I am trying to configure an Apache install to accept client certificates. When I work with self-signed certificate, unknown to Apache and using Firefox, it works when SSLVerifyClient set to optional_no_ca.

However, we also try to connect from WebMethods SAP, and it gives an error (the message says "Server certicate rejected by chain verifier."), but I cannot see what is going on in my Apache install.

Is there a way to see what Apache is receiving / sending from this client? My logs are all empty for this IP address.

I got some more logging by putting the LogLevel to debug. This is the message I get now:

[Fri Mar 27 14:30:19.030334 2015] [ssl:info] [pid 2154] SSL Library Error: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate (SSL alert number 42) -- Subject CN in certificate not server name or identical to CA!?

What does that mean, and does the client certificate need to have the server CN in it?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.