Subject: Troubleshooting another ssl handshake failed problem

From: "Mary Peterson" <[email-masked]>
Date: Tue, 06 Aug 2002 15:51:53 -0500

Does anyone know what would cause the following error???

[Fri Aug 02 11:56:45 2002] [error] mod_ssl: SSL handshake failed
(server www.xxxxxxx.org:443, client xxx.xxx.xxx.xxx) (OpenSSL library
error follows)
[Fri Aug 02 11:56:45 2002] [error] OpenSSL: error:2706820C::lib(39)
:func(104) :reason(524)
[Fri Aug 02 11:56:45 2002] [error] OpenSSL: error:1408807A:SSL
routines:SSL3_GET_CERT_VERIFY:bad rsa signature
[Fri Aug 02 11:56:48 2002] [error] mod_ssl: SSL handshake failed
(server www.xxxxxxx.org:443, client xxx.xxx.xxx.xxx) (OpenSSL library
error follows)
[Fri Aug 02 11:56:48 2002] [error] OpenSSL: error:140890C7:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
[Hint: No CAs known to server for verification?]
[Fri Aug 02 11:57:31 2002] [error] mod_ssl: SSL handshake failed
(server www.xxxxxxx.org:443, client xxx.xxx.xxx.xxx) (OpenSSL library
error follows)
[Fri Aug 02 11:57:31 2002] [error] OpenSSL: error:0D0A2007:asn1
encoding routines:d2i_X509_CINF:expecting an asn1 sequence
[Fri Aug 02 11:57:31 2002] [error] OpenSSL: error:0D09F004:asn1
encoding routines:d2i_X509:nested asn1 error
[Fri Aug 02 11:57:31 2002] [error] OpenSSL: error:1408900D:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:ASN1 lib
[Fri Aug 02 11:57:32 2002] [error] mod_ssl: SSL handshake failed
(server www.xxxxxxx.org:443, client xxx.xxx.xxx.xxx) (OpenSSL library
error follows)
[Fri Aug 02 11:57:32 2002] [error] OpenSSL: error:140890C7:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
[Hint: No CAs known to server for verification?]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: David Marshall <[email-masked]>
Date: Tue, 6 Aug 2002 14:02:57 -0700

It looks like you need to update the CA authority certificates. If your
certificate came from verisign, their website gives directions on how to do
this (www.verisign.com)

David Marshall