SSL CA client verification issues with IE

Question

I have been trying to configure client authentication based upon a client-side certificate. Some browsers have issues accessing the page and end up throwing an error. After looking at a packet dump, it appears that the browser attempts to change the "Cipher Spec" and the web-server responds with an error (Error Type 21).

After spending a long time making changes to the configuration, I discovered that, by disabling SSLVerifyClient option, the site could then load. Without this option however, client authentication is obviously not possible.

Does any one have any ideas as to why this could be happening?

Answer 1

Alert 21 is decryption_failed (see RFC 2246, section 7.2). That's a very odd alert to get and typically indicates a bug in the SSL stack.

When you have SSLVerifyClient set, the server does send a CertificateRequest I assume. And the client is choosing not to send one? That should, of course, all work fine.

As a random thought, if this is a FreeBSD server, make sure that you didn't compile Apache against the wrong OpenSSL headers (i.e. if your ports OpenSSL is 1.0.0 and the system is 0.9.8).