Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a apache 2 host running with a commercial (rapidssl) signed certificate and I need to generate client certificates for authentication.

I created a CA (according to http://www.cafesoft.com/products/cams/ps/docs30/admin/ConfiguringApache2ForSSLTLSMutualAuthentication.html ) and modified my apache config file accordingly.

<VirtualHost *:443>
  Servername SITEtest.XXX.com
  DocumentRoot /SITE/html

        CustomLog /SITE/html.log vhost_combined
        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl/comercialcert.cer
        SSLCertificateChainFile /etc/apache2/ssl/comercialcert.int
        SSLCertificateKeyFile /etc/apache2/ssl/comercialcert.key

  <Directory /SITE>
        AllowOverride All
        SSLRequireSSL
            SSLCACertificateFile /etc/apache2/ssl/selfsignedcaCA.crt
            SSLVerifyClient require
            SSLVerifyDepth 1
            SSLOptions +StrictRequire +StdEnvVars +ExportCertData +FakeBasicAuth
  </Directory>

</VirtualHost>

I imported a pkcs12 file generated with the same CA to my browser. Every time I try to access I get the error "Re-negotiation handshake failed: Not accepted by client!?" on apache error log.

Everything works fine if I use a certificate generated by my CA in SSLCertificateFile but that doesn't work as intended as the browser recognizes the web server certificate as self signed.

Further details:

Apache/2.2.9 (Debian Lenny) mod_ssl/2.2.9 OpenSSL/0.9.8g

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You may be using an apache distribution that has had the tis renegotiation workarounds back-ported into it. One quick thing to try is to add the SSLInsecureRenegotiation off directive. If that doesn't work, change your SSLVerifyClient directive to Optional.

This will open the server up to TLS Renegotiation vulnerabilities for that directory location but there isn't much you can do about it until Debian updates their distribution (or you custom compile your own distribution).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.