Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm getting the error mentioned in the title in Firefox when i try to access my website on my machine. This is the error i get :

An error occurred during a connection to www.st.um.
SSL peer was unable to negotiate an acceptable set of security parameters.
(Error code: ssl_error_handshake_failure_alert)

This is my virtual host configuration :

<VirtualHost *:443>
    ServerAdmin user1@st.um
    ServerName www.st.um
    DocumentRoot /var/www/web
    <Directory /var/www/web>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>    
    SSLEngine on
    SSLCertificateFile /usr/lib/ssl/demoCA/servercert.pem
    SSLCertificateKeyFile /usr/lib/ssl/demoCA/serverkey.pem
    SSLCACertificateFile /usr/lib/ssl/demoCA/stcert.pem

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>

    BrowserMatch "MSIE [2-6]" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0

    # MSIE 7 and newer should be able to use keepalive
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

    SSLVerifyClient require
    SSLVerifyDepth 10

</VirtualHost>

The certificate "servercert.pem" is certificated using my CA : "stcert.pem" and i can use the certificate "servercert.pem" with the key "serverkey.pem" perfectly to gain access to the s_server as a server and having my CA imported and trusted in the list of authorities of the web browser :

openssl s_server -cert servercert.pem -key serverkey.pem -www

I also can gain access to my website as a client using a PKCS#12 file generated from a certificate "clientcert.pem" with its key "clientkey.pem".

The only thing that i have in /etc/log/apache2/error.log is :

[Sat May 25 02:44:11 2013] [notice] Apache/2.2.22 (Ubuntu) 
PHP/5.3.10-1ubuntu3.6 with Suhosin-Patch mod_ssl/2.2.22 
OpenSSL/1.0.1 configured -- resuming normal operations
share|improve this question
    
When i try to access my website in my machine i get the ssl error handshake failure alert in the web browser –  mragrid May 25 '13 at 0:36
    
What exactly does the Apache error log say? –  daff May 25 '13 at 0:40
    
OK, i just updated the question with the complete error description. –  mragrid May 25 '13 at 0:41
    
I just edited my virtualhost configuration and deleted "SSLVerifyClient require" and "SSLVerifyDepth 10". And now it is working. I could not answer my own question because it is asking me to wait 8 hours for being a beginner. –  mragrid May 25 '13 at 1:11

1 Answer 1

up vote 1 down vote accepted

I edited my virtualhost configuration and deleted :

    SSLVerifyClient require
    SSLVerifyDepth 10

And now it is working for server-side authentication. The "SSLVerifyClient require" directive override the lines :

SSLCertificateFile /usr/lib/ssl/demoCA/servercert.pem
SSLCertificateKeyFile /usr/lib/ssl/demoCA/serverkey.pem
SSLCACertificateFile /usr/lib/ssl/demoCA/stcert.pem

And that was the problem. The "SSLVerifyClient require" directive is for client-Side authentication and it makes openSSL to always require a certificate from the client.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.