Subject: SSL reverse proxy + Client Cert auth

From: Danny Kruitbosch <[email-masked]>
Date: Fri, 16 Aug 2002 10:38:27 +0200

Hi,

We want to build the following situation:

- Apache with mod_ssl as a reverse SSL proxy (Client  --->  SSL/HTTPS 
---> Rev. proxy ---> HTTP ---> Web/App server)
- We need to check for client certificates. These certs are handed out 
by another party (not a real TTP). We need to check the signature on the 
client certs and the validity of the client certs.

What's the best way to do this. I've read the mod_ssl manual, but I 
don't understand how I can check client certs from another (third) party.

How do I setup Apache as an SSL reverse proxy?

Any help on this would be great!

Cheers,

Danny Kruitbosch

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Thomas Gagné <[email-masked]>
Date: Fri, 16 Aug 2002 08:49:39 -0400

I'm not sure about checking another authority, but suspect the configs 
would be in conf/ssl.conf.  For doing the reverse proxying, I edited 
proxy.conf and included it inside ssl.conf.  Inside proxy.conf, 
statements like:

    ProxyPass /cgi/ http://10.0.10.1/cgi/
    ProxyPassReverse /cgi/ http://10.0.10.1/cgi/

are what accomplishes the reverse proxying.  In our case, https: comes 
into the proxy and we talk (behind the DMZ) http to the web servers.

Danny Kruitbosch wrote:

> by another party (not a real TTP). We need to check the signature on 
> the client certs and the validity of the client certs.
>
>

-- 
.tom

-- 
.tom
http://isectd.sourceforge.net

---

From: Anbuchezhian Chelliah <[email-masked]>
Date: Sun, 18 Aug 2002 23:40:13 -0700 (PDT)

Hi Danny,
   I guess I understood your doubt. If not, please
ignore this. There should be 'ca-bundle.crt' file in
which you can put the third party's certificate and
you could make a try.

Rgds,
Anbu

> User Support Mailing List                     

__________________________________________________
Do You Yahoo!?
HotJobs - Search Thousands of New Jobs
http://www.hotjobs.com
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Jason Haar <[email-masked]>
Date: Tue, 20 Aug 2002 16:03:35 +1200

> which you can put the third party's certificate and

Whoa! If you are running your own CA and only want your https server to
accept certs signed by that CA, then YOU MUST NOT USE THE ca-bundle.crt
FILE!!!

Replace it with your own cacert instead. Otherwise you are actually telling
your https server that *any* cert signed by *any* CA is valid - which may
not be what you want...

This is especially pertinent given the huge SSL hole found in IE/Konqueror
recently...

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]