Subject: Client authentication fails - why (oh why) ?

From: Renne Tergujeff <[email-masked]>
Date: Tue, 18 Jun 2002 19:15:28 +0300

Hello all,
After studying various guides and mail archives for days and days, with no 
luck, I'm now turning to you.
I would really appreciate some advice -- any advice. Thanks in advance!

Case & situation:

I need to arrange SOAP connection with both client and server side 
authentication. Currently using Tomcat 4.0.3, Apache 1.3.22, OpenSSL 0.9.6c 
and mod_ssl 2.8.8. Plus Apache SOAP 2.3. And it's working, as long as I 
only require server authentication. The server certificate is certified by 
a CA, which is created by myself. The CA certificate is in the client's 
keystore and thus the server certificate offered by the server is 
recognized. Nice and fine.

Problem:

A client certificate has been certified by the same aforementioned, 
self-made CA. This certificate is in the client keystore. Apache/modssl 
correctly sends the CA certificate to the client in the SSL 
CertificateRequest phase. AFAIK, this should result in the client 
certificate being accepted. The problem of course is, it never does that.

Some data:

* The client is Win NT 4, the server is Redhat Linux.

* The error message in ssl_engine_log is: OpenSSL: error:140890C7:SSL 
routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 
[Hint: No CAs known to server for verification?]

* httpd.conf includes:
	SSLCertificateFile [the_correct_path_to]/server.crt
	SSLCertificateKeyFile [the_correct_path_to]/server.key
	SSLCACertificateFile [the_correct_path_to]/cacert.pem
	SSLVerifyClient require
	SSLVerifyDepth  1

* Because the client authentication fails, server closes the connection, 
which at the client side results in: Exception while waiting for close 
java.net.SocketException: Cannot send after socket shutdown: JVM_recv in 
socket input stream read

* Some pondering follows... As far as I understand, having the client 
certificate in the server keystore is not necessary, as Apache/modssl sends 
the CA certificate pointed to in SSLCACertificateFile directive. Am I right 
in that? At least doing so didn't improve the situation. In fact, I don't 
think Apache looks into the keystore at all... how about that, am I right 
there? :-) And how about this: does it matter where I create the client 
certificate, on the server or on the client -- as long as I fill in the 
same data? And finally: besides the obvious(?) PEM/DER format differences, 
does it matter if I use openssl or keytool for certificate creation etc.?

Now I'd cross my fingers if I did that -- hoping for some replies.
Thank you and have a nice day,

Renne Tergujeff
VTT Information Technology
Espoo, Finland

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]