Subject: Netscape ask always certificat

From: xavier jeannin <[email-masked]>
Date: Wed, 29 Oct 2003 17:15:13 +0100

Hello

I have looked for information in Archive about my problem. I don't find 
answer to my problem, sorry in advance to ask a question about a very 
known problem.

I have developped Web application, that uses X509 certificat. Netscape 
ask at each time (page) the certificat. As my users have several 
certificates they do not use the option "Select Automaticly" in 
netscape,  I have to say to my user to use now this option and create  a 
netscape's profile for every certificat.

First, I have compile Apache with MM and use :
SSLSessionCache        shm:/usr/local/apache/logs/ssl_gscache(2048000)
SSLSessionCacheTimeout  1800
but  it does not work.

Does anyone got a better idea ?
Thanks in advance
--xj

-- 
_____________________________________________________________________________________________
Xavier Jeannin
UREC/CNRS Université P. & M. Curie, Courrier : case 171, 4 place Jussieu 75252 PARIS CEDEX 05
Tél : 01 44 27 42 59 - Fax : 01 44 27 42 61 - Courriel : [email-masked]

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mads Toftum <[email-masked]>
Date: Wed, 29 Oct 2003 18:07:42 +0100

> SSLSessionCacheTimeout  1800
"but  it does not work" - how should that be understood? that SSLSessionCache
does not work, or that the users are still being asked for the certificate?
The simplest way to test sessions away from the browser is to use openssl
s_client with the -reconnect option - that should tell you wether session
caching is in effect or not. 
Usually when sessions are enabled in apache, but the browser keeps asking for
the cert, then it is a setting in the browser - I seem to recall that 
Netscape had an option to ask for the password on every use.

vh

Mads Toftum
-- 
Speaking at ApacheCon 2003 - http://ApacheCon.com/
T03, "Apache 2 mod_ssl tutorial" (3h)
WE03, "Troubleshooting Apache configurations" 
WE11, "Apache mod_rewrite, the Swiss Army Knife of URL manipulation" 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Matt Stevenson <[email-masked]>
Date: Wed, 29 Oct 2003 10:54:58 -0800 (PST)

Hi,

Try using the status module

ExtendedStatus On
<Location /server-status>
    SetHandler server-status
</Location>

That gives some info about ssl sessions near the
bottom. Currently I'm using client certs and firebird
with ask every time set. This results in a prompt
every  300 seconds as the session times out. Which
version of netscape?  

Regards
Matt

--- xavier jeannin <[email-masked]>
wrote:
> SSLSessionCache       
> shm:/usr/local/apache/logs/ssl_gscache(2048000)
> Xavier Jeannin
> UREC/CNRS Université P. & M. Curie, Courrier : case
> 171, 4 place Jussieu 75252 PARIS CEDEX 05
> User Support Mailing List                     

__________________________________
Do you Yahoo!?
Exclusive Video Premiere - Britney Spears
http://launch.yahoo.com/promos/britneyspears/
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: xavier jeannin <[email-masked]>
Date: Thu, 30 Oct 2003 09:24:04 +0100

Hi

Thanks Mads for your answer :
I should write Netscape still ask the cert at each page  instead of "it 
does not work".
I mad the test you suggest, here is the result

root@engine jeannin]# openssl s_client -host intranet.stic.cnrs.fr -port 
443 -cert /usr/local/apache/conf/ssl.crt/intranet.stic.cns.fr.crt  -key 
/usr/local/apache/conf/ssl.key/intranet.stic.cnrs.fr.key -CAfile 
/usr/local/apache/conf/ssl.crt/ca-bundle.crt -reconect -ssl3
CONNECTED(00000003)
depth=2 /C=FR/O=CNRS/CN=CNRS
verify return:1
depth=1 /C=FR/O=CNRS/CN=CNRS-Standard
verify return:1
depth=0 
/C=FR/O=CNRS/OU=UPS836/CN=intranet.stic.cnrs.fr/Email=[email-masked]
verify return:1
24359:error:14094413:SSL routines:SSL3_READ_BYTES:sslv3 alert 
unsupported certificate:s3_pkt.c:1031:SSL alert number 43
24359:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake 
failure:s3_pkt.c:514:

I am sorry but I do not understand the response. I am sure that my cert 
is valid, my private key too, and my cafile too.
Do you know where I can read documentation that explain the error 
message ? perhaps it is a bad used of openssl client.
thank  you
--xj

---

From: Mads Toftum <[email-masked]>
Date: Thu, 30 Oct 2003 09:44:47 +0100

> message ? perhaps it is a bad used of openssl client.

openssl s_client expects the certificate and key to be in PEM format -

openssl x509 -in cert.crt -inform DER -out cert.pem -outform PEM

vh

Mads Toftum

---

From: xavier jeannin <[email-masked]>
Date: Thu, 30 Oct 2003 11:40:52 +0100

Ok Sorry I correct my mistake so now I  can connect  with SSL Client and 
get my HTML Page.
Thank you it is a powerful tools to debug (redirect, etc)

I send to you the response I get, I am not capable to analyse the SSL 
sequence.
Is it a normal sequence ?
Seeing this can we deduce the session cache work fine ?
In this example, I have only ask for one page, I have not browsed into 
my site so can we deduce anything from this example ?
Is  it possible to browse into a site with ssl_client (see cookie and 
session pb) ?

thank you
--xj
 
CONNECTED(00000003)
---
Certificate chain
 0 
s:/C=FR/O=CNRS/OU=UPS836/CN=intranet.stic.cnrs.fr/Email=[email-masked]
   i:/C=FR/O=CNRS/CN=CNRS-Standard
 1 s:/C=FR/O=CNRS/CN=CNRS-Standard
   i:/C=FR/O=CNRS/CN=CNRS
 2 s:/C=FR/O=CNRS/CN=CNRS
   i:/C=FR/O=CNRS/CN=CNRS
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIEfzCCA2egAwIBAgICAvUwDQYJKoZIhvcNAQEEBQAwNDELMAkGA1UEBhMCRlIx
DTALBgNVBAoTBENOUlMxFjAUBgNVBAMTDUNOUlMtU3RhbmRhcmQwHhcNMDIwNjI0
MDcwODIyWhcNMDQwNjI0MDcwODIyWjB5MQswCQYDVQQGEwJGUjENMAsGA1UEChME
-- zip --
p1vfh+sI/gmyoV5Fpx3cQ1ZhS6PsFxHmhe6bnQSbyOJjVmtvR7qx7iAZuo3+NE8o
bNsDnc7NQrDxOts5mYQugiPpNwW+CS7Yj8uuXFPkF/G4pBPBRooiwoJ6o5X6CZi5
uYKp
-----END CERTIFICATE-----
subject=/C=FR/O=CNRS/OU=UPS836/CN=intranet.stic.cnrs.fr/Email=[email-masked]
issuer=/C=FR/O=CNRS/CN=CNRS-Standard
---
Acceptable client certificate CA names
/C=FR/O=CNRS/CN=SSI
/C=FR/O=CNRS/CN=CNRS
/C=FR/O=CNRS/CN=Datagrid-fr
/C=FR/O=CNRS/CN=CNRS-Projets
/C=FR/O=CNRS/CN=CNRS-Standard
/Email=[email-masked]/CN=CNRS-Test/OU=UREC/O=CNRS/C=FR
/C=FR/O=CNRS/CN=CNRS-Plus
---
SSL handshake has read 3873 bytes and written 3551 bytes
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
Server public key is 1024 bit
SSL-Session:
    Protocol  : TLSv1
    Cipher    : EDH-RSA-DES-CBC3-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: 
279FCDC4C400A75AE70E85755781EAA6F39429D8FC22AE69B6F95D982020F5DFAD6DF5B552DF21FE7DB23CC7FC09EE1A
    Key-Arg   : None
    Start Time: 1067509174
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
drop connection and then reconnect
CONNECTED(00000003)
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
SSL-Session:
    Protocol  : TLSv1
    Cipher    : EDH-RSA-DES-CBC3-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: 
0F8D50DBEAE85A067D6A631609D5728CE9AA91F7052E39115481D6787478124CC43B290C4D164F858FBC2F44103F8C2A
    Key-Arg   : None
    Start Time: 1067509174
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
drop connection and then reconnect
CONNECTED(00000003)
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
SSL-Session:
    Protocol  : TLSv1
    Cipher    : EDH-RSA-DES-CBC3-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: 
C04F385EFFBC7FE29AB3503C3A55F264D5EB42D33F5AD15D988E7E030E3E2D0A61BBF9540CD2CDFEF139A23F23656E42
    Key-Arg   : None
    Start Time: 1067509174
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
drop connection and then reconnect
CONNECTED(00000003)
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
SSL-Session:
    Protocol  : TLSv1
    Cipher    : EDH-RSA-DES-CBC3-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: 
0FBF55C5A75525AC4DE0A508D984DAAFD046C38C251744F4546358747FFD7527BD88A6F5B5B2258DD8D99BD4F04D6227
    Key-Arg   : None
    Start Time: 1067509174
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
drop connection and then reconnect
CONNECTED(00000003)
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
SSL-Session:
    Protocol  : TLSv1
    Cipher    : EDH-RSA-DES-CBC3-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: 
1FA07645E42886ED343D5C7B7BA722675B35E298AC48791D981784FFE2F640914D7BDBE0ADD184DEE104C4BDDC251494
    Key-Arg   : None
    Start Time: 1067509174
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
drop connection and then reconnect
CONNECTED(00000003)
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
SSL-Session:
    Protocol  : TLSv1
    Cipher    : EDH-RSA-DES-CBC3-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: 
72B0D603F01C3416E2B39C650E7359B1123E959F49D54EB4654A9F26CF666089DDB071D305CF267FDB95E6B3210DD9B3
    Key-Arg   : None
    Start Time: 1067509174
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Bienvenue sur l'Intranet du département STIC du 
CNRS</TITLE>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1170" name=GENERATOR>
<link rel="stylesheet" href="../style/main.css" type="text/css">
</HEAD>
<BODY bgColor=#ffffff leftMargin=0 topMargin=0 MARGINHEIGHT="0" 
MARGINWIDTH="0">
My HTML page
</BODY></HTML>closed

---

From: Mads Toftum <[email-masked]>
Date: Thu, 30 Oct 2003 12:44:10 +0100

On Thu, Oct 30, 2003 at 11:40:52AM +0100, xavier jeannin wrote:
[SNIP]

>    Verify return code: 0 (ok)

Session caching seems to be off on the server side - when I use reconnect, I get

    Protocol  : TLSv1
    Cipher    : EDH-RSA-DES-CBC3-SHA
    Session-ID: 1C7284F45FE7153AD082C737E2EBFD2176A4B0B34BCA41AE79663F9C804142EB
    Session-ID-ctx: 
    Master-Key: 6D9E61B97ADE120B056E79A09B3489D23D7D2A74FE2D82E067CBEF50296B76B5E6034ECDB32B4B062788BA9D9832DD3B

vh

Mads Toftum