How can I configure Apache 2 (on Ubuntu 10.04) to use Client Certificate Authentication where my domain (secure.somedomain.com) is secured by a third party trusted SSL certificate, and the client certificates are issued by my own CA?
When I try using the 3rd party trusted SSL certificate (/C=US /O=GeoTrust, Inc. /CN=RapidSSL CA) I get errors, because I think the SSLCACertificateFile conflicts !?!?
Result from: $ openssl s_client -state -debug -showcerts -verify 0 -connect secure.somedomain.com
depth=1 /C=US/O=GeoTrust, Inc./CN=RapidSSL CA verify error:num=20:unable to get local issuer certificate verify return:0
My apache conf file:
<VirtualHost *:443> ServerAdmin [email protected] ServerName secure.somedomain.com SSLEngine On SSLCertificateFile /var/websites/ssl/certificate.cer SSLCertificateKeyFile /var/websites/ssl/key.key SSLCACertificateFile /var/websites/ssl/intermediate.cer DocumentRoot /var/websites/www <Directory /> Options FollowSymLinks AllowOverride None </Directory> <Directory /var/websites/www> Options Indexes FollowSymLinks MultiViews AllowOverride None Order allow,deny allow from all SetHandler mono DirectoryIndex index.html default.aspx SSLCACertificateFile /etc/apache2/ownca.pem SSLVerifyClient require SSLVerifyDepth 1 </Directory> LogLevel warn ErrorLog /var/websites/logs/error_443.log CustomLog /var/websites/logs/access_443.log combined ServerSignature On
Any advise would be greatly appreciated. I can find lots of tutorials about using own self signed certificate but no example of a 3rd party trusted root. I don't want a security warning for my users.
They should be able to go to my site, it should present a valid trusted 3rd party issued certificate and request a certificate from the client that was signed by my CA.