3

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works.

Now I'm required to generate x509 client-side certificates to issue for this subdomain. I'm following along this page: (http://www.vanemery.com/Linux/Apache/apache-SSL.html), starting with "Creating Client Certificates for Authentication".

I've generated the p12 files and successfully imported them into Firefox. When I browse to the site now, I get an error in FireFox that says "The connection to the server was reset while the page was loading."

I think my problem is coming from not signing the client-side correctly. When I sign the client-side certificate, I'm using the PEM file (RapidSSL_CA_bundle.pem) from RapidSSL (who we bought the certificate from) for the -CA argument. For the -CAkey argument, I'm using the private key of the server. Is this correct?

3
  • I think ServerFault would be a more appropriate place for a question since it's clearly a configuration issue and not a programming one. Mar 4, 2011 at 16:40
  • My bad. Didn't realize this was misplaced.
    – walshms
    Mar 4, 2011 at 16:54
  • No, that is not correct. Mar 5, 2011 at 13:21

3 Answers 3

0

I do not think that the license for a wildcard certificate allows you to use it for signing other certificates. You need to be a certificate authority to be able to do that.

1
  • Thanks. I think after trying to talk with my CA's technical support I got to this conclusion.
    – walshms
    Mar 7, 2011 at 20:33
0

Apache is probably resetting the connection. Try looking at your log files. If you are on *nix system this should be in /var/log/apache/error.log.

0

Use openssl to view the contents of your generated certificate. It will then be obvious if your signing is working correctly.

openssl x509 -text -noout -in <yoursignedcert>

If that looks OK and appears to have an Issuer field that reflects where it is signed try using openssl to attach to your server and see what it is expecting.

openssl s_client -connect <host>:port -CAfile <yourtrustcert> -cert <yoursignedcert>

That should give some clues as to whether the server is requesting your certificate or not.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .