0

I inherited a system that is running Apache 2.4 that requires users to present client certificates. For some users, their client certificate is not being passed, and are thus denied access.

ssl.conf is as follows:

Listen 443 https
SSLPassPhraseDialog exec:/usr/<pasphraseexecfile>
SSLSessionCache     shmbc:/run/<pathtocache>
SSLSessionCacheTimeout 300
SSLCryptoDevice     builtin
SSLCryptoDevice     rdrand
SSLCryptoDevice     dynamic
SSLStaplingCache    shmbc:/var/run/<pathtocache>

<VirtualHost _default_:443>
  DocumentRoot "/var/www/html/myproject"
  ServerName "www.myproject.com:443"
  SSLEngine    on
  ErrorLog     /logs/ssl_error_log
  TransfrerLog /logs/ssl_access_log
  LogLevel warn
  SSLProtocol    -SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
  SSLUseStapling on
  SSLStaplingResponderTimeout 5
  SSLStaplingReturnResponderErrors off
  SSLCompression off
  Header add Strict-Transport-Security "max-age=15768000"
  SSLCertificateFile      <pathtocert>
  SSLCertificateKeyFile   <pathtokey>
  SSLCertificateChainFile <pathtochainfile>
  SSLCACertificateFile    <pathtocacertfile>
  SSLVerifyClient optional
  SSLVerifyDepth 2
  <Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
  </Files>
  <Directory "/var/www/html/myproject">
    SSLOptions +StdEnvVars +ExportCertData
  </Directory>
  CustomLog logs/ssl_request_log \
          "%t %h %a \"%{SSL_CLIENT_S_DN_CN}x\" %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %s %b"
</VirtualHost>

There also is a whitelist.conf for a limited set of users

<Directory /var/www/html/myproject>
  <RequireAny>
    Require ssl-verrify-client
    <RequireAny>
      ... internal list ..
    </RequireAny>
  </RequireAny>
</Directory>

Most of the users that are denied access are running Windows 10, using various browsers (IE, Firefox, and Chrome). Many are also running ActiveClient. What could be preventing these users from presenting their certs?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.