Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works.

Now I'm required to generate x509 client-side certificates to issue for this subdomain. I'm following along this page: (http://www.vanemery.com/Linux/Apache/apache-SSL.html), starting with "Creating Client Certificates for Authentication".

I've generated the p12 files and successfully imported them into Firefox. When I browse to the site now, I get an error in FireFox that says "The connection to the server was reset while the page was loading."

I think my problem is coming from not signing the client-side correctly. When I sign the client-side certificate, I'm using the PEM file (RapidSSL_CA_bundle.pem) from RapidSSL (who we bought the certificate from) for the -CA argument. For the -CAkey argument, I'm using the private key of the server. Is this correct?

share|improve this question

migrated from stackoverflow.com Mar 5 '11 at 16:58

This question came from our site for professional and enthusiast programmers.

    
I think ServerFault would be a more appropriate place for a question since it's clearly a configuration issue and not a programming one. –  Eugene Mayevski 'EldoS Corp Mar 4 '11 at 16:40
    
My bad. Didn't realize this was misplaced. –  walshms Mar 4 '11 at 16:54
    
No, that is not correct. –  GregS Mar 5 '11 at 13:21

3 Answers 3

up vote 0 down vote accepted

I do not think that the license for a wildcard certificate allows you to use it for signing other certificates. You need to be a certificate authority to be able to do that.

share|improve this answer
    
Thanks. I think after trying to talk with my CA's technical support I got to this conclusion. –  walshms Mar 7 '11 at 20:33

Apache is probably resetting the connection. Try looking at your log files. If you are on *nix system this should be in /var/log/apache/error.log.

share|improve this answer

Use openssl to view the contents of your generated certificate. It will then be obvious if your signing is working correctly.

openssl x509 -text -noout -in <yoursignedcert>

If that looks OK and appears to have an Issuer field that reflects where it is signed try using openssl to attach to your server and see what it is expecting.

openssl s_client -connect <host>:port -CAfile <yourtrustcert> -cert <yoursignedcert>

That should give some clues as to whether the server is requesting your certificate or not.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.