Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After some research I got the idea that I can't use SSLVerifyClient successfully anywhere except within a server context because of current CVE-2009-3555 mitigation efforts.

Specifically, because of CVE-2009-3555, various versions of OpenSSL, Apache/mod_ssl and some browsers stopped allowing SSL renegotiation. So SSLVerifyClient require in a Directory, Location or .htaccess context causes service to fail (e.g. various of these examples fail). Since CVE-2009-3555, RFC 5746 was published, which newer versions of OpenSSL, Apache/mod_ssl etc. support.

Q1: Is this summary approximately correct?

My problem immediate is with shared web hosting. I've no access to httpd.conf and no way to upgrade the software.

Q2: If I find a shared web hosting company running recent software that supports RFC 5746 TLS Renegotiation Indication (unlike GoDaddy) will I have any success putting into .htaccess:

SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile /path/to/my/ca.crt

where ca.crt is my bastard self-signed CA cert?

mod_ssl docs don't say SSLCACertificateFile can go in a .htaccess but I don't get the typical "Not allowed here" error when I put it there.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Q1: Yeah, correct.

Q2: No, I don't think it'll work.

Config-wise, is there any reason SSLCACertificateFile couldn't go in a broader config section like a VirtualHost block?

But, that aside, client certificates are probably a lost cause on this system, assuming that GoDaddy has actually patched to disable renegotiation (with them, I won't assume). I don't know of any way around the requirement that client certificate authentication requires a renegotiation.

share|improve this answer
    
It could go in a borader context but I don't believe I have access to any kind of httpd.conf. All I can touch, it seems, is .htaccess. –  fsb Mar 19 '11 at 4:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.