Browser not asking for client certificate

Question

I am configuring Apache to use client certificate authentication. When I brows to the site however, it does not ask me for a certificate, unless SSLCACertificateFile is specified. It will then ask for a certificate through the browser. The browser will pop up a box asking me to choose a certificate (it only shows certificates signed by the CA specified by SSLCACertificateFile).

I am using a self signed certificate.

It also does not matter if the certs the 'client' uses is specified in SSLCACertificatePath.

Any helpful advice on why it is acting this way? Is the browser not asking for certificates normal unless SSLCACertificateFile is specified?

<VirtualHost _default_:443>
DocumentRoot "C:/documents"
ServerName server.ip:443
ServerAdmin [email protected]
ErrorLog "C:/Apache2.2/logs/error.log"
TransferLog "C:/Apache2.2/logs/access.log"

SSLEngine on
SSLCipherSuite HIGH:MEDIUM

SSLCertificateFile C:/Apache2.2/certs/server.crt

SSLCertificateKeyFile C:/Apache2.2/certs/server.key

SSLCertificateChainFile C:/Apache2.2/certs/ca.crt

SSLCACertificateFile C:/Apache2.2/certs/ca.crt

SSLCACertificatePath C:/Apache2.2/allowed-crts

SSLCARevocationPath C:/Apache2.2/revoked-certs

SSLVerifyClient require
SSLVerifyDepth  2

SSLOptions +ExportCertData +StdEnvVars
<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory "C:/Apache2.2/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch ".*MSIE.*" \
     nokeepalive ssl-unclean-shutdown \
     downgrade-1.0 force-response-1.0

CustomLog "C:/Apache2.2/logs/webservices-ssl_request.log" \
      "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

Answer 1

What you are saying does make sense, and the doc, while a bit vague, seems to agree.

SSLCACertificateFile

This directive sets the all-in-one file where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with. These are used for Client Authentication. Such a file is simply the concatenation of the various PEM-encoded Certificate files, in order of preference. This can be used alternatively and/or additionally to SSLCACertificatePath.

Just to clarify, I understand it that SSLCACertificateFile is needed so that the server knows which clients it is allowed to let in the protected area and you would need at least SSLCACertificateFile or SSLCACertificatePath.

Answer 2

When using self-signed certs, I've found it easier to forgo the CA business and use SSLVerifyClient optional_no_ca combined with SSLRequire:

    DocumentRoot /srv/www/1
ServerName your.server.tld
SSLCertificateFile /etc/apache2/ssl/your.server.tld.crt
SSLCertificateKeyFile /etc/apache2/ssl/your.server.tld.key
SSLEngine on
SSLOptions +StdEnvVars
<Location />
    Order allow,deny
    allow from all

    SSLRequireSSL
    SSLVerifyDepth 1
    SSLVerifyClient optional_no_ca
    SSLRequire (\
        %{SSL_CLIENT_CERT} eq file("/etc/apache2/ssl/validclient.crt")\
    )
</Location>

Answer 3

If you're planning to use self-signed client certificates (which can be sense, but should be done with caution, as they'll eventually need to be verified somehow), you'll need:

• to get the server to send an empty CA list in its Certificate Request TLS message (so that the browser offers you a choice between all the certs it has, including self-signed ones): this can be done using SSLCADNRequestFile pointing to a file with an empty line;
• to get the server to accept any cert: this can be done with SSLVerifyClient optional_no_ca.

There are more details in this answer.