Subject: SSLVerifyClient statements causing problems?

From: "Ron Gedye" <[email-masked]>
Date: Wed, 11 Sep 2002 14:46:56 -0500

Hello List....

I searched the archives and saw a few mentions of the error that I am
seeing, but no solid solutions so here goes...

In attempting to use client certificates to provide/restrict access to
certain portions of my website I am encountering problems.

Apache 1.3.26, mod_ssl 2.8.10, OpenSSL 0.9.7-b2

I believe my syntax is correct as no errors are reported when starting
apache.
However, the server dies hard (leaving pid file) with the error in both
errorlog & ssl_engine_errorlog of:
"Unable to configure verify locations for client authentication"

This is the only error.

Example of syntax:

<Directory "/pub">
SSLVerifyClient     none
</Directory>

<Directory "/private">
SSLVerifyClient    require
SSLVerifyDepth    1
SSLOptions          +FakeBasicAuth
SSLRequire    (  %{SSL_CLIENT_S_DN_O} eq "MyOrg"
</Directory>

I have my SSLCACertificatePath & File set as well as the SSLCARevocation...
(Self signed CA via OpenCA 0.9.1 RC4)

Stumped on this one, (Not hard for a newby) everything was fine before
attempting the access restrictions.

Pointers Please.....

Thanks in advance

Ron

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Roberto Hoyle <[email-masked]>
Date: Wed, 11 Sep 2002 15:50:58 -0400

Ron Gedye wrote:
[snip]

> attempting the access restrictions.

Just a guess, but doesn't the SSLRequire statement require a close-paren?

r.

---

From: "Ron Gedye" <[email-masked]>
Date: Wed, 11 Sep 2002 15:15:11 -0500

Typo in my email, ( modified from actual syntax) should read:
SSLRequire    (  %{SSL_CLIENT_S_DN_O} eq "MyOrg" )