3

Attempting to implement client authentication with an SSL cert.

http://www.modssl.org/docs/2.8/ssl_howto.html#auth-selective

Receive the following errors.

Apache: Re-negotiation handshake failed: Not accepted by client!?

Firefox:

ssl_error_handshake_failure_alert

I assume it is a configuration error, but have not been able to locate it.

Additional info: Commercial CA server cert servers secure works without problem in Apache 2.2 & Passenger. Only client authentication related directives do not work.

2
1

Seeing that the handshake fails it could be that the client doesn't understand (or is configured to use) the negotiated SSL Protocol. Check eg in FF whether all SSL protocols are enabled (SSL2, SSL3, TLSv1) and match that up with the SSL protocol configured for Apache.

update: it might also be usefull to do a network trace to see what cypher suites both client and server support. Maybe they cannot find matching suite and hence the handshake fails.

or setting up the modssl log can reveal some more detail as well : http://www.modssl.org/docs/2.8/ssl_reference.html#ToC19

1

Are you by any chanced running Debian/Lenny?

We ran into a similiar issue and finally found out that accepted certificates now mustn't have MD5 (SHA-something is fine) checksum because it's considered insecure.

Our issue was with GnuTLS+OpenLDAP thou. You might want to try a renewed cert or even a self-signed cert before spending more money.

0

In my case the client certificate(the '.p12' thing imported into Firefox) was outdated and i was produced with such an error. If that's the case you'll need to re-generate the client cert and sign it.

0

Check the Paypal URL

api.paypal.com/webscr&cmd=_express-checkout&token=’; Replace with api.paypal.com/webscr&cmd=_express-checkout&token=’;

for more details see... http://blog.oryxn.com/2010/10/ssl_error_handshake_failure_alert-paypal/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy