Subject: mutual authentication problem

From: "Nauman, Ahmed [IT]" <[email-masked]>
Date: Thu, 15 May 2003 16:05:13 -0400

Hi all,

I am sorry if you get this message twice. I am facing a strange problem with
implementation of client authentication. Please advise me.

i m trying to establish mutual authentication on apache web server. I did
this in httpd.conf file
SSLVerifyClient require

then when i accessed the server from browser - it asked me for client
certificate - i select one from the list - it displayed the message that it
is going to access a protected item i preseed OK - then it displayed error
message that certificate is not issued from trusted CA.

I added this directive

SSLCACertificateFile "path to CA file" // I got this from
freecerts.entrust.com

Now i save it, restart the server. And when i try to access it from browser
- it follows the same path but after pressing OK [see above] it does not
display error or actual page. It says the page can not be displayed. I have
seen server log - which shows the GET_CLIENT_CERTIFICATE: no certificate
returned

Why i am having this problem ? i m sepcifying client certificate. It happens
only when i specify SSLCACertificateFile directive. Please advise.
Here is log at server side

[12/May/2003 15:34:29 29091] [info]  Connection to child 0 established
(server cddfs1.nj.ssmb.com:8443, client 168.109.64.190)
[12/May/2003 15:34:29 29091] [info]  Seeding PRNG with 1160 bytes of entropy
[12/May/2003 15:34:29 29091] [error] Certificate Verification: Error (20):
unable to get local issuer certificate
[12/May/2003 15:34:29 29091] [error] SSL handshake failed (server
cddfs1.nj.ssmb.com:8443, client 168.109.64.190) (OpenSSL library error
follows)
[12/May/2003 15:34:29 29091] [error] OpenSSL: error:140890B2:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
[12/May/2003 15:34:33 29091] [info]  Connection to child 0 established
(server cddfs1.nj.ssmb.com:8443, client 168.109.64.190)
[12/May/2003 15:34:33 29091] [info]  Seeding PRNG with 1160 bytes of entropy
[12/May/2003 15:34:33 29091] [error] Certificate Verification: Error (20):
unable to get local issuer certificate
[12/May/2003 15:34:33 29091] [error] SSL handshake failed (server
cddfs1.nj.ssmb.com:8443, client 168.109.64.190) (OpenSSL library error
follows)
[12/May/2003 15:34:33 29091] [error] OpenSSL: error:140890B2:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

Regards,
Nauman

-----Original Message-----
From: Geoff Thorpe [mailto:[email-masked]]
Sent: Thursday, May 15, 2003 3:57 PM
To: Apache Users
Cc: ModSSL Users
Subject: [ANNOUNCE] distcache 0.4.1

Hi all,

Distcache version 0.4.1 has been released, and with it a patch/README for 
Apache 2.0.45. The existing support for Apache 1.3 (mod_ssl version 
2.8.14) remains.

If you want shared SSL/TLS session caching between servers, please give it 
a try;

   http://www.distcache.org/

Regards,
Geoff

-- 
Geoff Thorpe
[email-masked]
http://www.geoffthorpe.net/

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Juan Angel Martin <[email-masked]>
Date: Fri, 16 May 2003 09:41:43 +0200

Hi Ahmed,

Are you sure that you have the CA certificate that have issued the cert 
that you use to autheticate in your server in SSLCACertificateFile?

Cause the main error is:

[12/May/2003 15:34:29 29091] [error] Certificate Verification: Error (20):unable to get local issuer certificate

All the best
Juanan