RE: Re: Please help with certificates
Asma Aljarai <[email protected]> Fri, 26 Dec 2025 14:35:44 +0200
| Newsgroups | gmane.comp.apache.user |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-3D608722-7A0A-4822-909D-F959F46105F6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I have same issue=20 Could you help me The link you sent it doesn=E2=80=99t open with me On 2003/11/10 14:26:51 kko wrote: > On Mon, 2003-11-10 at 08:58, Ivan Venuti wrote: > > Hi, > > > > I'm using Apache + mod_ssl. > > In order to retrieve a user certificate (from a smart card) I've these f= iles > > in the server: > > > > 1) server_webtest.p12 > > Why did you create a p12 for your server? This format is typically used > by your client (i.e browser) > > > 2) ca.cer (DER format) > > I assume this is the file containing CA certs, right? > > > > > after I have trasformed them with openssl: > > > > $ openssl pkcs12 -in server_webtest.p12 -out hostkey.pem -nodes -nocerts= > > $ openssl pkcs12 -in server_webtest.p12 -out hostcert.pem -nodes -nokeys= > > See below... > > > > > and > > > > $ openssl x509 -inform DER -in ca.cer -outform PEM -out ca.crt > > > > I have modified the conf/httpd.conf file with: > > > > SSLCertificateFile /home/caribel/certs/hostcert.pem > > SSLCertificateKeyFile /home/caribel/certs/hostkey.pem > > SSLCACertificateFile /home/caribel/certs/ca.crt > > SSLVerifyClient require > > > > the error (from logs/error_log): > > > > [Mon Nov 10 11:22:22 2003] [alert] httpd: Could not determine the server= 's > > fully qualified domain name, using 127.0.0.1 for ServerName > > What's the value of your ServerName Directive in httpd.conf? > > > [Mon Nov 10 11:22:22 2003] [notice] Apache/1.3.28 (Unix) mod_jk/1.2.5 > > mod_ssl/2.8.15 OpenSSL/0.9.7c configured -- resuming normal operations > > [Mon Nov 10 11:22:22 2003] [notice] Accept mutex: sysvsem (Default: sysv= sem) > > [Mon Nov 10 11:22:36 2003] [error] mod_ssl: Certificate Verification: Er= ror > > (19): self signed certificate in certificate chain > > [Mon Nov 10 11:22:36 2003] [error] mod_ssl: SSL handshake failed (server= > > linux135:443, client 192.168.1.71) (OpenSSL library error follows) > > [Mon Nov 10 11:22:36 2003] [error] OpenSSL: error:140890B2:SSL > > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > > [Mon Nov 10 11:22:39 2003] [error] mod_ssl: Certificate Verification: Er= ror > > (19): self signed certificate in certificate chain > > [Mon Nov 10 11:22:39 2003] [error] mod_ssl: SSL handshake failed (server= > > linux135:443, client 192.168.1.71) (OpenSSL library error follows) > > [Mon Nov 10 11:22:39 2003] [error] OpenSSL: error:140890B2:SSL > > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > > [Mon Nov 10 11:22:43 2003] [error] mod_ssl: Certificate Verification: Er= ror > > (19): self signed certificate in certificate chain > > [Mon Nov 10 11:22:43 2003] [error] mod_ssl: SSL handshake failed (server= > > linux135:443, client 192.168.1.71) (OpenSSL library error follows) > > [Mon Nov 10 11:22:43 2003] [error] OpenSSL: error:140890B2:SSL > > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > > > > Why didn't you create your csr/crt/pem directly and sign them? > > Take a look at this > http://www.karkomaonline.com/article.php?story=3D20030713003329816 > > Hope this helps > > -- > kko <[email protected]> > karkomaonline > > > --------------------------------------------------------------------- > The official User-To-User support forum of the Apache HTTP Server Project.= > See <URL:http://httpd.apache.org/userslist.html> for more info. > To unsubscribe, e-mail: [email protected] > " from the digest: [email protected] > For additional commands, e-mail: [email protected] > > Sent from my iPhone= --Apple-Mail-3D608722-7A0A-4822-909D-F959F46105F6 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html class=3D"apple-mail-supports-explicit-dark-mode"><head><meta http-equi= v=3D"content-type" content=3D"text/html; charset=3Dutf-8"></head><body dir=3D= "auto"><div dir=3D"ltr"><div style=3D"direction: ltr;">I have same issue&nbs= p;</div><div style=3D"direction: ltr;">Could you help me</div><div style=3D"= direction: ltr;">The link you sent it doesn=E2=80=99t open with me</div><br>= On 2003/11/10 14:26:51 kko wrote:<br>> On Mon, 2003-11-10 at 08:58, Ivan V= enuti wrote:<br>> > Hi,<br>> > <br>> > I'm using Apache + m= od_ssl.<br>> > In order to retrieve a user certificate (from a smart c= ard) I've these files<br>> > in the server:<br>> > <br>> >= 1) server_webtest.p12<br>> <br>> Why did you create a p12 for= your server? This format is typically used<br>> by your client (i.e brow= ser)<br>> <br>> > 2) ca.cer (DER format)<br>> <br>> I a= ssume this is the file containing CA certs, right?<br>> <br>> > <br= >> > after I have trasformed them with openssl:<br>> > <br>> &= gt; $ openssl pkcs12 -in server_webtest.p12 -out hostkey.pem -nodes -no= certs<br>> > $ openssl pkcs12 -in server_webtest.p12 -out hostce= rt.pem -nodes -nokeys<br>> <br>> See below...<br>> <br>> > <b= r>> > and<br>> > <br>> > $ openssl x509 -inform DER -= in ca.cer -outform PEM -out ca.crt<br>> > <br>> > I have modifie= d the conf/httpd.conf file with:<br>> > <br>> > SSLCertific= ateFile /home/caribel/certs/hostcert.pem<br>> > SSLCertificateKeyFi= le /home/caribel/certs/hostkey.pem<br>> > SSLCACertificateFil= e /home/caribel/certs/ca.crt<br>> > SSLVerifyClient require<br>= > > <br>> > the error (from logs/error_log):<br>> > <br>&g= t; > [Mon Nov 10 11:22:22 2003] [alert] httpd: Could not determine the se= rver's<br>> > fully qualified domain name, using 127.0.0.1 for ServerN= ame<br>> <br>> What's the value of your ServerName Directive in httpd.= conf?<br>> <br>> > [Mon Nov 10 11:22:22 2003] [notice] Apache/1.3.2= 8 (Unix) mod_jk/1.2.5<br>> > mod_ssl/2.8.15 OpenSSL/0.9.7c configured -= - resuming normal operations<br>> > [Mon Nov 10 11:22:22 2003] [notice= ] Accept mutex: sysvsem (Default: sysvsem)<br>> > [Mon Nov 10 11:22:36= 2003] [error] mod_ssl: Certificate Verification: Error<br>> > (19): s= elf signed certificate in certificate chain<br>> > [Mon Nov 10 11:22:3= 6 2003] [error] mod_ssl: SSL handshake failed (server<br>> > linux135:= 443, client 192.168.1.71) (OpenSSL library error follows)<br>> > [Mon N= ov 10 11:22:36 2003] [error] OpenSSL: error:140890B2:SSL<br>> > routin= es:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned<br>> > [Mon Nov= 10 11:22:39 2003] [error] mod_ssl: Certificate Verification: Error<br>> &= gt; (19): self signed certificate in certificate chain<br>> > [Mon Nov= 10 11:22:39 2003] [error] mod_ssl: SSL handshake failed (server<br>> >= ; linux135:443, client 192.168.1.71) (OpenSSL library error follows)<br>>= > [Mon Nov 10 11:22:39 2003] [error] OpenSSL: error:140890B2:SSL<br>>= > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned<br>> &= gt; [Mon Nov 10 11:22:43 2003] [error] mod_ssl: Certificate Verification: Er= ror<br>> > (19): self signed certificate in certificate chain<br>> &= gt; [Mon Nov 10 11:22:43 2003] [error] mod_ssl: SSL handshake failed (server= <br>> > linux135:443, client 192.168.1.71) (OpenSSL library error foll= ows)<br>> > [Mon Nov 10 11:22:43 2003] [error] OpenSSL: error:140890B2= :SSL<br>> > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate return= ed<br>> > <br>> <br>> Why didn't you create your csr/crt/pem dir= ectly and sign them?<br>> <br>> Take a look at this<br>> http://www= .karkomaonline.com/article.php?story=3D20030713003329816<br>> <br>> Ho= pe this helps<br>> <br>> -- <br>> kko <[email protected]&g= t;<br>> karkomaonline<br>> <br>> <br>> -------------------------= --------------------------------------------<br>> The official User-To-Us= er support forum of the Apache HTTP Server Project.<br>> See <URL:http= ://httpd.apache.org/userslist.html> for more info.<br>> To unsubscribe= , e-mail: [email protected]<br>> " from the digest:= [email protected]<br>> For additional commands, e= -mail: [email protected]<br>> <br>> </div><br id=3D"lineBrea= kAtBeginningOfSignature"><div dir=3D"ltr">Sent from my iPhone</div></body></= html>= --Apple-Mail-3D608722-7A0A-4822-909D-F959F46105F6--