Subject: RePost: Error 403 with Client Authentication - modssl 2.8.8

From: Rabellino Sergio <[email-masked]>
Date: Tue, 09 Apr 2002 11:47:59 +0200

Sorry for my repost,
 but we continue to get an error if requesting an automatic listing from a directory under Client Authentication with FakeBasicAuth enabled.
We are using successfully an old release (Apache 1.3.14 / ModSSL 2.7.1 / OpenSSL 0.9.6), now we would to upgrade our apache engine for the
bugfixes, but even with the 1.2.23/2.8.7 or the 1.3.24/2.8.8 releases, we got errors "Access Forbidden", with the old config files.
Note that we have these errors persistently and ONLY IF client Authentication is done with a certificate; if we pass a login/password, we
get the Directory Listing or DirectoryIndex as usual.

So we believe that there is some tricks about mod_ssl unknown to us... or is a bug ?

Thanks.
-- 
Dott. Sergio Rabellino 

 Technical Staff
 Department of Computer Science
 University of Torino (Italy)
 Member of the Internet Society

http://www.di.unito.it/~rabser
Tel. +39-0116706701
Fax. +39-011751603
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Nick Miles <[email-masked]>
Date: Tue, 9 Apr 2002 15:42:42 +0100

My guess is a bug...I had the same problem for some time, eventually I found a 
solution in the archives, I believe it was this one:
http://marc.theaimsgroup.com/?l=apache-modssl&m=98995735231070&w=2

So comment out that section of code then recompile and all will be ok.  
Downside to this will be that the checking for the DN as username to normal 
basic auth will be allowed through.  But Im not sure that worked with it anyhow.

Nick

Quoting Rabellino Sergio <[email-masked]>:

> Sorry for my repost,
>  but we continue to get an error if requesting an automatic listing from a
> directory under Client Authentication with FakeBasicAuth enabled.
> We are using successfully an old release (Apache 1.3.14 / ModSSL 2.7.1 /
> OpenSSL 0.9.6), now we would to upgrade our apache engine for the
> bugfixes, but even with the 1.2.23/2.8.7 or the 1.3.24/2.8.8 releases, we got
> errors "Access Forbidden", with the old config files.
> Note that we have these errors persistently and ONLY IF client Authentication
> is done with a certificate; if we pass a login/password, we