Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create a static page instead of the default "ssl_error_handshake_failure_alert" page when an error occurs, for example when the client do not send any certificate.

how can i do this? any idea?

thankss

share|improve this question

3 Answers 3

Sorry for digging up this one year later. You can solve your issue without scripting by combining "SSLVerifyClient optional" and "SSLRequire ". In this case, the SSL handshake succeeds, since the cert is only optional, however, it turns out to be mandatory though, by the SSLRequire statement a little bit later down the process ...

Like:

<Location /somewhere>
SSLRequireSSL
SSLVerifyClient optional
SSLVerifyDepth 10
SSLRequire %{SSL_CLIENT_I_DN_CN} eq "YOURSELF"
ErrorDocument 403 "!FORBIDDEN!"
</Location>
share|improve this answer

HTTPS is HTTP inside a SSL tunnel, so if the SSL negociation fail, HTTP conversation between the server and the client has not even started.

As a matter of fact, in this case, the error page is generated by the client's browser then you can't change this page on the server side.

share|improve this answer

Set your location to be sslverifyclient optional (apache). An example

<Location /resources/protected/>
    SSLOptions +StdEnvVars
    SSLVerifyClient optional
</Location>

Now a scipt in that location will have it's env set with env vars such as these. If apache was able to client authenticate, then you can do a test similar to

if ( $ENV{SSL_CLIENT_S_DN_CN}  &&  SSL_CLIENT_I_DN == "Blah issuer")
 echo" we are good"
else
 echo "You need to enrol for a cert.. Please contact admin @ blah"

So an authenticated person will see the "we are good" line while everyone else will see the enrollment message.

I hope this helps!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.