LinuxQuestions.org - How to configure the Client Side authentication on Apache server Using SSLVerifyClie

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - How to configure the Client Side authentication on Apache server Using SSLVerifyClie (https://www.linuxquestions.org/questions/linux-newbie-8/how-to-configure-the-client-side-authentication-on-apache-server-using-sslverifyclie-4175417931/)

How to configure the Client Side authentication on Apache server Using SSLVerifyClie

Hi ,

I have installed the apache server with self signed CA certificate and now i want to authenticate the client with the client certificate installed in the browser of the client. Below is the configuration for the website i have. I tried to generate the client ssl certificate and installed in the browser but is not working and i am getting error (Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error. )

<Location />
SSLVerifyClient require
SSLVerifyDepth 1
</Location>

But when i change require to optional then i start browsing the website . But i want to browse the website with the require option.

Kindly suggest how to solve this problem

Thanks a lootttttttt

Ravinder

Hi
You're right - if with "require" it does not work, then with the "optional" option it probably falls back to not checking your certificate.
How does your full apache configuration look like? I suppose that you added stuff like...

Code:

        SSLEngine on



        ## SSL Cipher Suite:

        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

        SSLCertificateFile /myserv_cert.crt

        SSLCertificateKeyFile /mypriv_key.key

        SSLCertificateChainFile /mycertchain.crt

        SSLOptions StrictRequire

        SSLProtocol all -SSLv2

        SSLOptions +StdEnvVars

                BrowserMatch ".*MSIE.*" \

                        nokeepalive ssl-unclean-shutdown \

                        downgrade-1.0 force-response-1.0

...right?

And which browser are you using on the client side?

And can by increasing the "LogLevel" option to e.g. "info" do you get more informations when you fail to connect?

Cheers