I am trying to configure an Apache install to accept client certificates. When I work with self-signed certificate, unknown to Apache and using Firefox, it works when SSLVerifyClient
set to optional_no_ca
.
However, we also try to connect from WebMethods SAP, and it gives an error (the message says "Server certicate rejected by chain verifier."), but I cannot see what is going on in my Apache install.
Is there a way to see what Apache is receiving / sending from this client? My logs are all empty for this IP address.
I got some more logging by putting the LogLevel
to debug
. This is the message I get now:
[Fri Mar 27 14:30:19.030334 2015] [ssl:info] [pid 2154] SSL Library Error: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate (SSL alert number 42) -- Subject CN in certificate not server name or identical to CA!?
What does that mean, and does the client certificate need to have the server CN in it?