client certificates won't verify under Apache
Aaron Turner <[email protected]>
| Newsgroups | gmane.comp.apache.mod-ssl.user |
|---|---|
| Message-ID | <[email protected]> |
I'm running CentOS 4.1 with Apache 2.0.52 and trying to setup client SSL authentication using an internal CA. I've read the docs and checked the list archives for someone having the same problem or any hints, but have come up empty so far. Anyways... Running: openssl verify -CAfile ssl.crt/cacert.crt -purpose sslclient aaron_turner.crt Returns OK. But configuring apache with: SSLProtocol all SSLCipherSuite HIGH:MEDIUM SSLCertificateFile conf/ssl.crt/updates.musecurity.net.crt SSLCertificateKeyFile conf/ssl.key/updates.musecurity.net SSLCACertificatePath conf/ssl.crt SSLVerifyClient require SSLVerifyDepth 1 where my conf/ssl.crt directory has the cacert.crt with the approrpriate hashes, when I run: openssl s_client -connect updates.musecurity.net:443 -CAfile cacert.pem -cert aaron_turner.pem -certform pem -showcerts -verify 1 I get: [error] Certificate Verification: Error (19): self signed certificate in certificate chain In my ssl_error_log. openssl returns: verify depth is 1 CONNECTED(00000003) depth=1 /C=US/ST=California/L=Sunnyvale/O=MuSecurity, Inc./ [email protected] verify return:1 depth=0 /C=US/ST=California/L=Sunnyvale/O=MuSecurity, Inc./OU=Update Server/CN=updates.musecurity.net/[email protected] verify return:1 871:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1054:SSL alert number 48 871:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:230: I think somewhat related is my problem with using: SSLCACertificateFile conf/ssl.crt/cacert.crt which gives me an error: SSLCACertificateFile: file '/etc/httpd/conf/ssl.crt/cacert.crt' does not exist or is empty which is quite strange since the file does exist, contains the certificate and has the correct perms (files are 644 and directories 755). I've even tried copying over the aaron_turner.crt to the conf/ ssl.crt directory and regenerating the hashes, but that doesn't help. I can only assume I'm missing something horribly obvious, but I've been working on this for hours with no luck... TIA, Aaron -- Aaron Turner, Sr. Security Engineer <[email protected]> Ph: 408.329.1956 ______________________________________________________________________ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager [email protected]