Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Just recently I found out a server can use a certification to check if a client is who they say they are. I know how to sign and enable server certifications but how do i have the server check if the client certification is valid on apache?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I hate just linking an article, but is this what your looking for? http://it.toolbox.com/blogs/securitymonkey/howto-securing-a-website-with-client-ssl-certificates-11500

share|improve this answer

These are the main configuration entries that you are looking for:

SSLCACertificateFile <path to valid CA certs>
SSLVerifyClient reqiure
SSLVerifyDepth 5

You need to specify what root CAs you trust by setting the appropriate CA certs. If you are using it in-house, you can become your own root CA and use that to issue client certs to your browsers. Otherwise, you will need to use a valid CA root cert (they're typically bundled or you can download them).

Once that is done, you will have an extra environment variable when a verified client connects called SSL_CLIENT_S_DN and several others.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.