static page instead of the default “ssl_error_handshake_failure_alert”

Question

I want to create a static page instead of the default "ssl_error_handshake_failure_alert" page when an error occurs, for example when the client do not send any certificate.

how can i do this? any idea?

thankss

Answer 1

HTTPS is HTTP inside a SSL tunnel, so if the SSL negociation fail, HTTP conversation between the server and the client has not even started.

As a matter of fact, in this case, the error page is generated by the client's browser then you can't change this page on the server side.

Answer 2

Set your location to be sslverifyclient optional (apache). An example

<Location /resources/protected/>
    SSLOptions +StdEnvVars
    SSLVerifyClient optional
</Location>

Now a scipt in that location will have it's env set with env vars such as these. If apache was able to client authenticate, then you can do a test similar to

if ( $ENV{SSL_CLIENT_S_DN_CN}  &&  SSL_CLIENT_I_DN == "Blah issuer")
 echo" we are good"
else
 echo "You need to enrol for a cert.. Please contact admin @ blah"

So an authenticated person will see the "we are good" line while everyone else will see the enrollment message.

I hope this helps!

Answer 3

Sorry for digging up this one year later. You can solve your issue without scripting by combining "SSLVerifyClient optional" and "SSLRequire ". In this case, the SSL handshake succeeds, since the cert is only optional, however, it turns out to be mandatory though, by the SSLRequire statement a little bit later down the process ...

Like:

<Location /somewhere>
SSLRequireSSL
SSLVerifyClient optional
SSLVerifyDepth 10
SSLRequire %{SSL_CLIENT_I_DN_CN} eq "YOURSELF"
ErrorDocument 403 "!FORBIDDEN!"
</Location>