Subject: RE: Apache 2 and client authenticaction

From: "Nauman, Ahmed [IT]" <[email-masked]>
Date: Wed, 14 May 2003 08:38:12 -0400

Hi all,

I had earlier mailed my problem also related to client authentication. That i have set apache with mod ssl for mutual authentication, but client certificate does not seem to be transferred for authentication. But surprizingly this is happening when i mention CA of client in httpd.conf for Server as 
"SSLCACertificateFile" directive. If i don't mention this directive, it displays a message on browser side that certificate is not from some of the trusted CA. If we see the log, [Please see list archive for my previous message] either the Server is not loading the certificate of client's CA properly or client Certificate does not seem to be returned when server asks for it.

Please advise.

Regards
Nauman

-----Original Message-----
From: Estrade Matthieu [mailto:[email-masked]]
Sent: Wednesday, May 14, 2003 8:24 AM
To: [email-masked]
Subject: Re: Apache 2 and client authenticaction

Hi,

I have exactly the same problem. On each new document (not in temp file 
of IE), my browser ask me to choose which client certificate i want to 
use for the secured web site.
Even if i have only one.
First, i was thinking it was because of the browser, so i looked into IE 
configuration, but i found nothing.
Then i look with apache in debug mode and i saw that the client seems to 
no send again the certificate.

Maybe it's a problem of session handling. i played with SessionCache 
parameters and SessionCacheTimeout, but nothing more happened.
I will try to find more debug information.

Regards,

Estrade Matthieu

Juan Angel Martin wrote:

> Hi all,
>
> I have one Linux server with Apache 1.3.27 and it's configured for 
> client authentication in one port.
>
> When I connect with it at that port with IE 6.0.or Netscape 7.0 or 
> 4.78, the server asks me the container's password that keeps the 
> private key needed for authenticate me only one time.
>
> But I have another with Apache 2.0.45, configured as the other one 
> with 1.3.27; it has the same SSL virtual hosts configuration options.
>
> With this server, the server asks me the container's password that 
> keeps the private key needed for authenticate me for every frame o 
> picture that the page shows.
>
> How can I get that the server with Apache 2.0.45 only asks me for the 
> password one time like the other one with Apache 1.3.27?
>
> Thanks in advance
> Juanan
>
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
> _____________________________________________________________________
> Envie de discuter en "live" avec vos amis ? Télécharger MSN Messenger
> http://www.ifrance.com/_reloc/m la 1ère messagerie instantanée de France
>

_____________________________________________________________________
Envie de discuter en "live" avec vos amis ? Télécharger MSN Messenger
http://www.ifrance.com/_reloc/m la 1ère messagerie instantanée de France

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Juan Angel Martin <[email-masked]>
Date: Wed, 14 May 2003 18:34:00 +0200

Hi,

This the part of log obtained when I request one html page with two 
frames. The browser asks me for the password 4 times.

[info] Connection to child 1 established (xxx.xxx.xxx:4443, client 
xxx.xxx.xxx.xxx)
[info] Seeding PRNG with 512 bytes of entropy
[debug] ssl_engine_kernel.c(1757): OpenSSL: Handshake: start

[debug] ssl_engine_kernel.c(1761): OpenSSL: Handshake: done
[info] Connection: Client IP: xxx.xxx.xxx.xxx, Protocol: SSLv3, Cipher: 
RC4-MD5 (128/128 bits)
[info] Initial (No.1) HTTPS request received for child 1 (xxx.xxx.xxx:4443)
[info] Connection to child 1 closed with unclean 
shutdown(xxx.xxx.xxx:4443, client xxx.xxx.xxx.xxx)
[info] Connection to child 6 established (xxx.xxx.xxx:4443, client 
xxx.xxx.xxx.xxx)
[info] Seeding PRNG with 512 bytes of entropy
[debug] ssl_engine_kernel.c(1757): OpenSSL: Handshake: start

[debug] ssl_engine_kernel.c(1761): OpenSSL: Handshake: done
[info] Connection: Client IP: xxx.xxx.xxx.xxx, Protocol: SSLv3, Cipher: 
RC4-MD5 (128/128 bits)
[info] Initial (No.1) HTTPS request received for child 6 (xxx.xxx.xxx:4443)
[info] Connection to child 6 closed with unclean 
shutdown(xxx.xxx.xxx:4443, client xxx.xxx.xxx.xxx)
[info] Connection to child 5 established (xxx.xxx.xxx:4443, client 
xxx.xxx.xxx.xxx)
[info] Seeding PRNG with 512 bytes of entropy
[debug] ssl_engine_kernel.c(1757): OpenSSL: Handshake: start
[info] Connection to child 3 established (xxx.xxx.xxx:4443, client 
xxx.xxx.xxx.xxx)
[info] Seeding PRNG with 512 bytes of entropy
[debug] ssl_engine_kernel.c(1757): OpenSSL: Handshake: start

[debug] ssl_engine_kernel.c(1761): OpenSSL: Handshake: done
[info] Connection: Client IP: xxx.xxx.xxx.xxx, Protocol: SSLv3, Cipher: 
RC4-MD5 (128/128 bits)

[debug] ssl_engine_kernel.c(1761): OpenSSL: Handshake: done
[info] Connection: Client IP: xxx.xxx.xxx.xxx, Protocol: SSLv3, Cipher: 
RC4-MD5 (128/128 bits)

[info] Initial (No.1) HTTPS request received for child 5 (xxx.xxx.xxx:4443)
[info] Initial (No.1) HTTPS request received for child 3 (xxx.xxx.xxx:4443)
[info] Connection to child 5 closed with unclean 
shutdown(xxx.xxx.xxx:4443, client xxx.xxx.xxx.xxx)
[info] Connection to child 3 closed with unclean 
shutdown(xxx.xxx.xxx:4443, client xxx.xxx.xxx.xxx)

You can see that there is 4 connections. But every connection is closed 
with unclean shutdown, I don't know why.

Regards
Juanan

---

From: "Matthieu Estrade" <[email-masked]>
Date: Wed, 14 May 2003 21:06:05 +0200

Hi,
 
I have exactly the same logs as yours.
But i think when you say it asks the password, it’s the passphrase of
the private key of client certificate.
When i do my test, i use IE and it’s show me many times the client
certificate list to make me choose one.
 
I am continuing to search...
 
Regards,
 
Estrade Matthieu
 
-----Message d'origine-----
De : [email-masked]
[mailto:[email-masked]] De la part de Juan Angel Martin
Envoyé : mercredi 14 mai 2003 18:34
À : [email-masked]
Objet : Re: Apache 2 and client authenticaction
 
Hi,

[info] Initial (No.1) HTTPS request received for child 1
(xxx.xxx.xxx:4443)

[info] Initial (No.1) HTTPS request received for child 6
(xxx.xxx.xxx:4443)

[info] Initial (No.1) HTTPS request received for child 5
(xxx.xxx.xxx:4443)
[info] Initial (No.1) HTTPS request received for child 3
(xxx.xxx.xxx:4443)
[info] Connection to child 5 closed with unclean
shutdown(xxx.xxx.xxx:4443, client xxx.xxx.xxx.xxx)
[info] Connection to child 3 closed with unclean
shutdown(xxx.xxx.xxx:4443, client xxx.xxx.xxx.xxx)

Regards
Juanan

Hi all,
 
I had earlier mailed my problem also related to client authentication.
That i have set apache with mod ssl for mutual authentication, but
client certificate does not seem to be transferred for authentication.
But surprizingly this is happening when i mention CA of client in
httpd.conf for Server as 
"SSLCACertificateFile" directive. If i don't mention this directive, it
displays a message on browser side that certificate is not from some of
the trusted CA. If we see the log, [Please see list archive for my
previous message] either the Server is not loading the certificate of
client's CA properly or client Certificate does not seem to be returned
when server asks for it.
 
Please advise.
 
Regards
Nauman
 
-----Original Message-----
From: Estrade Matthieu [mailto:[email-masked]]
Sent: Wednesday, May 14, 2003 8:24 AM
To: [email-masked]
Subject: Re: Apache 2 and client authenticaction

Hi,

 
 
Regards,
 
Estrade Matthieu
 
Juan Angel Martin wrote:

Hi all,

 

 
Thanks in advance
Juanan