Using Apache 2.4.
We have two valid CA certificates whose distinguished names differ only by the case of one character (say CA1 with dn: cn=MyCA,O=myOrg and CA2 with dn: cn=MyCA,O=MyOrg).
These two certificates are both in the file referred by the SSLCACertificateFile Apache directive, as we need to authenticate client certificates signed by both CAs. This does not happen: only browsers with client certificates signed by CA1 or CA2 are able to access, depending on the order of the CA certificates in the file. So, if only clients from CA1 are able to authenticate themselves, after switching the order in SSLCACertificateFile and reloading Apache, only clients from CA2 are able to authenticate.
If we perform a SSL handshake by
openssl s_client -connect <server>:<port> -prexit, we notice that only one of the CA distinguished names is sent in the list of accepted CAs, and the dn that is sent depends on the order in which the CAs certificate are in the SSLCACertificateFile. This makes sense as the Openssl computed hash for the two distinguished names is the same, as distinguished names should not be case sensitive.
But it seems that the browser performs a case-sensitive match, instead, as in the Apache logs the certificate installed in the browser is not sent when the "advertised CA" is CA1 and the client certificate is signed by CA2, and vice-versa. We tried with Firefox on Windows and Linux, and Internet Explorer and Chrome on Windows.
Otherwise, the curl command line browser has not this problem, when we invoke the https URL with the client certificate and key in PEM format.