Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Attempting to implement client authentication with an SSL cert.

http://www.modssl.org/docs/2.8/ssl_howto.html#auth-selective

Receive the following errors.

Apache: Re-negotiation handshake failed: Not accepted by client!?

Firefox:

ssl_error_handshake_failure_alert

I assume it is a configuration error, but have not been able to locate it.

Additional info: Commercial CA server cert servers secure works without problem in Apache 2.2 & Passenger. Only client authentication related directives do not work.

share|improve this question
    
Erm modssl.org is for Apache1.3. Apache2 has SSL built in. Which version are you using? –  David Pashley Jun 3 '09 at 16:25
    
It looks like the SSL configuration is the same for Apache 2.2. httpd.apache.org/docs/2.2/ssl/ssl_howto.html#accesscontrol I will setup the SSL logging tonight to trace the handshake. I think it might be related to the Configuration of the SSLCACertificateFile. httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcacertificatefile –  Bryan Jun 3 '09 at 17:20

4 Answers 4

Seeing that the handshake fails it could be that the client doesn't understand (or is configured to use) the negotiated SSL Protocol. Check eg in FF whether all SSL protocols are enabled (SSL2, SSL3, TLSv1) and match that up with the SSL protocol configured for Apache.

update: it might also be usefull to do a network trace to see what cypher suites both client and server support. Maybe they cannot find matching suite and hence the handshake fails.

or setting up the modssl log can reveal some more detail as well : http://www.modssl.org/docs/2.8/ssl_reference.html#ToC19

share|improve this answer

Are you by any chanced running Debian/Lenny?

We ran into a similiar issue and finally found out that accepted certificates now mustn't have MD5 (SHA-something is fine) checksum because it's considered insecure.

Our issue was with GnuTLS+OpenLDAP thou. You might want to try a renewed cert or even a self-signed cert before spending more money.

share|improve this answer

In my case the client certificate(the '.p12' thing imported into Firefox) was outdated and i was produced with such an error. If that's the case you'll need to re-generate the client cert and sign it.

share|improve this answer

Check the Paypal URL

api.paypal.com/webscr&cmd=_express-checkout&token=’; Replace with api.paypal.com/webscr&cmd=_express-checkout&token=’;

for more details see... http://blog.oryxn.com/2010/10/ssl_error_handshake_failure_alert-paypal/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.