Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a apache 2 host running with a commercial (rapidssl) signed certificate and I need to generate client certificates for authentication.

I created a CA (according to ) and modified my apache config file accordingly.

<VirtualHost *:443>
  DocumentRoot /SITE/html

        CustomLog /SITE/html.log vhost_combined
        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl/comercialcert.cer
        SSLCertificateChainFile /etc/apache2/ssl/
        SSLCertificateKeyFile /etc/apache2/ssl/comercialcert.key

  <Directory /SITE>
        AllowOverride All
            SSLCACertificateFile /etc/apache2/ssl/selfsignedcaCA.crt
            SSLVerifyClient require
            SSLVerifyDepth 1
            SSLOptions +StrictRequire +StdEnvVars +ExportCertData +FakeBasicAuth


I imported a pkcs12 file generated with the same CA to my browser. Every time I try to access I get the error "Re-negotiation handshake failed: Not accepted by client!?" on apache error log.

Everything works fine if I use a certificate generated by my CA in SSLCertificateFile but that doesn't work as intended as the browser recognizes the web server certificate as self signed.

Further details:

Apache/2.2.9 (Debian Lenny) mod_ssl/2.2.9 OpenSSL/0.9.8g

share|improve this question
up vote 1 down vote accepted

You may be using an apache distribution that has had the tis renegotiation workarounds back-ported into it. One quick thing to try is to add the SSLInsecureRenegotiation off directive. If that doesn't work, change your SSLVerifyClient directive to Optional.

This will open the server up to TLS Renegotiation vulnerabilities for that directory location but there isn't much you can do about it until Debian updates their distribution (or you custom compile your own distribution).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.