Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been trying to configure client authentication based upon a client-side certificate. Some browsers have issues accessing the page and end up throwing an error. After looking at a packet dump, it appears that the browser attempts to change the "Cipher Spec" and the web-server responds with an error (Error Type 21).

After spending a long time making changes to the configuration, I discovered that, by disabling SSLVerifyClient option, the site could then load. Without this option however, client authentication is obviously not possible.

Does any one have any ideas as to why this could be happening?

share|improve this question

Alert 21 is decryption_failed (see RFC 2246, section 7.2). That's a very odd alert to get and typically indicates a bug in the SSL stack.

When you have SSLVerifyClient set, the server does send a CertificateRequest I assume. And the client is choosing not to send one? That should, of course, all work fine.

As a random thought, if this is a FreeBSD server, make sure that you didn't compile Apache against the wrong OpenSSL headers (i.e. if your ports OpenSSL is 1.0.0 and the system is 0.9.8).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.