Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have client certificate configured and working in Apache. I want to pass the PEM-encoded X.509 certificates of the client to the backend server.

I tried with the SSLOptions +ExportCertData. This does nothing at all, while the documentation states it should add SSL_SERVER_CERT, SSL_CLIENT_CERT and SSL_CLIENT_CERT_CHAINn (with n = 0,1,2,..) as headers. Any ideas why this option is not working?

I then tried setting the headers myself using RequestHeader. This works fine for all variables except SSL_CLIENT_CERT_CHAIN. It shows null in the header. Any ideas why the certificate chain is not being filled?

This is my first Apache configuration:

<VirtualHost 192.168.56.100:443>
    ServerName www.test.org
    ServerAdmin webmaster@localhost

    DocumentRoot /var/www

    ErrorLog ${APACHE_LOG_DIR}/error.log
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

    SSLEngine on
    SSLProxyEngine on

    SSLCertificateFile     /etc/apache2/ssl/certs/www.test.org.crt
    SSLCertificateKeyFile  /etc/apache2/ssl/private/www.test.org.key
    SSLCACertificateFile   /etc/apache2/ssl/ca/ca.crt

    <Proxy *>
        AddDefaultCharset Off
        Order deny,allow
        Allow from all
    </Proxy>

    <Location /carbon>
        ProxyPass          http://www.test.org:9763/carbon
        ProxyPassReverse   http://www.test.org:9763/carbon
    </Location>

    <Location /services/GbTestProxy>
        SSLVerifyClient require
        SSLVerifyDepth  5
        SSLOptions +ExportCertData

        ProxyPass          http://www.test.org:8888/services/GbTestProxy 
        ProxyPassReverse   http://www.test.org:8888/services/GbTestProxy 
    </Location>
</VirtualHost>

This is my second Apache configuration:

<VirtualHost 192.168.56.100:443>
    ServerName www.test.org
    ServerAdmin webmaster@localhost

    DocumentRoot /var/www

    ErrorLog ${APACHE_LOG_DIR}/error.log
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

    SSLEngine on
    SSLProxyEngine on

    SSLCertificateFile     /etc/apache2/ssl/certs/www.test.org.crt
    SSLCertificateKeyFile  /etc/apache2/ssl/private/www.test.org.key
    SSLCACertificateFile   /etc/apache2/ssl/ca/ca.crt

    <Proxy *>
        AddDefaultCharset Off
        Order deny,allow
        Allow from all
    </Proxy>

    <Location /carbon>
        ProxyPass          http://www.test.org:9763/carbon
        ProxyPassReverse   http://www.test.org:9763/carbon
    </Location>

    <Location /services/GbTestProxy>
        SSLVerifyClient require
        SSLVerifyDepth  5
        SSLOptions +ExportCertData

        RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
        RequestHeader set SSL_CLIENT_I_DN "%{SSL_CLIENT_I_DN}s"
        RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_SERVER_S_DN_CN}s"
        RequestHeader set SSL_SERVER_S_DN_OU "%{SSL_SERVER_S_DN_OU}s"
        RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
        RequestHeader set SSL_CLIENT_CERT_CHAIN_0 "%{SSL_CLIENT_CERT_CHAIN_0}s"
        RequestHeader set SSL_CLIENT_CERT_CHAIN_1 "%{SSL_CLIENT_CERT_CHAIN_1}s"
        RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"

        ProxyPass          http://www.test.org:8888/services/GbTestProxy 
        ProxyPassReverse   http://www.test.org:8888/services/GbTestProxy 
    </Location>
</VirtualHost>

Hope someone can help.

Regards, nidkil

share|improve this question

1 Answer 1

SSLOptions +ExportCertData doesn't add headers to a proxied request, it adds environment variables -- the environment variables that you're trying to add to the headers in your second config (but they aren't in the environment then, since you dropped the SSLOptions config).

You'll need both the RequestHeader set config as well as SSLOptions +ExportCertData.

share|improve this answer
    
Shane, thx for your quick response. When I added the SSLOptions to the second example, the certificate chain is unfortunately still not added. Any other suggestions? I have updated the example in my question to reflect your suggestion. Quick question out of curiosity, why does the client certificate get populated without setting the SSLOptions? –  nidkil Jul 9 '12 at 9:33
1  
Ahh, you're missing an underscore - change %{SSL_CLIENT_CERT_CHAIN1}s to %{SSL_CLIENT_CERT_CHAIN_1}s. –  Shane Madden Jul 9 '12 at 15:50
    
Hi Shane, Sharp eye! The underscore was missing. Corrected it and it still doesn't work :-( This is driving me insane. Anymore ideas? Updated the the example to reflect the correction. –  nidkil Jul 9 '12 at 22:56
    
Huh. Is there an intermediate cert for it to include as a part of the chain, or is it just the client cert straight back to the configured root? –  Shane Madden Jul 10 '12 at 5:23
1  
Hi shane, No there is no intermediate certificate ... Are you saying that only intermediate certificates are shown with the SSL_CLIENT_CERT_CHAIN_n? How do you get the root CA then? –  nidkil Jul 10 '12 at 5:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.