I'm trying to setup Certificate based Client Authentication.

To do this, I created a CA root certificate (called pi.key and pi.crt) and then signed a client certificate (called Hairy.key and Hairy.csr) and also created a Hairy.crt and Hairy.p12 file. I followed these instructions.

I've added the Hairy.p12 file to Google Chrome following these instructions.

Next I added the following to my httpd.conf (at /etc/apache2/apache2.conf):

SSLVerifyClient none
SSLCACertificateFile /etc/apache2/ssl-keys/pi.crt

<Location /InternalAccess/NetData>
    SSLVerifyClient require
    SSLVerifyDepth 1

and restarted the server with service apache2 restart.

According to the Apache website (the second heading), this should allow anyone to access most of the website, but only me (whoever has the Hairy.p12 certificate installed) to access /InternalAccess/NetData/.

To test it, I opened it in Firefox and was able to access the page. I was expecting to get a 401 not authorised error.

I then tried to use this page but it's quite old (Apache 1, talking about Netscape!) and didn't clarify anything I did wrong.

So how can I limit the path /InternalAccess/NetData/ to clients with a certificate which I've signed?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.