Subject: Problems with Thawte freemail certificate and Apache

From: Dave Kelly <[email-masked]>
Date: Mon, 19 Aug 2002 13:01:26 +0100

Hello,

I would appreciate any help on this please.

I am using Apache 1.3.23 on RedHat 7.3 with mod_ssl 2.8.7 and openssl 
0.9.6b-28.
This web server provides access to our internal Bugzilla database.

I have set up a CA on my server using /usr/share/ssl/misc/CA.pl and I 
issue browser certificates from it.

I have copied the CA certificate and appended it to 
/etc/httpd/conf/ssl.crt/ca-bundle.crt.

I have the following configuration in httpd.conf:

<Directory /var/www/html/bugzilla>
        Options ExecCGI FollowSymLinks
        SSLVerifyClient require
        SSLVerifyDepth  1
        SSLRequireSSL
        SSLRequire %{SSL_CLIENT_S_DN_OU} in {"Support", "Bugzilla"}
</Directory>

I have also uncommented:

SSLCACertificatePath /etc/httpd/conf/ssl.crt
SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt

in httpd.conf.

I generated an Apache server certificate using

make testcert

in /etc/httpd/conf so that the correct machine name was in the CN attribute.

This is all working fine. However, my colleague and I both have Thawte 
freemail certificates installed and that's when we get a problem.

Using Mozilla with the configuration set to prompt for a certificate, 
both the browser certificate and the Thawte certificate are displayed 
with the Thawte certificate being listed first. If the configuration is 
set to automatically select a certificate, the Thawte certificate is 
chosen.
The behaviour is similar using IE.

The symptoms we see in Bugzilla is that we seem to be circulating 
through the same of 3-4 pages (depending upon what we choose).

The ssl_engine_log file shows:

[19/Aug/2002 12:35:23 01206] [error] Re-negotiation handshake failed: 
Not accepted by client!?
[19/Aug/2002 12:35:23 01206] [error] SSL error on writing data (OpenSSL 
library error follows)
[19/Aug/2002 12:35:23 01206] [error] OpenSSL: 
error:1409E0E5:lib(20):func(158):reason(229)

When we remove the Thawte certificate, everything works.

The Thawte certificate has no O or OU specified so why do the browsers 
find a match with it ?

Cheers

Dave.

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]