So I have an Apache 2.4 server. It is currently serving pages via SSL, with a Comodo cert, behind an htpasswd login.

There are some computers in house that are accessing this server constantly. I would like to create some SSL client certs and install them on the computers so that the users do not have to login every time. I found this basic howto: http://www.garex.net/apache/ which I've followed with some modifications in order to create the client certificates. I have yet to implement those certs in Apache though.

What I need to know is if I can have both, the SSL cert from Comodo plus the internal CA with its client certs. Will one override or conflict with the other?


No, they do not interfere with each other.

One thing is the SSL certificate the server uses, and another one the list of CA's you need to give to Apache to Certificate verification of client connections.

Simply put:

SSLCertificateKeyFile <-- SERVER rsa key
SSLCertificateFile <-- SERVER certificate with its ca's sorted from leaf to root
SSLCACertificateFile <- File with a list of CA's the server will check when verifying client connection to see if the certificates they present is signed with any of them in order to let them access.

then all you need to add is:

SSLVerifyClient require

You can find relevant info at:
http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslverifyclient http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcacertificatefile

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.