1

How can I configure Apache 2 (on Ubuntu 10.04) to use Client Certificate Authentication where my domain (secure.somedomain.com) is secured by a third party trusted SSL certificate, and the client certificates are issued by my own CA?

When I try using the 3rd party trusted SSL certificate (/C=US /O=GeoTrust, Inc. /CN=RapidSSL CA) I get errors, because I think the SSLCACertificateFile conflicts !?!?

Result from: $ openssl s_client -state -debug -showcerts -verify 0 -connect secure.somedomain.com

depth=1 /C=US/O=GeoTrust, Inc./CN=RapidSSL CA
verify error:num=20:unable to get local issuer certificate
verify return:0

My apache conf file:

<VirtualHost *:443>
    ServerAdmin [email protected]
    ServerName secure.somedomain.com

    SSLEngine On
    SSLCertificateFile /var/websites/ssl/certificate.cer
    SSLCertificateKeyFile /var/websites/ssl/key.key
    SSLCACertificateFile /var/websites/ssl/intermediate.cer

    DocumentRoot /var/websites/www
    <Directory />
            Options FollowSymLinks
            AllowOverride None
    </Directory>
    <Directory /var/websites/www>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
            SetHandler mono
            DirectoryIndex index.html default.aspx

            SSLCACertificateFile /etc/apache2/ownca.pem
            SSLVerifyClient require
            SSLVerifyDepth 1
    </Directory>

    LogLevel warn
    ErrorLog /var/websites/logs/error_443.log
    CustomLog /var/websites/logs/access_443.log combined
    ServerSignature On

Any advise would be greatly appreciated. I can find lots of tutorials about using own self signed certificate but no example of a 3rd party trusted root. I don't want a security warning for my users.

They should be able to go to my site, it should present a valid trusted 3rd party issued certificate and request a certificate from the client that was signed by my CA.

Improve this question

2 Answers 2

Reset to default
1

sometimes u need to add a SSLCertificateChainFile option in your apache2.conf.

For example, we use SureServer for our SSL certificates. Sometimes browsers to not contain the full tree for the SSL certificate andu need to supply the missing piece: 

SSLEngine On
SSLCertificateFile ...
SSLCertificateKeyFile ...
SSLCertificateChainFile /etc/apache2/sureserverEDU.pem

So u probably need to add your 3rd party CA there.

If I recall correctly rapidSSL has a chain file (RapidSSL_CA_bundle.pem)

Improve this answer
5
  • 3
    Could you please try to use real words in your answers?
    – EEAA
    Jul 18, 2011 at 15:15
  • ? what do you mean ?
    – Goez
    Jul 18, 2011 at 15:17
  • As an example : we use SureServer for our SSL certificates, sometimes broswers do not contain the full tree of the SSL certificate. If so you need to supply the missing piece : code Probably you will need to add your 3rd party CA. If I recall correctly rapidSSL has a chain file called RapidSSL_CA_bundle.pem.
    – Lucas Kauffman
    Jul 18, 2011 at 15:18
  • 1
    "u" instead of "you". You're not typing on a phone keyboard. Type the whole word and the world will be a better place. :)
    – EEAA
    Jul 18, 2011 at 15:20
  • I get what Goez is saying about the CertificateChainFile but I not having a problem getting the trusted 3rd party certificate working to secure the website. If I take out all the SSL related lines in the <directory> directive then it works like a standard secure website, no problem. Its the introduction of Client Certificate authentication that is causing the problem.
    – Scott McArthur
    Jul 18, 2011 at 15:21
0

I decided to start with a clean server. The errors I was encountering was actually due to the browser not yet having the client certificate; and as such it was displaying obscure error messages.

<VirtualHost _default_:443>
    ServerAdmin [email protected]
    ServerName secure.somedomain.com

    SSLEngine On
    SSLCertificateFile /var/websites/ssl/certificate.crt
    SSLCertificateKeyFile /var/websites/ssl/certificate.key
    SSLCertificateChainFile /var/websites/ssl/cachain.pem

    DocumentRoot /var/websites/www
    <Directory />
            Options FollowSymLinks
            AllowOverride None
    </Directory>
    <Directory /var/websites/www>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
    SetHandler mono
            DirectoryIndex index.html index.aspx default.aspx

            SSLRequireSSL
    SSLCACertificateFile /etc/apache2/ownca.pem                
    SSLVerifyClient require
            SSLVerifyDepth 1
            SSLOptions +StrictRequire +StdEnvVars +ExportCertData
    </Directory>

    LogLevel warn
    ErrorLog /var/websites/logs/error_443.log
    CustomLog /var/websites/logs/access_443.log combined
ServerSignature On

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .