Subject: SSLVerifyClient require

From: "Hector Vass" <[email-masked]>
Date: Mon, 12 Jan 2004 15:54:53 -0000

I am having a problem with client authentication getting client certificates
to work -

Have installed the client certificate in internet explorer, this also
installs the server certificate as a 'trusted root certificate'.
When access basic https area of website all works correctly, when attempt to
go into the area where SSLVerifyClient is required, the certificate is
prompted for. But when chosen get "The page cannot be displayed" error.

The error in the ssl_error_log is: [Fri Jan 09 11:37:48 2004] [error]
Re-negotiation handshake failed: Not accepted by client!?

If certificates are viewed IE says that they are valid etc.

I was after references to good HowTo's or any views on whether this is a IE,
modssl, Apache or just a certificates problem.

Thanks in advance

Our server is
Apache-AdvancedExtranetServer/2.0.47 (Mandrake Linux/6mdk) mod_perl/1.99_09
Perl/v5.8.1 mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.2!

And clients are Internet Explorer IE6 and Opera 7.2

*****
SETUP CERTIFICATES AS FOLLOWS in directory /home/test/CA/:
*****
CERTIFICATION AUTHORITY
Generate New Certification Authority
    perl CA.pl -newca (when prompted I set the CN name to the servers ip
address)

SERVER CERTIFICATE
Generate new certificate request for SERVER (newreq.pem)
    perl CA.pl -newreq (when prompted I set the CN name to the servers ip
address)
Sign it (generates newcert.pem)
    perl CA.pl -sign
Get Key from it
    openssl rsa < newreq.pem > newkey.pem

CLIENT CERTIFICATE
Generate Unencrypted Key for CLIENT
    openssl genrsa -out client_unsecure.key 1024
Generate new certificate request for CLIENT
    openssl req -new -key client_unsecure.key -out client_unsecure.csr (when
prompted I set the CN name to the client ip address)
Sign it
    openssl ca -config /<somepath>/openssl.cnf -policy policy_anything -out
client_unsecure.crt -infiles client_unsecure.csr
Create format for Internet Explorer
    openssl pkcs12 -export -in client_unsecure.crt -inkey
client_unsecure.key -name "Client Cert" -certfile ./demoCA/cacert.pem -out
clientcert.p12

41_MOD_SSL.DEFAULT-VHOST.CONF SETTINGS AS FOLLOWS:
DocumentRoot "/var/www/html/secure"
ErrorLog logs/ssl_error_log
<IfModule mod_log_config.c>
TransferLog logs/ssl_access_log
</IfModule>
#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   SSL Cipher Suite:
#   List the ciphers that the client is permitted to negotiate.
#   See the mod_ssl documentation for a complete list.
SSLProtocol all
SSLCipherSuite HIGH:MEDIUM

#   Server Certificate:
SSLCertificateFile /home/test/CA/newcert.pem

#   Server Private Key:
SSLCertificateKeyFile /home/test/CA/newkey.pem

#   Server Certificate Chain:

#   Certificate Authority (CA):
SSLCACertificateFile /home/test/CA/demoCA/cacert.pem

#   Certificate Revocation Lists (CRL):

#   Client Authentication (Type):
#SSLVerifyClient require
#SSLVerifyDepth  10

<Location /audit>
    SSLVerifyClient require
    SSLVerifyDepth  1
</Location>