1

I am trying to configure an Apache install to accept client certificates. When I work with self-signed certificate, unknown to Apache and using Firefox, it works when SSLVerifyClient set to optional_no_ca.

However, we also try to connect from WebMethods SAP, and it gives an error (the message says "Server certicate rejected by chain verifier."), but I cannot see what is going on in my Apache install.

Is there a way to see what Apache is receiving / sending from this client? My logs are all empty for this IP address.

I got some more logging by putting the LogLevel to debug. This is the message I get now:

[Fri Mar 27 14:30:19.030334 2015] [ssl:info] [pid 2154] SSL Library Error: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate (SSL alert number 42) -- Subject CN in certificate not server name or identical to CA!?

What does that mean, and does the client certificate need to have the server CN in it?

6

0

You must log in to answer this question.

Browse other questions tagged .