Subject: client authentication

From: "Edgard Janzen" <[email-masked]>
Date: Wed, 5 Jun 2002 10:53:43 -0300

Hi,

i´m trying to use Client Authentication with certificates... so I´m using
apache_1.3.22
mod_ssl_2.8.5-1.3.22
openssl-0.9.6c

and the apache configurations is like this

<VirtualHost 192.168.254.142:443>
    ServerAdmin [email-masked]
    DocumentRoot /home/www-data/443.psmi.com.br
    ServerName 443.psmi.com.br
    ScriptAlias /cgi-bin/ "/usr/local/apache/cgi-bin/"
    LogLevel warn
    ErrorLog /home/log-data/443.psmi.com.br-error_log
    CustomLog /home/log-data/443.psmi.com.br-access_log common
    CustomLog /home/log-data/443.psmi.com.br-referer_log referer
    CustomLog /home/log-data/443.psmi.com.br-agent_log agent
    ProxyPass / http://172.16.2.159:8080/443/
    ProxyPassReverse / http://172.16.2.159:8080/443/
    ProxyPass /misc_ http://172.16.2.159:8080/misc_
    ProxyPass /p_ http://172.16.2.159:8080/p_
    ProxyVia on
SSLEngine on
SSLCertificateFile /usr/local/apache-ssl/conf/chaves443/public.crt
SSLCertificateKeyFile /usr/local/apache-ssl/conf/chaves443/secureprivate.key
SSLCACertificatePath /usr/local/apache-ssl/conf/chaves443/
SSLCACertificateFile /usr/local/apache-ssl/conf/chaves443/unicert.cer
SSLVerifyClient 2
SSLVerifyDepth  10

<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/usr/local/apache-ssl/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
</VirtualHost>

and after I show my certificate on the broser I get an error window an the log says so:

[Wed Jun  5 09:24:32 2002] [error] mod_ssl: Certificate Verification: Error (20): unable to get local issuer certificate
[Wed Jun  5 09:24:32 2002] [error] mod_ssl: SSL handshake failed (server 443.psmi.com.br:443, client 172.16.2.47) (OpenSSL library error follows)
[Wed Jun  5 09:24:32 2002] [error] OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

could someone help me? any idea?
thaks a lot

---------------------------------------------------------------------------------
Edgard Janzen
Electrical Engineer (Electronic/Telecom.)
PSmi Editora Digital Ltda
---------------------------------------------------------------------------------
E-mail: [email-masked]
Home-page: http://www.psmi.com.br/
Address: Rua Brasilio Itiberê, 2928 - Sobreloja
Rebouças - Curitiba - PR - 80250-160
Phone/Fax:(41) 333-3699
---------------------------------------------------------------------------------