I have TLS 1.2 mutual authentication working on Apache 2.4.54 with a self-signed CA and test clients on iOS and MacOS. Everything works, except the clients do not recognize the "Acceptable client certificate CA" on the CertificateRequest, so user/app must know which one to choose. On my iOS app, the URLAuthenticationChallenge.protectionSpace.distinguishedNames field that is supposed to deliver this list is empty. On MacOS Safari it asks the user to choose a certificate among all installed, even though only 1 has the correct issuer CA. Using

openssl s_client -connect myserver.com:443 -prexit


Acceptable client certificate CA names

Relevant apache config is like so.

SSLCACertificateFile /etc/pki/CA/cacert.pem
SSLCADNRequestFile /etc/pki/CA/cacert.pem
SSLVerifyClient require
SSLVerifyDepth  1

I get same result without SSLCADNRequestFile. Looking at apache logs with LogLevel trace8 appears to show the proper distinguished name being written on the CertificateRequest. This is raw dump, so I can't read the binary fields, but I can see the right ASCII for my CA CN. I guess iOS/MacOS must be seeing this data, but deciding not useable.

The CA certificate has X509v3 Basic Constraints: CA:TRUE, but no keyUsage specs. Since the authentication works, I assume the cert is okay, as long as client chooses right cert.

Any ideas what I am doing wrong, or how to debug further?

1 Answer 1


I was wrong. The acceptable CA list is being delivered to my iOS app (whether I include the SSLCADNRequestFile or not). There are two app callbacks at the start of the connection, and the DER-encoded CA list is delivered on the second. I still need to figure out why MacOS Safari gave me option to choose certs with wrong CA, but at least the list is being delivered.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.