I'm trying to setup Certificate based Client Authentication.
To do this, I created a CA root certificate (called
pi.crt) and then signed a client certificate (called
Hairy.csr) and also created a
Hairy.p12 file. I followed these instructions.
I've added the
Hairy.p12 file to Google Chrome following these instructions.
Next I added the following to my
SSLVerifyClient none SSLCACertificateFile /etc/apache2/ssl-keys/pi.crt <Location /InternalAccess/NetData> SSLVerifyClient require SSLVerifyDepth 1 </Location>
and restarted the server with
service apache2 restart.
According to the Apache website (the second heading), this should allow anyone to access most of the website, but only me (whoever has the
Hairy.p12 certificate installed) to access
To test it, I opened it in Firefox and was able to access the page. I was expecting to get a 401 not authorised error.
I then tried to use this page but it's quite old (Apache 1, talking about Netscape!) and didn't clarify anything I did wrong.
So how can I limit the path
/InternalAccess/NetData/ to clients with a certificate which I've signed?