Subject: RE: Apache 2.0.35 - ssl fails silently?

From: "Jose Correia (J)" <[email-masked]>
Date: Tue, 3 Sep 2002 09:21:25 +0200

Have you tried looking in ssl_engine.log?

-----Original Message-----
From: Paul English [mailto:[email-masked]]
Sent: 02 September 2002 22:55
To: [email-masked]
Subject: Re: Apache 2.0.35 - ssl fails silently?

> On Mon, 2 Sep 2002, Paul English wrote:
> 
> > 	I'm working with a new setup of 2.0.35 under Linux, and having
> 
> First of all, why 2.0.35 on a new setup?  2.0.36 was the first full
> release (back in April).  2.0.40 is the current release.

Oops, I guess I should have said "relatively new." It has been up and 
running without any SSL for a few months.

I'm downloading 2.0.40 now, although I think the problem is most
likely 
configuration somehow.

Paul

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Paul English <[email-masked]>
Date: Tue, 3 Sep 2002 09:36:21 -0700 (PDT)

> Have you tried looking in ssl_engine.log?

That one wasn't being generated. Now I'm not sure what the problem was, 
but upgrading to 2.0.40 fixed it. Now that I've seen the build again, it 
is possible that mod_ssl failed to build, and I missed it as the messages 
scrolled past. I made sure that it did build for 2.0.40.

Thanks everyone,
Paul

---

From: GOSS <[email-masked]>
Date: Tue, 3 Sep 2002 12:40:14 -0700 (PDT)

Hello,

I am setting up an Apache 1.3.26 reverse proxy on
Linux to a remote IIS v5.0 server with a client
certificate but it doesn't work. I kept getting 403
forbidden error because IIS v5.0 does not send a list
of acceptable CAs to the Apache reverse proxy so
Apache doesn't send the client certificate to IIS.

In my httpd.conf file,

SSLProxyMachineCertificateFile points_to_client_cert
SSLProxyCAMachineCertificateFile
points_to_CA_of_IIS_server_cert
ProxyPass /test/ https://www.testiis.server/
ProxyPassReverse /test/ https://www.testiis.server/

There is nothing wrong with my Apache reverse proxy
setup because it works fine when I set it to another
remote Apache web server with client certificate
(SSLVerify required). I used "openssl s_client
-connect ..." to test the IIS server and found that it
wasn't sending a list of acceptable CAs to the client.

I have configured IIS with One-to-One Mapping as per
instructions on this webpage:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/ad/windows2000/howto/mapcerts.asp

I just want to make sure that it is a IIS problem for
not sending the list of acceptable CAs. Has anyone
here got this type of set up to work before?

Thanks!
GOSS

__________________________________________________
Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes
http://finance.yahoo.com
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]