I am trying to setup Client Certificate Authentication for a web service that is running on Rails. The service is running on apache2, passenger, and mod_ssl. I have been able to successfully generate the keys and setup the Client Certificate authentication for the entire domain. This works fine, however, when I try to include the Location directive I always get this error (from browsers and ruby client):
SSL_connect returned=1 errno=0 state=SSLv3 read finished A: sslv3 alert handshake failure (OpenSSL::SSL::SSLError).
When I run the command from curl I get this error:
curl: (52) Empty reply from server
I remove the directive and it works fine. This what my confiration for this virtual host looks like.
<VirtualHost *:443 *:80> ServerName wrangler.optimis.local DocumentRoot "/Users/jmoore/Sites/data-wrangler/public/" RackEnv development ErrorLog "/Users/jmoore/Sites/data-wrangler/log/error.log" CustomLog "/Users/jmoore/Sites/data-wrangler/log/access.log" common SetEnv GEM_HOME /Users/jmoore/.rvm/gems/ree-1.8.7-2010.02 SetEnv GEM_PATH /Users/jmoore/.rvm/gems/ree-1.8.7-2010.02 # Enable SSL on this domain SSLEngine on SSLProtocol ALL SSLCipherSuite HIGH:MEDIUM SSLCertificateFile /etc/apache2/ssl.key/new/wrangler_servercert.pem SSLCertificateKeyFile /etc/apache2/ssl.key/new/wrangler_server.nopass.key # Enable SSL client certificates, but disable verification for the entire domain (we only want it on specific URLs) #SSLCACertificatePath /etc/apache2/ssl.key/new/demoCA SSLCACertificateFile /etc/apache2/ssl.key/new/demoCA/cacert.pem #SSLCertificateChainFile /etc/apache2/ssl.key/new/demoCA/cacert.pem #SSLVerifyClient require SSLVerifyClient none #SSLVerifyDepth 1 <Location /test> SSLVerifyClient require SSLVerifyDepth 1 </Location> </VirtualHost>
My research has indicated that this is usually caused by bad certificates so I have regenerated the certificates several times and each time it works fine for the entire domain but gives the handshake error when I try to limit to just one location. Since these configurations are suggested by the apache documentation I am not sure what is going wrong. Does anybody know how to resolve the handshake problem that happens when you try to limit the client authentication to one location?