2

I want to create a static page instead of the default "ssl_error_handshake_failure_alert" page when an error occurs, for example when the client do not send any certificate.

how can i do this? any idea?

thankss

3 Answers 3

2

Sorry for digging up this one year later. You can solve your issue without scripting by combining "SSLVerifyClient optional" and "SSLRequire ". In this case, the SSL handshake succeeds, since the cert is only optional, however, it turns out to be mandatory though, by the SSLRequire statement a little bit later down the process ...

Like:

<Location /somewhere>
SSLRequireSSL
SSLVerifyClient optional
SSLVerifyDepth 10
SSLRequire %{SSL_CLIENT_I_DN_CN} eq "YOURSELF"
ErrorDocument 403 "!FORBIDDEN!"
</Location>
1

HTTPS is HTTP inside a SSL tunnel, so if the SSL negociation fail, HTTP conversation between the server and the client has not even started.

As a matter of fact, in this case, the error page is generated by the client's browser then you can't change this page on the server side.

1

Set your location to be sslverifyclient optional (apache). An example

<Location /resources/protected/>
    SSLOptions +StdEnvVars
    SSLVerifyClient optional
</Location>

Now a scipt in that location will have it's env set with env vars such as these. If apache was able to client authenticate, then you can do a test similar to

if ( $ENV{SSL_CLIENT_S_DN_CN}  &&  SSL_CLIENT_I_DN == "Blah issuer")
 echo" we are good"
else
 echo "You need to enrol for a cert.. Please contact admin @ blah"

So an authenticated person will see the "we are good" line while everyone else will see the enrollment message.

I hope this helps!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .