Please help with certificates
Asma Aljarai <[email protected]> Fri, 26 Dec 2025 14:36:13 +0200
| Newsgroups | gmane.comp.apache.user |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-D38B6CE3-AA89-41CC-8D1F-06F6E1F85974 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable =EF=BB=BF I have same issue=20 Could you help me The link you sent it doesn=E2=80=99t open with me On 2003/11/10 14:26:51 kko wrote: > On Mon, 2003-11-10 at 08:58, Ivan Venuti wrote: > > Hi, > > > > I'm using Apache + mod_ssl. > > In order to retrieve a user certificate (from a smart card) I've these f= iles > > in the server: > > > > 1) server_webtest.p12 > > Why did you create a p12 for your server? This format is typically used > by your client (i.e browser) > > > 2) ca.cer (DER format) > > I assume this is the file containing CA certs, right? > > > > > after I have trasformed them with openssl: > > > > $ openssl pkcs12 -in server_webtest.p12 -out hostkey.pem -nodes -nocerts= > > $ openssl pkcs12 -in server_webtest.p12 -out hostcert.pem -nodes -nokeys= > > See below... > > > > > and > > > > $ openssl x509 -inform DER -in ca.cer -outform PEM -out ca.crt > > > > I have modified the conf/httpd.conf file with: > > > > SSLCertificateFile /home/caribel/certs/hostcert.pem > > SSLCertificateKeyFile /home/caribel/certs/hostkey.pem > > SSLCACertificateFile /home/caribel/certs/ca.crt > > SSLVerifyClient require > > > > the error (from logs/error_log): > > > > [Mon Nov 10 11:22:22 2003] [alert] httpd: Could not determine the server= 's > > fully qualified domain name, using 127.0.0.1 for ServerName > > What's the value of your ServerName Directive in httpd.conf? > > > [Mon Nov 10 11:22:22 2003] [notice] Apache/1.3.28 (Unix) mod_jk/1.2.5 > > mod_ssl/2.8.15 OpenSSL/0.9.7c configured -- resuming normal operations > > [Mon Nov 10 11:22:22 2003] [notice] Accept mutex: sysvsem (Default: sysv= sem) > > [Mon Nov 10 11:22:36 2003] [error] mod_ssl: Certificate Verification: Er= ror > > (19): self signed certificate in certificate chain > > [Mon Nov 10 11:22:36 2003] [error] mod_ssl: SSL handshake failed (server= > > linux135:443, client 192.168.1.71) (OpenSSL library error follows) > > [Mon Nov 10 11:22:36 2003] [error] OpenSSL: error:140890B2:SSL > > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > > [Mon Nov 10 11:22:39 2003] [error] mod_ssl: Certificate Verification: Er= ror > > (19): self signed certificate in certificate chain > > [Mon Nov 10 11:22:39 2003] [error] mod_ssl: SSL handshake failed (server= > > linux135:443, client 192.168.1.71) (OpenSSL library error follows) > > [Mon Nov 10 11:22:39 2003] [error] OpenSSL: error:140890B2:SSL > > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > > [Mon Nov 10 11:22:43 2003] [error] mod_ssl: Certificate Verification: Er= ror > > (19): self signed certificate in certificate chain > > [Mon Nov 10 11:22:43 2003] [error] mod_ssl: SSL handshake failed (server= > > linux135:443, client 192.168.1.71) (OpenSSL library error follows) > > [Mon Nov 10 11:22:43 2003] [error] OpenSSL: error:140890B2:SSL > > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > > > > Why didn't you create your csr/crt/pem directly and sign them? > > Take a look at this > http://www.karkomaonline.com/article.php?story=3D20030713003329816 > > Hope this helps > > -- > kko <[email protected]> > karkomaonline > > > --------------------------------------------------------------------- > The official User-To-User support forum of the Apache HTTP Server Project.= > See <URL:http://httpd.apache.org/userslist.html> for more info. > To unsubscribe, e-mail: [email protected] > " from the digest: [email protected] > For additional commands, e-mail: [email protected] > > Sent from my iPhone= --Apple-Mail-D38B6CE3-AA89-41CC-8D1F-06F6E1F85974 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html class=3D"apple-mail-supports-explicit-dark-mode"><head><meta http-equi= v=3D"content-type" content=3D"text/html; charset=3Dutf-8"></head><body dir=3D= "auto"><div dir=3D"ltr">=EF=BB=BF<meta http-equiv=3D"content-type" content=3D= "text/html; charset=3Dutf-8"><div dir=3D"ltr"><div style=3D"direction: ltr;"= >I have same issue </div><div style=3D"direction: ltr;">Could you help m= e</div><div style=3D"direction: ltr;">The link you sent it doesn=E2=80=99t o= pen with me</div><br>On 2003/11/10 14:26:51 kko wrote:<br>> On Mon, 2003-= 11-10 at 08:58, Ivan Venuti wrote:<br>> > Hi,<br>> > <br>> &g= t; I'm using Apache + mod_ssl.<br>> > In order to retrieve a user cert= ificate (from a smart card) I've these files<br>> > in the server:<br>= > > <br>> > 1) server_webtest.p12<br>> <br>> Why d= id you create a p12 for your server? This format is typically used<br>> b= y your client (i.e browser)<br>> <br>> > 2) ca.cer (DER form= at)<br>> <br>> I assume this is the file containing CA certs, right?<b= r>> <br>> > <br>> > after I have trasformed them with openssl= :<br>> > <br>> > $ openssl pkcs12 -in server_webtest.p12 -ou= t hostkey.pem -nodes -nocerts<br>> > $ openssl pkcs12 -in server= _webtest.p12 -out hostcert.pem -nodes -nokeys<br>> <br>> See below...<= br>> <br>> > <br>> > and<br>> > <br>> > $ o= penssl x509 -inform DER -in ca.cer -outform PEM -out ca.crt<br>> > <br= >> > I have modified the conf/httpd.conf file with:<br>> > <br>&= gt; > SSLCertificateFile /home/caribel/certs/hostcert.pem<br>>= > SSLCertificateKeyFile /home/caribel/certs/hostkey.pem<br>> > = SSLCACertificateFile /home/caribel/certs/ca.crt<br>> > SSLVerifyCl= ient require<br>> > <br>> > the error (from logs/error_log):<br>= > > <br>> > [Mon Nov 10 11:22:22 2003] [alert] httpd: Could not d= etermine the server's<br>> > fully qualified domain name, using 127.0.= 0.1 for ServerName<br>> <br>> What's the value of your ServerName Dire= ctive in httpd.conf?<br>> <br>> > [Mon Nov 10 11:22:22 2003] [notic= e] Apache/1.3.28 (Unix) mod_jk/1.2.5<br>> > mod_ssl/2.8.15 OpenSSL/0.9= .7c configured -- resuming normal operations<br>> > [Mon Nov 10 11:22:= 22 2003] [notice] Accept mutex: sysvsem (Default: sysvsem)<br>> > [Mon= Nov 10 11:22:36 2003] [error] mod_ssl: Certificate Verification: Error<br>&= gt; > (19): self signed certificate in certificate chain<br>> > [Mo= n Nov 10 11:22:36 2003] [error] mod_ssl: SSL handshake failed (server<br>>= ; > linux135:443, client 192.168.1.71) (OpenSSL library error follows)<br= >> > [Mon Nov 10 11:22:36 2003] [error] OpenSSL: error:140890B2:SSL<br= >> > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned<br>&= gt; > [Mon Nov 10 11:22:39 2003] [error] mod_ssl: Certificate Verificatio= n: Error<br>> > (19): self signed certificate in certificate chain<br>= > > [Mon Nov 10 11:22:39 2003] [error] mod_ssl: SSL handshake failed (= server<br>> > linux135:443, client 192.168.1.71) (OpenSSL library erro= r follows)<br>> > [Mon Nov 10 11:22:39 2003] [error] OpenSSL: error:14= 0890B2:SSL<br>> > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate r= eturned<br>> > [Mon Nov 10 11:22:43 2003] [error] mod_ssl: Certificate= Verification: Error<br>> > (19): self signed certificate in certifica= te chain<br>> > [Mon Nov 10 11:22:43 2003] [error] mod_ssl: SSL handsh= ake failed (server<br>> > linux135:443, client 192.168.1.71) (OpenSSL l= ibrary error follows)<br>> > [Mon Nov 10 11:22:43 2003] [error] OpenSS= L: error:140890B2:SSL<br>> > routines:SSL3_GET_CLIENT_CERTIFICATE:no c= ertificate returned<br>> > <br>> <br>> Why didn't you create you= r csr/crt/pem directly and sign them?<br>> <br>> Take a look at this<b= r>> http://www.karkomaonline.com/article.php?story=3D20030713003329816<br= >> <br>> Hope this helps<br>> <br>> -- <br>> kko <ka...@ka= rkomaonline.com><br>> karkomaonline<br>> <br>> <br>> --------= -------------------------------------------------------------<br>> The of= ficial User-To-User support forum of the Apache HTTP Server Project.<br>>= See <URL:http://httpd.apache.org/userslist.html> for more info.<br>&g= t; To unsubscribe, e-mail: [email protected]<br>> " = from the digest: [email protected]<br>> For addi= tional commands, e-mail: [email protected]<br>> <br>> </div>= <br id=3D"lineBreakAtBeginningOfSignature"><div dir=3D"ltr">Sent from my iPh= one</div></div></body></html>= --Apple-Mail-D38B6CE3-AA89-41CC-8D1F-06F6E1F85974--