0

I should enable ssl.verifyclient.* option for a single endpoint of the website, to proceed with certificate login or validation. But it is not working.

The configuration:

$HTTP["host"] =~ "^(.*\.|)example.com$"{    

    $SERVER["socket"] == ":443" {
        protocol     = "https://" 
        ssl.engine   = "enable" 
        ssl.disable-client-renegotiation = "disable" 

        #server.name = "example.com" 
        ssl.pemfile               = "/etc/lighttpd/ssl/example.com.pem" 
        ssl.ca-file               = "/etc/lighttpd/ssl/bundle-ca.pem" 

        ssl.honor-cipher-order = "enable" 
        #ssl.cipher-list = "ECDHE-RSA-AES256-GCM-SHA384" 
        #ssl.use-compression = "disable" 
        setenv.add-response-header = (
            "Strict-Transport-Security" => "max-age=63072000; includeSubDomains; preload",
            "X-Frame-Options" => "DENY",
            "X-Content-Type-Options" => "nosniff" 
        )
        ssl.use-sslv2 = "enable" 
        ssl.use-sslv3 = "enable" 
        ssl.read-ahead = "enable" 
        #ssl.disable-client-renegotiation = "disable" 

        # It Works
        $HTTP["host"] == "ssl.example.com"{
            server.name = "ssl.example.com" 
            #ask for client cert
            ssl.verifyclient.activate   = "enable" 
            ssl.verifyclient.enforce    = "enable" 

            ssl.verifyclient.exportcert = "enable" 
            #ssl.verifyclient.username   = "SSL_CLIENT_S_DN_CN" 
            ssl.verifyclient.depth      = 3
        }

        # It not Works
        $HTTP["url"] =~ "/backend/server/auth/ssl"  {
            #ask for client cert
            ssl.verifyclient.activate   = "enable" 
            ssl.verifyclient.enforce    = "disable" 

            ssl.verifyclient.exportcert = "enable" 
            #ssl.verifyclient.username   = "SSL_CLIENT_S_DN_CN" 
            ssl.verifyclient.depth      = 10
        }
    }
}

Is it a bug or a mismatch configuration?

1

It cannot work. SSL is negotiated before any HTTP requests are sent to the server.

When negotiating the SSL connection, client sends the virtual host name using the SNI feature in SSL. Client verification happens also during SSL connection negotiation.

Only after the SSL session has been established, the client will send "GET /path/to/resource" request to the web server.

You need to apply client verification for the whole domain.

  • It's really make sense. But the URI doesn't exist at connection time? – LeonanCarvalho Apr 7 '17 at 14:02
  • 1
    It exists in the client's memory, but it is not sent to the server until SSL negotiation has finished. – Tero Kilkanen Apr 7 '17 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.