directive as follows But I want each user to set their client authentication access control to their directory. Is there any bug with previous versions of mod_ssl which would make client authentication fails? Angus Lee __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: .htaccess not processed with client authentication
Try to put all these directives in httpd.conf file and
also try to put the SSLRequire directive as follows
SSLRequire %{SSL_CLIENT_M_SERIAL} eq "A6"
-- Shiva
--- Angus Lee <[EMAIL PROTECTED]> wrote:
> Hi, list,
>
> I used .htaccess to add client authentication to
> access a particular directory. However it seems that
> .htaccess is not processed occassionally when http
> request is made to an object in that directory.
> Anything wrong with my configuration?
>
> SSLRequireSSL
> SSLVerifyClient require
> SSLVerifyDepth 1
> SSLRequire %{SSL_CLIENT_M_SERIAL} eq "A6"
>
> And when requet to a file requires client
> authentication, the server would return 'Internal
> Server Probelm' after a long run. Is my server
> having too few resources? Please help. Thank you.
>
> Angus Lee
>
__
> Apache Interface to OpenSSL (mod_ssl)
>www.modssl.org
> User Support Mailing List
> [EMAIL PROTECTED]
> Automated List Manager
[EMAIL PROTECTED]
__
Do You Yahoo!?
Try FREE Yahoo! Mail - the world's greatest free email!
http://mail.yahoo.com/
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager[EMAIL PROTECTED]
.htaccess not processed with client authentication
Hi, list,
I used .htaccess to add client authentication to access a particular directory.
However it seems that .htaccess is not processed occassionally when http request is
made to an object in that directory. Anything wrong with my configuration?
SSLRequireSSL
SSLVerifyClient require
SSLVerifyDepth 1
SSLRequire %{SSL_CLIENT_M_SERIAL} eq "A6"
And when requet to a file requires client authentication, the server would return
'Internal Server Probelm' after a long run. Is my server having too few resources?
Please help. Thank you.
Angus Lee
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager[EMAIL PROTECTED]
unable to configure the client authentication,why?
Dear all: I have installed apache+mod_ssl+openssl on the windows 2000,and I also create the server cert and key,and the apache with openssl can works well. but when I want to configure the client authentication,it can not start. my configure looks like: SSLMutex sem SSLRandomSeed startup builtin SSLSessionCache none SSLLog logs/SSL.log SSLLogLevel debug SSLVerifyClient requie SSLVerifyDepth 2 SSLCACertificateFile conf/ssl/cacert.der SSLEngine On SSLCertificateFile conf/ssl/server.der SSLCertificateKeyFile conf/ssl/server2.key and when I look the error log ,the ssl.log looks like: Init: Generating temporary RSA private keys (512/1024 bits) Init: Configuring temporary DH parameters (512/1024 bits) Init: Seeding PRNG with 136 bytes of entropy Init: Configuring temporary RSA private keys (512/1024 bits) Init: Configuring temporary DH parameters (512/1024 bits) Init: Initializing (virtual) servers for SSL Init: Configuring server bigworm:443 for SSL protocol Init: (bigworm:443) Creating new SSL context (protocols: SSLv2, SSLv3, TLSv1) Init: (bigworm:443) Configuring client authentication [error] Init: (bigworm:443) Unable to configure verify locations for client authentication = http://news.163.com/editor/etalk.html ÍøÑÔÒ×ÓÆß×ì°ËÉà´ó¼Ò˵ http://love.163.com ´ºÌ컨»á¿ª£¬Äк¢Å®º¢ÒªÁµ°®¡« http://vip.163.com ÍøÒ×VIPÓÊÏä 30ÃëÁ¢µÃ __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
unable to configure the client authentication,why?
Dear all: I have installed apache+mod_ssl+openssl on the windows 2000,and I also create the server cert and key,and the apache with openssl can works well. but when I want to configure the client authentication,it can not start. my configure looks like: SSLMutex sem SSLRandomSeed startup builtin SSLSessionCache none SSLLog logs/SSL.log SSLLogLevel debug SSLVerifyClient requie SSLVerifyDepth 2 SSLCACertificateFile conf/ssl/cacert.der SSLEngine On SSLCertificateFile conf/ssl/server.der #cert SSLCertificateKeyFile conf/ssl/server2.key = http://news.163.com/editor/etalk.html ÍøÑÔÒ×ÓÆß×ì°ËÉà´ó¼Ò˵ http://love.163.com ´ºÌ컨»á¿ª£¬Äк¢Å®º¢ÒªÁµ°®¡« http://vip.163.com ÍøÒ×VIPÓÊÏä 30ÃëÁ¢µÃ __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication
On Tue, Oct 23, 2001 at 07:44:35AM -0300, Marcelo Maraboli wrote: > Hello. > > Has anyone successfuly done Client Authentication using client > certificates with apache-openssl-modssl ? (server has self signed > certificate and Client has a GlobalSign Certificate) > works just fine for me. > or knows about a good tutorial? See http://www.modssl.org/docs/2.8/ssl_howto.html#ToC6 vh Mads Toftum -- With a rubber duck, one's never alone. -- "The Hitchhiker's Guide to the Galaxy" __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Client Authentication
Hello. Has anyone successfuly done Client Authentication using client certificates with apache-openssl-modssl ? (server has self signed certificate and Client has a GlobalSign Certificate) or knows about a good tutorial? thanks... -- Marcelo Maraboli Rosselott Ingeniero Civil Electronico Jefe Area de Redes (Electronic Civil Engineer) (Chief Network & Systems Admin) Direccion Central de Servicios Computacionales (DCSC) Universidad Tecnica Federico Santa Maria, Chile. mailto:[EMAIL PROTECTED] http://elqui.dcsc.utfsm.cl/ --/ S/MIME Cryptographic Signature
RE: Re: SSL client authentication access to Perl script
Hi, > Easy way to check - make a normal HTTP virtualhost with the same > content/functionality and see if you get the same problem. I guess the hang-up is due to DBD::mysql. I found that the CPU usage drmatically increased to 80% when accessing the mySQL database using DBD::mysql Perl module. However I still couldn't figured out which statement caused the hang-up. Angus Lee __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: SSL client authentication access to Perl script
Angus Lee wrote: > > I'm not sure if SSL client authentication used up all my system resources and CPU >processing power or my poor Perl programming technique leads to the fault. Can >someone help? Thank you. > Easy way to check - make a normal HTTP virtualhost with the same content/functionality and see if you get the same problem. Rgds, Owen Boyle. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
SSL client authentication access to Perl script
Hi, I've written a Perl script which must be invoked through the web browser by using SSL client authentication mode. On the server which this Perl script runs, it also runs a mySQL database server. This server runs Windows 2000 Server. My Perl script will first do some checking by querying from a Oracle database using DBD::Oracle Perl module. Then after some user inputs, the form data will be entered to the mySQL database using the DBD::mysql Perl module. However after running the Perl script for several times, the machine slows down. I found that the CPU usage is 100%. When I move this Perl script to another machine which does not run mySQL database, the problem is not so obvious. The response from the Perl script would also be very long after running the script for, say, 20 times. I'm not sure if SSL client authentication used up all my system resources and CPU processing power or my poor Perl programming technique leads to the fault. Can someone help? Thank you. Angus Lee __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: client authentication falied when client cert issued by VeriSign!!
On Sun, Sep 16, 2001 at 10:16:12PM +0800, joan wang wrote: > I haved try many method, but can't solve my problem. > I configure my apache in client authentication. After client choosing user >login(user can choose viewer), the connection is disconnect(authentication failed). >But if client choose the user cert issued by apache(not third party CA), the >connction is success!! > Pls tell me how to configure..thanks so much.. > Try setting SSLLogLevel debug and take a look in the logfile - or tell us the exact error that you get from the browser. It looks as it could be the client that doesn't have the right kind of certificate. > ==my httpd.conf== > SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt > SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key > SSLCACertificatePath /usr/local/apache/conf/ssl.crt > (I have put the veriSign cert in this directory) If you use the SSLCACertificatePath then remember to run a make update in that directory. > SSLCACertificateFile /usr/local/apache/conf/ssl.crt/ca-bundle.crt > (including the veriSign certificate(PEM format) You really shouldn't mix SSLCACertificatePath and SSLCACertificateFile one of them should be enough. I'm assuming that you also have stuff like SSLEngine on and SSLVerifyClient require in the right places in your config. vh Mads Toftum -- With a rubber duck, one's never alone. -- "The Hitchhiker's Guide to the Galaxy" __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
client authentication falied when client cert issued by VeriSign!!
I haved try many method, but can't solve my problem. I configure my apache in client authentication. After client choosing user login(user can choose viewer), the connection is disconnect(authentication failed). But if client choose the user cert issued by apache(not third party CA), the connction is success!! Pls tell me how to configure..thanks so much.. ==my httpd.conf== SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key SSLCACertificatePath /usr/local/apache/conf/ssl.crt (I have put the veriSign cert in this directory) SSLCACertificateFile /usr/local/apache/conf/ssl.crt/ca-bundle.crt (including the veriSign certificate(PEM format)
Re: POST method with client authentication
Is this a ModSSL-Question? In Apache there is a directive called Limit where you can allow or disallow GET, POST, HEAD, ... As the Credentials are sent to .../examine.pl, because you have authenticated yourself successfully at .../private/, there should be no problem! GreetingX, Alex --- Angus Lee <[EMAIL PROTECTED]> schrieb: > Hi, > > I've installed OpenSA 1.0b3 on Windows 2000 Server. Everything in > http://localhost/cgi-bin/private need client authentication to access. When I use >the POST > method to post some form data to a CGI program >http://localhost/cgi-bin/private/examine.pl I got > the following error: > --- > 405 Method not allowed > > The method you attempted to use is not allowed for the resource identified by the >Request-URI. > That method is either disallowed or not supported on this resource. Common methods >are 'HEAD', > 'GET', 'POST', and 'PUT'. POST and PUT are frequently disabled, per resource, on >this server. > Perhaps you may request this resource using another method. 'GET' is available for >most > resources. > --- > > Does anyone know what wrong with my configuration? Can I use POST method with client > authentication? I know some people have asked similar question before, but is there >any way for > the Perl script to use client authentication and pass, say, about 1-2k form data to >that Perl > script? > > Please help me. Thank you. > > Angus Lee > __ > Apache Interface to OpenSSL (mod_ssl) www.modssl.org > User Support Mailing List [EMAIL PROTECTED] > Automated List Manager[EMAIL PROTECTED] __ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
POST method with client authentication
Hi, I've installed OpenSA 1.0b3 on Windows 2000 Server. Everything in http://localhost/cgi-bin/private need client authentication to access. When I use the POST method to post some form data to a CGI program http://localhost/cgi-bin/private/examine.pl I got the following error: --- 405 Method not allowed The method you attempted to use is not allowed for the resource identified by the Request-URI. That method is either disallowed or not supported on this resource. Common methods are 'HEAD', 'GET', 'POST', and 'PUT'. POST and PUT are frequently disabled, per resource, on this server. Perhaps you may request this resource using another method. 'GET' is available for most resources. --- Does anyone know what wrong with my configuration? Can I use POST method with client authentication? I know some people have asked similar question before, but is there any way for the Perl script to use client authentication and pass, say, about 1-2k form data to that Perl script? Please help me. Thank you. Angus Lee __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication - reviewers wanted
On 9 Jul 2001, at 9:35, Dan Langille wrote: > I've just finished writing a how-to for setting up client authentication > using self-signed certficates. It includes details of creating the > certificate authority, signing the certificate, web server configuration, and > installing the certificate in a browser. In this instance, I'm using > Apache, OpenSSL, and MSIE. > > I'm looking for people to review the article from a techincal point of view > (I'm more concerned with technical errors at this point rather than > spelling mistakes). Once the review recommendations are completed, > the article will be publicly available. To that end, I'd prefer to provide the > URL only to people who are knowledgable in this area. Please contact > me for the URL. Thanks to the many people that offerred to review the article. Special thanks to those that found the time to provide feedback. The article can be found at http://freebsddiary.org/openssl-client-authentication.php cheers -- Dan Langille pgpkey - finger [EMAIL PROTECTED] | http://unixathome.org/finger.php __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication - reviewers wanted
I voluteer as well, if it is not too late. --- G & S Sistemas de Informacion, S.L. | Teléfono: 9 02 01 44 43 Victoriano Giralt| Land line: +34-952-207-241 Chief Consultant and Owner | Mobile:+34-670-332-720 Torre de San Telmo, 8| Fax: Use e-mail, is nicer E-29018 Malaga (Spain) | E-mail: [EMAIL PROTECTED] Member of ISOC (Andalusian Chapter) | http://www.gssi.es/ --- __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication - reviewers wanted
On 10 Jul 2001, at 15:47, Owen Boyle wrote: > Er to be precise, the majordomo program *adds* a "Reply-To" field to > the header. This takes precedence over the "From" field when you click > "reply". That, in my experience, it not the default behaviour of majordomo. You have to do something extra to majordomo to make it do that. > This behaviour is entirely correct for an automated list where the > default is that traffic is kept on the list. If you want to go private, you > have to extract the e-mail address manually :-) This point is often debated. Rarely resolved. -- Dan Langille pgpkey - finger [EMAIL PROTECTED] | http://unixathome.org/finger.php __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication - reviewers wanted
Dan Langille wrote: > My apologies. I sent a message to the list when it should have gone > privately.[1] No problem - easy mistake to make. > [1] - Unfortunately, the list mangles the reply-to address and sets it to > the list, not the person who sent the email. Er to be precise, the majordomo program *adds* a "Reply-To" field to the header. This takes precedence over the "From" field when you click "reply". This behaviour is entirely correct for an automated list where the default is that traffic is kept on the list. If you want to go private, you have to extract the e-mail address manually :-) rgds, Owen Boyle. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client authentication - reviewers wanted
My apologies. I sent a message to the list when it should have gone privately.[1] Don't bother looking for the URL below. It's gone. The reviewers have the correct URL. Sorry for posting to the list when it should have gone private. [1] - Unfortunately, the list mangles the reply-to address and sets it to the list, not the person who sent the email. While this may be convenient for some, it's led to this unfortunate incident. Sending a public message to a individual isn't a big deal. Sending a private message to the list is a problem. On 10 Jul 2001, at 7:35, Dan Langille wrote: > Thanks. You can find the work in progress at: > http://diary.unixathome.org/openssl-client-authentication.php > Eventually the document will be moved to the public site at > http://freebsddiary.org/. > > The areas I have doubts about are: "Create the secure area of your > website", specifically: SSLCipherSuite. I'm not sure that's required yet. > > I'm also about to change the first picture provided under "Import the > certificate": http://diary.unixathome.org/showpicture.php?id=26 > > > On 10 Jul 2001, at 8:49, [EMAIL PROTECTED] wrote: > > > This is an S/MIME signed message. > > > > -z41025_boundary_sign > > Content-Type: multipart/alternative; boundary="=_alternative > > 00255912C1256A85_=" > > > > This is a multipart message in MIME format. > > --=_alternative 00255912C1256A85_= > > Content-Type: text/plain; charset="iso-8859-1" > > Content-Transfer-Encoding: quoted-printable > > > > Yes, > > > > I can review your "How-To" ! > > > > Sylvain > > > > - > > -- = - Sylvain Maret Senior Security Engineer > > - Strategic Director e-Xpert Solutions SA Route de Pr=E9-Marais 29 1233 > > Bernex / Geneva Switzerland > > > > Tel: +41 22 727 05 55 > > Fax: +41 22 727 05 50 > > Mail: [EMAIL PROTECTED] > > > > > > > > > > "Dan Langille" <[EMAIL PROTECTED]> > > Sent by: [EMAIL PROTECTED] > > 09.07.2001 15:35 > > Please respond to modssl-users > > > > =20 > > To: [EMAIL PROTECTED] > > cc:=20 > > Subject:Client authentication - reviewers wanted > > > > > > I've just finished writing a how-to for setting up client > > authentication=20 using self-signed certficates. It includes details of > > creating the=20 certificate authority, signing the certificate, web > > server configuration,=20 and=20 installing the certificate in a browser. > > In this instance, I'm using=20 Apache, OpenSSL, and MSIE. > > > > I'm looking for people to review the article from a techincal point of=20 > > view=20 (I'm more concerned with technical errors at this point rather > > than=20 spelling mistakes). Once the review recommendations are > > completed,=20 the article will be publicly available. To that end, I'd > > prefer to=20 provide the=20 URL only to people who are knowledgable in > > this area. Please contact=20 me for the URL. > > > > Thanks. > > > > --=20 > > Dan Langille > > pgpkey - finger [EMAIL PROTECTED] | http://unixathome.org/finger.php > > =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= > > 5F = > > =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= > > 5F = =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F Apache > > Interface to OpenSSL (mod=5Fssl) www.modssl.org User > > Support Mailing List [EMAIL PROTECTED] > > Automated List Manager[EMAIL PROTECTED] > > > > > > > > --=_alternative 00255912C1256A85_= > > Content-Type: text/html; charset="iso-8859-1" > > Content-Transfer-Encoding: quoted-printable > > > > > > Yes, > > > > I can review your > > "How-To"= > > ! > > > > Sylvain > > > > ----- > > -- = - Sylvain Maret Senior Security > > Engineer - Strategic Director e-Xpert Solutions SA Route de > > Pr=E9-Marais 29 1233 Bernex / Geneva Switzerland Tel: > > +41 22 727 05 55 Fax: +41 22 727 05 50 Mail: > > [EMAIL PROTECTED] > valign=3Dtop> "Dan > > Langille" <dan@= langille.org> > face=3D"s
Re: Client authentication - reviewers wanted
Thanks. You can find the work in progress at: http://diary.unixathome.org/openssl-client-authentication.php Eventually the document will be moved to the public site at http://freebsddiary.org/. The areas I have doubts about are: "Create the secure area of your website", specifically: SSLCipherSuite. I'm not sure that's required yet. I'm also about to change the first picture provided under "Import the certificate": http://diary.unixathome.org/showpicture.php?id=26 On 10 Jul 2001, at 8:49, [EMAIL PROTECTED] wrote: > This is an S/MIME signed message. > > -z41025_boundary_sign > Content-Type: multipart/alternative; boundary="=_alternative > 00255912C1256A85_=" > > This is a multipart message in MIME format. > --=_alternative 00255912C1256A85_= > Content-Type: text/plain; charset="iso-8859-1" > Content-Transfer-Encoding: quoted-printable > > Yes, > > I can review your "How-To" ! > > Sylvain > > --- > = - Sylvain Maret Senior Security Engineer - > Strategic Director e-Xpert Solutions SA Route de Pr=E9-Marais 29 1233 > Bernex / Geneva Switzerland > > Tel: +41 22 727 05 55 > Fax: +41 22 727 05 50 > Mail: [EMAIL PROTECTED] > > > > > "Dan Langille" <[EMAIL PROTECTED]> > Sent by: [EMAIL PROTECTED] > 09.07.2001 15:35 > Please respond to modssl-users > > =20 > To: [EMAIL PROTECTED] > cc:=20 > Subject:Client authentication - reviewers wanted > > > I've just finished writing a how-to for setting up client authentication=20 > using self-signed certficates. It includes details of creating the=20 > certificate authority, signing the certificate, web server > configuration,=20 and=20 installing the certificate in a browser. In this > instance, I'm using=20 Apache, OpenSSL, and MSIE. > > I'm looking for people to review the article from a techincal point of=20 > view=20 (I'm more concerned with technical errors at this point rather > than=20 spelling mistakes). Once the review recommendations are > completed,=20 the article will be publicly available. To that end, I'd > prefer to=20 provide the=20 URL only to people who are knowledgable in this > area. Please contact=20 me for the URL. > > Thanks. > > --=20 > Dan Langille > pgpkey - finger [EMAIL PROTECTED] | http://unixathome.org/finger.php > =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F > = > =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F > = =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F Apache > Interface to OpenSSL (mod=5Fssl) www.modssl.org User > Support Mailing List [EMAIL PROTECTED] Automated > List Manager[EMAIL PROTECTED] > > > > --=_alternative 00255912C1256A85_= > Content-Type: text/html; charset="iso-8859-1" > Content-Transfer-Encoding: quoted-printable > > > Yes, > > I can review your > "How-To"= > ! > > Sylvain > > --- > = - Sylvain Maret Senior Security > Engineer - Strategic Director e-Xpert Solutions SA Route de > Pr=E9-Marais 29 1233 Bernex / Geneva Switzerland Tel: +41 > 22 727 05 55 Fax: +41 22 727 05 50 Mail: > [EMAIL PROTECTED] valign=3Dtop> "Dan > Langille" <dan@= langille.org> face=3D"sans-serif">Sent by: [EMAIL PROTECTED]= rg > 09.07.2001 15:35 size=3D1 face=3D"sans-serif">Please respond to modssl-users > > To: > &nbs= p; [EMAIL PROTECTED] size=3D1 face=3D"sans-serif"> cc: &nbs= p; > > Subject:= > Client authentication - reviewers > wanted= > > > > I've just finished writing a > how-to= > for setting up client authentication > using self-signed certficates. It includes details of creating the > certificate authority, signing the certificate, web server > configuration, a= nd installing the certificate in a browser. In > this instance, I'm using = Apache, OpenSSL, and MSIE. I'm > looking for people to review the article from a techincal point of view= > > (I'm more concerned with technical errors at this point rather than > spelling mistakes). Once the review recommendations are completed, > the article will be publicly available. To that end, I'd > prefer to pr= ovide the URL only to people who are
Re: Client authentication - reviewers wanted
Yes, I can review your "How-To" ! Sylvain Sylvain Maret Senior Security Engineer - Strategic Director e-Xpert Solutions SA Route de Pré-Marais 29 1233 Bernex / Geneva Switzerland Tel: +41 22 727 05 55 Fax: +41 22 727 05 50 Mail: [EMAIL PROTECTED] "Dan Langille" <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 09.07.2001 15:35 Please respond to modssl-users To: [EMAIL PROTECTED] cc: Subject: Client authentication - reviewers wanted I've just finished writing a how-to for setting up client authentication using self-signed certficates. It includes details of creating the certificate authority, signing the certificate, web server configuration, and installing the certificate in a browser. In this instance, I'm using Apache, OpenSSL, and MSIE. I'm looking for people to review the article from a techincal point of view (I'm more concerned with technical errors at this point rather than spelling mistakes). Once the review recommendations are completed, the article will be publicly available. To that end, I'd prefer to provide the URL only to people who are knowledgable in this area. Please contact me for the URL. Thanks. -- Dan Langille pgpkey - finger [EMAIL PROTECTED] | http://unixathome.org/finger.php __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] S/MIME Cryptographic Signature
Re: Client authentication - reviewers wanted
Hello, Pls give me your document Regards, Thanh Binh Dan Langille wrote: > I've just finished writing a how-to for setting up client authentication > using self-signed certficates. It includes details of creating the > certificate authority, signing the certificate, web server configuration, and > installing the certificate in a browser. In this instance, I'm using > Apache, OpenSSL, and MSIE. > > I'm looking for people to review the article from a techincal point of view > (I'm more concerned with technical errors at this point rather than > spelling mistakes). Once the review recommendations are completed, > the article will be publicly available. To that end, I'd prefer to provide the > URL only to people who are knowledgable in this area. Please contact > me for the URL. > > Thanks. > > -- > Dan Langille > pgpkey - finger [EMAIL PROTECTED] | http://unixathome.org/finger.php > __ > Apache Interface to OpenSSL (mod_ssl) www.modssl.org > User Support Mailing List [EMAIL PROTECTED] > Automated List Manager[EMAIL PROTECTED] __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Client authentication - reviewers wanted
I've just finished writing a how-to for setting up client authentication using self-signed certficates. It includes details of creating the certificate authority, signing the certificate, web server configuration, and installing the certificate in a browser. In this instance, I'm using Apache, OpenSSL, and MSIE. I'm looking for people to review the article from a techincal point of view (I'm more concerned with technical errors at this point rather than spelling mistakes). Once the review recommendations are completed, the article will be publicly available. To that end, I'd prefer to provide the URL only to people who are knowledgable in this area. Please contact me for the URL. Thanks. -- Dan Langille pgpkey - finger [EMAIL PROTECTED] | http://unixathome.org/finger.php __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Client Authentication
Hello, I meet this problem before. It's seems this is a strange behavior from Netscape. The work around is to force the browser to present the Client Certificate. In netscape you can set up this option in Security --> Navigator --> Certificate to identify you to a web site: choose Sylvain Sylvain Maret Senior Security Engineer e-Xpert Solutions SA Route de Pré-Marais 29 1233 Bernex / Geneva Switzerland Tel: +41 22 727 05 55 Fax: +41 22 727 05 50 Mail: [EMAIL PROTECTED] Hatop Goetz <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 07.06.2001 21:25 Please respond to modssl-users To: [EMAIL PROTECTED] cc: Subject: Client Authentication Hi, I have managed to get client authentification working on a directory basis. That is, apache ask for client certificate when I try to access a file in that directory, I am telling netscape to send my cclient cert and I do get the page requested. Thats fine so far, but when I try to get another page from that directory orf even the same page again, apache asks me again for a client cerrtificate, so I am having to send my client cert for evrey page again and again and again.. can someone please point me into the direction where to look further ? I would really like to get this running.. any helpappreciated, Goetz. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] S/MIME Cryptographic Signature
Client Authentication
Hi, I have managed to get client authentification working on a directory basis. That is, apache ask for client certificate when I try to access a file in that directory, I am telling netscape to send my cclient cert and I do get the page requested. Thats fine so far, but when I try to get another page from that directory orf even the same page again, apache asks me again for a client cerrtificate, so I am having to send my client cert for evrey page again and again and again.. can someone please point me into the direction where to look further ? I would really like to get this running.. any helpappreciated, Goetz. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
[BugDB] client authentication (PR#567)
Full_Name: R.Chu Version: mod_ssl-2.7.1-1.3.14 OS: Redhat Linux 7.0 Submission from: (NULL) (61.187.56.10) I have installed mod_ssl-2.7.1-1.3.14 with apache_1.3.14 and openssl-0.9.6a successfully. Now I want to get client authentication, I modified the httpd.conf as this: SSLVerifyClient require SSLVerifyDepth 1 SSLCACertificatePath /usr/apache-ssl/conf/ssl.crt SSLCACertificateFile /usr/apache-ssl/conf/ssl.crt/ca.crt Of course, I have made a personal certificate(.p12) and put it into my Internet Explorer, the certificate of my own CA is also available. But when I test it, the connection interrupt after I choose the personal certificate from IE. This is my log file of apache: [root@grid96 logs]# more ssl_engine_log .. [22/May/2001 10:26:05 27437] [info] Connection to child 0 established (server grid96:443, client 172.26.20.187) [22/May/2001 10:26:05 27437] [info] Seeding PRNG with 1160 bytes of entropy [22/May/2001 10:26:05 27437] [info] Spurious SSL handshake interrupt[Hint: Usually just one of those OpenSSL confusions!?] (OpenSSL library error follows) [22/May/2001 10:26:05 27437] [info] OpenSSL: error:0200100D:system library:fopen:Permission denied [22/May/2001 10:26:05 27437] [info] OpenSSL: error:20074002:BIO routines:FILE_CTRL:system lib [22/May/2001 10:26:05 27437] [info] OpenSSL: error:0B06F002:x509 certificate routines:X509_load_cert_file:system lib [22/May/2001 10:26:07 27441] [info] Connection to child 4 established (server grid96:443, client 172.26.20.187) [22/May/2001 10:26:07 27441] [info] Seeding PRNG with 1160 bytes of entropy [22/May/2001 10:26:07 27441] [error] Certificate Verification: Error (26): unsupported certificate purpose [22/May/2001 10:26:07 27441] [info] Spurious SSL handshake interrupt[Hint: Usually just one of those OpenSSL confusions!?] (OpenSSL library error follows) [22/May/2001 10:26:07 27441] [info] OpenSSL: error:0200100D:system library:fopen:Permission denied [22/May/2001 10:26:07 27441] [info] OpenSSL: error:20074002:BIO routines:FILE_CTRL:system lib [22/May/2001 10:26:07 27441] [info] OpenSSL: error:0B06F002:x509 certificate routines:X509_load_cert_file:system lib [22/May/2001 10:26:07 27441] [info] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned I do not know what's the wrong with it, would you please tell me? Thanks a lot! __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
REPOST: Interesting issue with Client Authentication
I'm going to do one repost in hopes that I get an answer to this. This really has me stumped. Hello, I've read the faq and the docs, I've scoured the mailing list, and I can not find the answer to this. I'm trying to setup client cert authentication. I have a Verisign signed personal cert on my browser, and for now, a self signed cert on the server. When I try to connect to the site, it prompts me twice for the certificate to send, and then returns "Cannot find server". Here is the lines from the error log: [Thu May 10 10:56:51 2001] [error] mod_ssl: Certificate Verification: Error (7): certificate signature failure [Thu May 10 10:56:51 2001] [error] mod_ssl: SSL handshake failed (server repsystem.amntv.com:443, client 207.138.31.11) (OpenSSL library error follows) [Thu May 10 10:56:51 2001] [error] OpenSSL: error:0D07908D:asn1 encoding routines:ASN1_verify:unknown message digest algorithm [Thu May 10 10:56:51 2001] [error] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned [Thu May 10 10:56:52 2001] [error] mod_ssl: Certificate Verification: Error (7): certificate signature failure [Thu May 10 10:56:52 2001] [error] mod_ssl: SSL handshake failed (server repsystem.amntv.com:443, client 207.138.31.11) (OpenSSL library error follows) [Thu May 10 10:56:52 2001] [error] OpenSSL: error:0D07908D:asn1 encoding routines:ASN1_verify:unknown message digest algorithm [Thu May 10 10:56:52 2001] [error] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Here is the entry in my apache config: DocumentRoot /home/repsys/html ServerName repsystem.amntv.com ServerAdmin [EMAIL PROTECTED] TransferLog /home/repsys/logs/secure.xfer ErrorLog /home/repsys/logs/secure.error SSLEngine on SSLCertificateFile /etc/httpd/conf/ssl.crt/repsystem.amntv.com.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/repsystem.amntv.com.key SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown SSLVerifyClient require SSLVerifyDepth 10 SSLOptions +ExportCertData +StdEnvVars SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLCertificateChainFile /etc/httpd/conf/ssl.crt/repsystem.amntv.com.crt Options Indexes Includes FollowSymLinks ExecCGI AllowOverride All Order allow,deny Allow from all AllowOverride None Options ExecCGI Order allow,deny Allow from all I can connect to the HTTPS server just fine if I change SSLVerifyClient to none. So I'm sure it has to do with the personal certs, but for the life of me I can't figure out WHAT it has to do with themI'm truly sorry if this has been answered before, but I was unable to find any information regarding this. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Interesting issue with Client Authentication
Hello, I've read the faq and the docs, I've scoured the mailing list, and I can not find the answer to this. I'm trying to setup client cert authentication. I have a Verisign signed personal cert on my browser, and for now, a self signed cert on the server. When I try to connect to the site, it prompts me twice for the certificate to send, and then returns "Cannot find server blah blah blah". Here is the lines from the error log: [Thu May 10 10:56:51 2001] [error] mod_ssl: Certificate Verification: Error (7): certificate signature failure [Thu May 10 10:56:51 2001] [error] mod_ssl: SSL handshake failed (server repsystem.amntv.com:443, client 207.138.31.11) (OpenSSL library error follows) [Thu May 10 10:56:51 2001] [error] OpenSSL: error:0D07908D:asn1 encoding routines:ASN1_verify:unknown message digest algorithm [Thu May 10 10:56:51 2001] [error] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned [Thu May 10 10:56:52 2001] [error] mod_ssl: Certificate Verification: Error (7): certificate signature failure [Thu May 10 10:56:52 2001] [error] mod_ssl: SSL handshake failed (server repsystem.amntv.com:443, client 207.138.31.11) (OpenSSL library error follows) [Thu May 10 10:56:52 2001] [error] OpenSSL: error:0D07908D:asn1 encoding routines:ASN1_verify:unknown message digest algorithm [Thu May 10 10:56:52 2001] [error] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Here is the entry in my apache config: DocumentRoot /home/repsys/html ServerName repsystem.amntv.com ServerAdmin [EMAIL PROTECTED] TransferLog /home/repsys/logs/secure.xfer ErrorLog /home/repsys/logs/secure.error SSLEngine on SSLCertificateFile /etc/httpd/conf/ssl.crt/repsystem.amntv.com.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/repsystem.amntv.com.key SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown SSLVerifyClient require SSLVerifyDepth 10 SSLOptions +ExportCertData +StdEnvVars SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLCertificateChainFile /etc/httpd/conf/ssl.crt/repsystem.amntv.com.crt Options Indexes Includes FollowSymLinks ExecCGI AllowOverride All Order allow,deny Allow from all AllowOverride None Options ExecCGI Order allow,deny Allow from all I can connect to the HTTPS server just fine if I change SSLVerifyClient to none. So I'm sure it has to do with the personal certs, but for the life of me I can't figure out WHAT it has to do with themI'm truly sorry if this has been answered before, but I was unable to find any information regarding this. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Apache mod_ssl - proxy/client authentication
Hello, I couldn't find any explicit answer on this issue yet. We were trying to configure an Apache 1.3.12 + mod_ssl 2.6.6 (+ OpenSSL 0.9.6) to work as a mirroring proxy. The requirement against the proxy was that it has to fulfill client authentication requests from the peers when communicating over ssl. According to the (debug level) logs it seems that the proxy doesn't send its own (client) certificate to the requesting peer. When the peer is not configured to require client auth, everything works fine and the certificates are verified properly on both sides. I read that there are some Apache directives (e.g. SSLProxyMachineFile) which would control the proxy's response when in proxy mode and client auth is required by the peer. These directives are not (yet) supported in mod_ssl but in Stronghold. Is this correct? Does this mean that this functionality is currently not available or there is a workaround? Thanks for your coments in advance, Best regards, Zsolt Szabadi __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
RE: client authentication
>Dave, >OK I am new to SSL and Apache, modlssl. >So, i can start with the client auth, using a browser first. >Can you please explain how you sign the client with your own ca cert? >Basically what are the steps that you need to do, to be a CA? >I find on the modssl guide, to use sign.sh but i am on NT. so do you know >any equivalent for Windows? >After singing the client csr, what are the steps we need to do on the client >side? What are the steps we need to do on the server side? > >Thanks, >Vani. Vani, In addition to looking through the email in this user's group, I know of two documents with clues: From the mod_ssl FAQ: http://www.modssl.org/docs/2.8/ssl_faq.html#ToC24 I have used these instructions as well: http://tud.at/programm/apache-ssl-win32-howto.php3 Dave __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
RE: client authentication
Dave, OK I am new to SSL and Apache, modlssl. So, i can start with the client auth, using a browser first. Can you please explain how you sign the client with your own ca cert? Basically what are the steps that you need to do, to be a CA? I find on the modssl guide, to use sign.sh but i am on NT. so do you know any equivalent for Windows? After singing the client csr, what are the steps we need to do on the client side? What are the steps we need to do on the server side? Thanks, Vani. -Original Message- From: Deocs Postmaster [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 25, 2001 11:16 AM To: [EMAIL PROTECTED] Subject: Re: client authentication At 01:19 PM 04/25/2001 , you wrote: >Hi, >i am developing an application, where the server needs to authenticate the >client. On the client side i am using JSSE. On the server side i am using >Apache with openssl. > >Can anyone tell me the step by step procedure, about >1. How to make the server request the client, to send its certificate? >I have added the following lines in httpd.cnf. > >SSLVerifyClient require >SSLVerifyDepth 1 > >But when i try to access the url using browser(to test the server settings), >i get an empty list box asking me to select the certificate to use when >connecting. >What do i need to do to see some certificates there? > >What do i need to do to access this secure site using a program? > >2.I want to be my CA >3.How to add certs? etc etc? I was able to get a Java Browser to connect to Apache+SSL, but it was very difficult compared to my experiences with Netscape for IE. Java has its own cert file, and I found the Java rules strict and the Java documentation scattered and inconsistent. Some docs are here: http://java.sun.com/j2se/1.3/docs/tooldocs/win32/keytool.html About 2/5 of the way down is a section named "Importing Certificates" and is a good start. As I recall I had to look in other Java sites to find more clues. One of them indicated that some versions of Java didn't work with Thawte certs. At that point I reverted to an earlier cert and things started working. It did work with a cert that I signed. Lots of luck, sorry I didn't have more information. Dave __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED] __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: client authentication
At 01:19 PM 04/25/2001 , you wrote: >Hi, >i am developing an application, where the server needs to authenticate the >client. On the client side i am using JSSE. On the server side i am using >Apache with openssl. > >Can anyone tell me the step by step procedure, about >1. How to make the server request the client, to send its certificate? >I have added the following lines in httpd.cnf. > >SSLVerifyClient require >SSLVerifyDepth 1 > >But when i try to access the url using browser(to test the server settings), >i get an empty list box asking me to select the certificate to use when >connecting. >What do i need to do to see some certificates there? > >What do i need to do to access this secure site using a program? > >2.I want to be my CA >3.How to add certs? etc etc? I was able to get a Java Browser to connect to Apache+SSL, but it was very difficult compared to my experiences with Netscape for IE. Java has its own cert file, and I found the Java rules strict and the Java documentation scattered and inconsistent. Some docs are here: http://java.sun.com/j2se/1.3/docs/tooldocs/win32/keytool.html About 2/5 of the way down is a section named "Importing Certificates" and is a good start. As I recall I had to look in other Java sites to find more clues. One of them indicated that some versions of Java didn't work with Thawte certs. At that point I reverted to an earlier cert and things started working. It did work with a cert that I signed. Lots of luck, sorry I didn't have more information. Dave __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
client authentication
Hi, i am developing an application, where the server needs to authenticate the client. On the client side i am using JSSE. On the server side i am using Apache with openssl. Can anyone tell me the step by step procedure, about 1. How to make the server request the client, to send its certificate? I have added the following lines in httpd.cnf. SSLVerifyClient require SSLVerifyDepth 1 But when i try to access the url using browser(to test the server settings), i get an empty list box asking me to select the certificate to use when connecting. What do i need to do to see some certificates there? What do i need to do to access this secure site using a program? 2.I want to be my CA 3.How to add certs? etc etc? Thanks in advance, Vani. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Client authentication and PHP
I have a problem with modssl and client authentication. The I parse a PHP script to get my page the client authenticaton is "forgotten", so then I press a link I have to do a new client authentication. Because we are using a smartcard as token for the client autentication this is anoying (takes time). But if I use static HTML pages modssl remembers the session and serves the page without client authentication. So it has some thing to do with the page to be a PHP script. /Fredrik Gustafsson Integris Sweden __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
MSIE Client Authentication failure
Dear list, i'm in trouble with MSIE 5.5 (128bit EncPack) and modssl2.7.1/Apache 1.3.14. If I set "SSLVerifyClient require" in my conf file, I can't get any page from my server. Pls. note that the browser correctly tell me that the site want a certificate to authenticate access, I select it from my personal list, but then the page "...cannot be displayed". this is a scratch from the logfile for mod_ssl [14/Feb/2001 13:08:58 00953] [trace] OpenSSL: Loop: SSLv3 flush data [14/Feb/2001 13:09:02 00953] [trace] OpenSSL: Exit: failed in SSLv3 read client certificate A I've tested every hint in the faq, modifying also the features in the client, but without results... Obviously with netscape I've NO PROBLEMS Anyone can help me ? (pls. reply to email, 'cause i'm not in this list...) Thanks in advance. -- Dott. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) Member of the Internet Society http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
how to make a CA known to apache but not valid for client authentication? (apache1.3.17,modssl2.8,openssl0.9.6)
How do I make a root CA known to apache but not valid for client authentication? (apache1.3.17,modssl2.8,openssl0.9.6) I've got a three tier cert hierarchy like: root ca --signs--> project ca --signs--> server/client certs The problem is that unless I place the root ca in SSLCACertificateFile or SSLCACertificatePath apache complains about not being able to locate the local issuer. If I place the root in either of these apache allows server/client certs that were signed directly by the root ca to access the server (when I only want to allow certs signed by the project ca) I would think that one should only need SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile (containing the project ca and root ca), SSLCACertificateFile (containing just the project ca), SSLVerifyClient require, and SSLVerifyDepth 2. These settings do not work as advertised. Only the project CA is loaded startup (looking at the ssl_engine_log) and when attempting to do a client connection, apache says it can't find the local issuer (this would seem to be the root ca, which IS IN the chain!! isnt that enough?). If I add the root ca to the SSLCACertificateFile or SSLCACertificatePath apache allows clients signed by the root CA access. Does apache not support three tier certificate hierarchies? Any other things I should try? I know that the last two paragraphs basically restated the same issue but hopefully one of them will be clear enough for someone to understand. If you can believe it, we've been toying with this for 3 months now and I fear this is going to reflect badly on the use of opensource software within the company. The vendor who manages our certificates is finger pointing at apache and its driving me insane. I've been using apache since its first year of existance and I can't imagine being stuck using commercial implementations (which don't work AT ALL) here for the rest of my days just because of a lack of documentation :(. Any help would be greatly appreciated. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
RE: 3tier certificate + client authentication doesn't seem to work. (newest apache/modperl/openssl)
Hi,
If you want to trust a sub CA than you have to trust it's Root. I.e. when
you trust a Client certificate issued by a SubCA, you trust the sub CA which
automatically means you trust all certificates issued directly of the Root.
Obviously you do not automatically trust all the certificates issued by
other SubCAs of the same root.
The options SSLCACertificateFile and the like refer to client certificates,
the SSLCertificateFile and the like to certificates for the server. I
believe there is no connection between them, i.e. the Server can trust a
commercial CA for the server certificate but does not trust it to issue
client certificates. I have not tried this though.
There are two solution for your scenario.
1) You use two CA's. I.e. you buy from a commercial CA
a server certificate for your server and you run your
own CA (or have it hosted by a provider) to issue
client certificates of your own private root. Of course
you can have your own private SubCA under your private root.
2) You use DN information of the client certificate to
figure out whether to allow them access to your server.
For this to work you have to trust the Root never to
produce a certificate with that same information.
It seems to be possible to use the issuers information
of the client certificate for this too. Have a look
at the HowTo: http://www.modssl.org/docs/2.8/ssl_howto.html#ToC9
SSLRequire %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." and \
%{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"}
It should be possible to use SSL_CLIENT_I_DN_O eq "Mastercard"
Hope this helps,
Jens
The information contained in this message is confidential and is intended
for the addressee(s) only. If you have received this message in error or
there are any problems please notify the originator immediately. The
unauthorized use, disclosure, copying or alteration of this message is
strictly forbidden. This message and any attachments have been scanned for
viruses. Baltimore Technologies plc will not be liable for direct, special,
indirect or consequential damages arising from alteration of the contents of
this message by a third party or as a result of any virus being passed on.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, February 20, 2001 9:42 AM
To: [EMAIL PROTECTED]
Subject: 3tier certificate + client authentication doesn't seem to work.
(newest apache/modperl/openssl)
How do I make the root CA known to apache but not valid for client
authentication? (only the sub root CA that signed the server/client should
be
valid. (apache1.3.17,modssl2.8,openssl0.9.6)
I've got a three tier cert hierarchy like:
root ca --signs--> project ca --signs--> server/client certs
The problem is that unless I place the root ca in SSLCACertificateFile or
SSLCACertificatePath apache complains about not being able to locate the
local
issuer. If I place the root in either of these apache allows server/client
certs that were signed directly by the root ca to access the server (when I
only
want to allow certs signed by the project ca)
I would think that one should only need SSLCertificateFile,
SSLCertificateKeyFile and SSLCertificateChainFile (containing the project ca
and
root ca), SSLCACertificateFile (containing just the project ca),
SSLVerifyClient
require, and SSLVerifyDepth 2. These settings do not work as advertised.
Only
the project CA is loaded startup (looking at the ssl_engine_log) and when
attempting to do a client connection, apache says it can't find the local
issuer
(this would seem to be the root ca, which IS IN the chain!! isnt that
enough?).
If I add the root ca to the SSLCACertificateFile or SSLCACertificatePath
apache
allows clients signed by the root CA access. Does apache not support three
tier
certificate hierarchies? Any other things I should try?
I know that the last two paragraphs basically restated the same issue but
hopefully one of them will be clear enough for someone to understand.
-Matthew Lenz
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager[EMAIL PROTECTED]
This footnote confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager[EMAIL PROTECTED]
3tier certificate + client authentication doesn't seem to work. (newest apache/modperl/openssl)
How do I make the root CA known to apache but not valid for client authentication? (only the sub root CA that signed the server/client should be valid. (apache1.3.17,modssl2.8,openssl0.9.6) I've got a three tier cert hierarchy like: root ca --signs--> project ca --signs--> server/client certs The problem is that unless I place the root ca in SSLCACertificateFile or SSLCACertificatePath apache complains about not being able to locate the local issuer. If I place the root in either of these apache allows server/client certs that were signed directly by the root ca to access the server (when I only want to allow certs signed by the project ca) I would think that one should only need SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile (containing the project ca and root ca), SSLCACertificateFile (containing just the project ca), SSLVerifyClient require, and SSLVerifyDepth 2. These settings do not work as advertised. Only the project CA is loaded startup (looking at the ssl_engine_log) and when attempting to do a client connection, apache says it can't find the local issuer (this would seem to be the root ca, which IS IN the chain!! isnt that enough?). If I add the root ca to the SSLCACertificateFile or SSLCACertificatePath apache allows clients signed by the root CA access. Does apache not support three tier certificate hierarchies? Any other things I should try? I know that the last two paragraphs basically restated the same issue but hopefully one of them will be clear enough for someone to understand. -Matthew Lenz __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: question on client authentication using certificates
On Wed, Feb 07, 2001 at 03:35:03PM +0100, Reich, Stefan wrote: > Ok, so on my site it's the same behaviour. > > I am using > > SSLSessionCache dbm:/myapache/logs/ssl_scache > SSLSessionCacheTimeout 300 > Try shm instead of dbm - IIRC there has been a couple of cases where that fixed the problem. vh Mads Toftum -- `Darn it, who spiked my coffee with water?!' - lwall __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
AW: question on client authentication using certificates
Ok, so on my site it's the same behaviour. I am using SSLSessionCache dbm:/myapache/logs/ssl_scache SSLSessionCacheTimeout 300 I think I will use a different approach then. I use a cgi to set a signed cookie. The CGI is the only place, where the client certificate is requested. All other places are protected by the cookie. This is working with Netscape and IE and it may be even faster. Anyway: Thanks for your help. -Ursprüngliche Nachricht- Von: Lutz Jaenicke [mailto:[EMAIL PROTECTED]] Gesendet: Mittwoch, 7. Februar 2001 15:09 An: [EMAIL PROTECTED] Betreff: Re: question on client authentication using certificates On Wed, Feb 07, 2001 at 02:01:27PM +0100, Reich, Stefan wrote: > This seems to be indeed a session problem. But it's Netscape specific. > If I look in the log, IE is reusing a session and I can see counters like > request 1 request 2 request 3 and so on. > With Netscape these subsequent requests are very rare. > > But: Even if IE is sending a new request, I'm not asked for the certificate > again. Hmm, no idea about IE, but I can reproduce your problem with Netscape... I have just ssldump'ed and it seems that Netscape proposes sessions to be reused, but mod_ssl happily issues new sessions... I have an idea, let's verify... * SSLLogLevel trace - found expected entries looking like this: [07/Feb/2001 14:53:11 06753] [trace] Inter-Process Session Cache: request=SET status=BAD id=DAF80CB3346BA4F5AF1B85914695B8FD285C9D0725A36D2029280BEF0F59F8C5 timeout=295s (session caching) [07/Feb/2001 14:53:30 06719] [trace] Inter-Process Session Cache: request=SET status=BAD id=9AD1C76F2E88ABCEF3EDBDBAF979B7DA6384BB5B0032D1E8DD32F7DD3B740D16 timeout=295s (session caching) Sessions are not loaded into the inter-process session cache. If you happen to connect to the same server process again it will still be in memory (working fine), otherwise a new negotiation takes place. * I use sdbm, you too? * Explanation: I have written the Postfix/TLS patchkit extending the Postfix Mail Transport Agent to support TLS. Client certificates can be used to authenticate for relaying. I am also using SDBM, but I had to change the source to allow larger blocks, since sessions with client certificates can extend the 1024 byte hard limit. (Further reduce 1024 by the size of the key, in this case the session ID). There is nothing you can do as long as you use sdbm. Maybe you can try shm. I made some experiments on HP-UX with "mm", but it didn't work well (may well be caused by compiling in mm support for PHP). I didn't care that much, since i normally don't use client certificates and continued using SDBM... Failure may look arbitrary. My certificate was issued by our universities computer center with the full name of our university and as a sub-CA of the Toplevel CA, so it is really long: ... Issuer: C=DE, ST=Brandenburg, L=Cottbus, O=Brandenburgische Technische Universitaet Cottbus, OU=Rechenzentrum, [EMAIL PROTECTED] ... Subject: C=DE, ST=Brandenburg, L=Cottbus, O=Brandenburgische Technische Universitaet Cottbus, OU=Allgemeine Elektrotechnik und Numerische Feldberechnung, CN=Lutz [EMAIL PROTECTED] ... X509v3 Authority Key Identifier: DirName:/C=DE/O=Deutsches Forschungsnetz/OU=DFN-PCA/CN=DFN Top Level Certification [EMAIL PROTECTED] ... X509v3 Subject Alternative Name: email:[EMAIL PROTECTED] So with all of the extenions in it it may well exceed the limit. I have been using self-issued certificates for quite some time without this problem, but they did not contain that much information. Best regards, Lutz -- Lutz Jaenicke [EMAIL PROTECTED] BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/ Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129 Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153 __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED] __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: question on client authentication using certificates
On Wed, Feb 07, 2001 at 02:01:27PM +0100, Reich, Stefan wrote: > This seems to be indeed a session problem. But it's Netscape specific. > If I look in the log, IE is reusing a session and I can see counters like > request 1 request 2 request 3 and so on. > With Netscape these subsequent requests are very rare. > > But: Even if IE is sending a new request, I'm not asked for the certificate > again. Hmm, no idea about IE, but I can reproduce your problem with Netscape... I have just ssldump'ed and it seems that Netscape proposes sessions to be reused, but mod_ssl happily issues new sessions... I have an idea, let's verify... * SSLLogLevel trace - found expected entries looking like this: [07/Feb/2001 14:53:11 06753] [trace] Inter-Process Session Cache: request=SET status=BAD id=DAF80CB3346BA4F5AF1B85914695B8FD285C9D0725A36D2029280BEF0F59F8C5 timeout=295s (session caching) [07/Feb/2001 14:53:30 06719] [trace] Inter-Process Session Cache: request=SET status=BAD id=9AD1C76F2E88ABCEF3EDBDBAF979B7DA6384BB5B0032D1E8DD32F7DD3B740D16 timeout=295s (session caching) Sessions are not loaded into the inter-process session cache. If you happen to connect to the same server process again it will still be in memory (working fine), otherwise a new negotiation takes place. * I use sdbm, you too? * Explanation: I have written the Postfix/TLS patchkit extending the Postfix Mail Transport Agent to support TLS. Client certificates can be used to authenticate for relaying. I am also using SDBM, but I had to change the source to allow larger blocks, since sessions with client certificates can extend the 1024 byte hard limit. (Further reduce 1024 by the size of the key, in this case the session ID). There is nothing you can do as long as you use sdbm. Maybe you can try shm. I made some experiments on HP-UX with "mm", but it didn't work well (may well be caused by compiling in mm support for PHP). I didn't care that much, since i normally don't use client certificates and continued using SDBM... Failure may look arbitrary. My certificate was issued by our universities computer center with the full name of our university and as a sub-CA of the Toplevel CA, so it is really long: ... Issuer: C=DE, ST=Brandenburg, L=Cottbus, O=Brandenburgische Technische Universitaet Cottbus, OU=Rechenzentrum, [EMAIL PROTECTED] ... Subject: C=DE, ST=Brandenburg, L=Cottbus, O=Brandenburgische Technische Universitaet Cottbus, OU=Allgemeine Elektrotechnik und Numerische Feldberechnung, CN=Lutz [EMAIL PROTECTED] ... X509v3 Authority Key Identifier: DirName:/C=DE/O=Deutsches Forschungsnetz/OU=DFN-PCA/CN=DFN Top Level Certification [EMAIL PROTECTED] ... X509v3 Subject Alternative Name: email:[EMAIL PROTECTED] So with all of the extenions in it it may well exceed the limit. I have been using self-issued certificates for quite some time without this problem, but they did not contain that much information. Best regards, Lutz -- Lutz Jaenicke [EMAIL PROTECTED] BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/ Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129 Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153 __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
AW: question on client authentication using certificates
This seems to be indeed a session problem. But it's Netscape specific. If I look in the log, IE is reusing a session and I can see counters like request 1 request 2 request 3 and so on. With Netscape these subsequent requests are very rare. But: Even if IE is sending a new request, I'm not asked for the certificate again. Is someone out there, who successfully uses certificate based client authentication with Netscape without this effect? -Ursprüngliche Nachricht- Von: Lutz Jaenicke [mailto:[EMAIL PROTECTED]] Gesendet: Mittwoch, 7. Februar 2001 11:14 An: [EMAIL PROTECTED] Betreff: Re: question on client authentication using certificates On Wed, Feb 07, 2001 at 09:34:29AM +0100, Reich, Stefan wrote: > Hi, > > I had the Netscape Problem too. I didn't get an answer up to now. > The only way to get around this I found up to now is to configure to send > the certificate automatically, instead of asking. > > If you find a better solution, please let me know. Please make sure that session caching is enabled. Netscape will ask you for the certificate whenever a new session is being negotiated. Since this is annoying, the session can be cached, so that the same information is reused. If session caching does not work or is not configured, you have new handshake for every request. Best regards, Lutz -- Lutz Jaenicke [EMAIL PROTECTED] BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/ Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129 Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153 __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED] __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: question on client authentication using certificates
On Wed, Feb 07, 2001 at 09:34:29AM +0100, Reich, Stefan wrote: > Hi, > > I had the Netscape Problem too. I didn't get an answer up to now. > The only way to get around this I found up to now is to configure to send > the certificate automatically, instead of asking. > > If you find a better solution, please let me know. Please make sure that session caching is enabled. Netscape will ask you for the certificate whenever a new session is being negotiated. Since this is annoying, the session can be cached, so that the same information is reused. If session caching does not work or is not configured, you have new handshake for every request. Best regards, Lutz -- Lutz Jaenicke [EMAIL PROTECTED] BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/ Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129 Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153 __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
AW: question on client authentication using certificates
Hi, I had the Netscape Problem too. I didn't get an answer up to now. The only way to get around this I found up to now is to configure to send the certificate automatically, instead of asking. If you find a better solution, please let me know. Tnx Stefan -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Gesendet: Dienstag, 6. Februar 2001 23:50 An: [EMAIL PROTECTED] Betreff: question on client authentication using certificates Howdy, I am having a problem with modssl certificate based client authentication that will undoubtedly have a simple answer. Currently, I have a CA certificate that I use to sign all my client certificates. On the apache+modssl server I want to use certificate based authentication. The client need only have a certificate signed by the CA to obtain access to the site. I added the following directives to the httpd.conf as per the modssl Howto. SSLVerifyClient require SSLVerifyDepth 1 SSLCACertificateFile /path/to/file.crt After turning the server over, I made the following discoveries: - On Netscape, it will request my certificate for authentication. The problem is, it requests it for every single page and image (on a page with several images the dialog box pops up once for each image). If I click on a link, it starts the cycle over again (requesting certificates for the new page and the images). - On Internet Explorer, the dialog box requesting the certificate for authentication pops up, but then I get an error page (One of the vanilla IE error pages: Cannot find server or DNS Error) I plan to keep working on it, but any help would be greatly appreciated. My configuration information is listed below: Netscape 4.75 Internet Explorer 5.00.292 Apache 1.3.17 + mod_ssl 2.8 (latest greatest) __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED] __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
question on client authentication using certificates
Howdy, I am having a problem with modssl certificate based client authentication that will undoubtedly have a simple answer. Currently, I have a CA certificate that I use to sign all my client certificates. On the apache+modssl server I want to use certificate based authentication. The client need only have a certificate signed by the CA to obtain access to the site. I added the following directives to the httpd.conf as per the modssl Howto. SSLVerifyClient require SSLVerifyDepth 1 SSLCACertificateFile /path/to/file.crt After turning the server over, I made the following discoveries: - On Netscape, it will request my certificate for authentication. The problem is, it requests it for every single page and image (on a page with several images the dialog box pops up once for each image). If I click on a link, it starts the cycle over again (requesting certificates for the new page and the images). - On Internet Explorer, the dialog box requesting the certificate for authentication pops up, but then I get an error page (One of the vanilla IE error pages: Cannot find server or DNS Error) I plan to keep working on it, but any help would be greatly appreciated. My configuration information is listed below: Netscape 4.75 Internet Explorer 5.00.292 Apache 1.3.17 + mod_ssl 2.8 (latest greatest) __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: client authentication
Hi...
> to sign your own certificate, you cannot use a plain server certificate. You
> need a CA certificate, a certificate, which allows you to sign other
> certificates. There are many different types of certificates, each serves
> one ore more special purposes. A server certificate can only be used for
> authenticating your server on the web. It is even bound to the name of the
> server it is used for.
o.k. thanks a lot, that is what i suspected...
But one more question- what is the "self-signed" certificate mentioned in
the reference to "VerifyDepth 0". Is this, when i use my self-made
CA-certificate as server-certificate ??
stephan
--
t="\$_='for(\$i=-2;\$_=substr(\"2720ab25409d2500f82310a6272\",\$i+=2,3);)
.~.
/V\[ [EMAIL PROTECTED] 0911.740 53-466 GnuPG: 0x6B8E9F25 ]
/( )\
^ ~ ^ {\$_=\$i++%2?hex:oct;\$_=chr(\$_%(2**2*22));\$_=\$i?lc:{};print;
}';s/\( +\)|[.\/V~^\\\]+| {2,}|\\[\s+.+\s+\\]//g;eval \$_;"&&echo $t|perl
PGP signature
