Antwort: [users@httpd] tls_process_client_certificate:certificate verify failed - when using a PSS Signed intermediat

["Frank Wuttig" <frank.wuttig@xxxxxxxxxxx>]

Testet again with clean Ubuntu 18.04.1
LTS and default Ubuntu repositorys

Apache 2.4.29-1ubuntu4.3
Openssl 1.1.0g-2ubuntu4.1

Same issue.



Von:      
 "Frank Wuttig"
<frank.wuttig@xxxxxxxxxxx>
An:      
 users@xxxxxxxxxxxxxxxx
Datum:      
 25.09.2018 08:25
Betreff:    
   [users@httpd]
tls_process_client_certificate:certificate verify failed - when using a
PSS Signed intermediat
Gesendet von:    
   "Frank
Wuttig" <info@xxxxxxxxxxx>

---

Hi,

we use a Clientauth configuration for a location without problems for many
months

Ubuntu 16.04.5 LTS
Apache 2.4.18-2ubuntu3.9
openssl 1.0.2g-1ubuntu4.13


Now we upgraded Apache to use HTTP2

Ubuntu 16.04.5 LTS
Apache  2.4.34-1
openssl 1.1.0h-2.0


Apache Conf:

    SSLEngine on
    SSLVerifyDepth 2
    SSLProxyEngine on
    SSLProtocol -All +TLSv1.2 +TLSv1.1

    SSLCipherSuite HIGH:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!EXP:!DES:!RC4:!3DES:!MD5:!PSK:!MEDIUM:!LOW:!SRP:!DSS

    SSLCertificateFile /etc/apache2/ssl/blablub.pem
    SSLCertificateKeyFile /etc/apache2/ssl/blablub.key
    SSLCertificateChainFile /etc/apache2/ssl/blablub.ca_certificates.pem
    SSLCACertificateFile /etc/apache2/ssl/ProductiveCAClientAuth.pem

....other stuff without ClientAuth...

    <Location /test>
        SSLVerifyClient require
        SSLVerifyDepth 2

        ProxyPass https://server-1/test
        ProxyPassReverse https://server-1/testg

    </Location>


Particularity:

The client certificates are issued by an intermediate CA which is itself
PSS Signed. 
The root CA and the actual client certificates are signed normally SHA256.
Do not ask why, that's how it was built in the past and has worked so far

Error:

[Tue Sep 25 07:18:27.723798 2018] [ssl:debug] [pid 49219:tid 140033499584256]
ssl_engine_kernel.c(757): [client 89.187.203.114:61120] AH02255: Changed
client verification type will force renegotiation
[Tue Sep 25 07:18:27.723803 2018] [ssl:info] [pid 49219:tid 140033499584256]
[client 89.187.203.114:61120] AH02221: Requesting connection re-negotiation
[Tue Sep 25 07:18:27.723827 2018] [ssl:debug] [pid 49219:tid 140033499584256]
ssl_engine_kernel.c(987): [client 89.187.203.114:61120] AH02260: Performing
full renegotiation: complete handshake protocol (client does support secu
re renegotiation)
[Tue Sep 25 07:18:27.723867 2018] [ssl:info] [pid 49219:tid 140033499584256]
[client 89.187.203.114:61120] AH02226: Awaiting re-negotiation handshake
[Tue Sep 25 07:18:33.176966 2018] [ssl:error] [pid 49219:tid 140033499584256]
[client 89.187.203.114:61120] AH02261: Re-negotiation handshake failed
[Tue Sep 25 07:18:33.176987 2018] [ssl:error] [pid 49219:tid 140033499584256]
SSL Library Error: error:1417C086:SSL routines:tls_process_client_certificate:certificate
verify failed
[Tue Sep 25 07:18:33.177005 2018] [core:trace3] [pid 49219:tid 140033499584256]
request.c(119): [client 89.187.203.114:61120] auth phase 'check access
(with Satisfy All)' gave status 403: /test/
[Tue Sep 25 07:18:33.177032 2018] [headers:debug] [pid 49219:tid 140033499584256]
mod_headers.c(900): AH01503: headers: ap_headers_error_filter()
[Tue Sep 25 07:18:33.177057 2018] [http:trace3]
[pid 49219:tid 140033499584256] http_filters.c(1128): [client 89.187.203.114:61120]
Response sent with status 403, headers:
[Tue Sep 25 07:18:33.177062 2018] [http:trace5]
[pid 49219:tid 140033499584256] http_filters.c(1135): [client 89.187.203.114:61120]
  Date: Tue, 25 Sep 2018 05:18:27 GMT
[Tue Sep 25 07:18:33.177066 2018] [http:trace5]
[pid 49219:tid 140033499584256] http_filters.c(1138): [client 89.187.203.114:61120]
  Server: Apache/2.4.34 (Ubuntu)
[Tue Sep 25 07:18:33.177071 2018] [http:trace4]
[pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120]
  X-Frame-Options: SAMEORIGIN
[Tue Sep 25 07:18:33.177075 2018] [http:trace4]
[pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120]
  Content-Length: 320
[Tue Sep 25 07:18:33.177080 2018] [http:trace4]
[pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120]
  Connection: close
[Tue Sep 25 07:18:33.177084 2018] [http:trace4]
[pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120]
  Content-Type: text/html; charset=iso-8859-1


We tested it all again with client certificates issued by a SHA256 intermediat
CA. This works without problems. 
As I suspect that by updating Apache or openssl there is now a problem
with PSS signed issuers.
Someone has an idea what you can do to make it fly again?

cheers 

Frank

Digitalisierung nach [Ihren] Regeln
Jetzt informieren unter www.procilon.de/progov

---

procilon IT-Logistics GmbH
Leipziger Straße 110
04425 Taucha bei Leipzig
www.procilon.de

---

Sitz der Gesellschaft: Leipziger
Straße 110, 04425 Taucha bei Leipzig
Amtsgericht Leipzig HRB 18002, Geschäftsführer Torsten Rienaß

---

 Diese E-Mail kann Betriebs-
oder Geschäftsgeheimnisse oder sonstige vertrauliche Informationen enthalten.
Sollten Sie diese E-Mail irrtümlich erhalten haben, ist Ihnen eine Kenntnisnahme
des Inhalts,
eine Vervielfältigung oder Weitergabe der E-Mail ausdrücklich untersagt.
Bitte benachrichtigen Sie uns und vernichten Sie die empfangene E-Mail.
Vielen Dank.

---

 This e-mail may contain
trade secrets or privileged, undisclosed, or otherwise confidential information.
If you have received this e-mail in error, you are hereby notified that
any review,
copying, or distribution of it is strictly prohibited. 
Please inform us immediately and destroy the original transmittal. Thank
you for your cooperation.[Anhang "ProGOV-VerifySMIME.pdf" gelöscht
von Frank Wuttig/procilon/itgroup]

Digitalisierung nach [Ihren] Regeln
Jetzt informieren unter www.procilon.de/progov

---

procilon IT-Logistics GmbH
Leipziger Straße 110
04425 Taucha bei Leipzig
www.procilon.de

---

Sitz der Gesellschaft: Leipziger Straße 110, 04425 Taucha bei Leipzig
Amtsgericht Leipzig HRB 18002, Geschäftsführer Torsten Rienaß

---

Diese E-Mail kann Betriebs- oder Geschäftsgeheimnisse oder sonstige vertrauliche Informationen enthalten.
Sollten Sie diese E-Mail irrtümlich erhalten haben, ist Ihnen eine Kenntnisnahme des Inhalts,
eine Vervielfältigung oder Weitergabe der E-Mail ausdrücklich untersagt.
Bitte benachrichtigen Sie uns und vernichten Sie die empfangene E-Mail. Vielen Dank.

---

This e-mail may contain trade secrets or privileged, undisclosed, or otherwise confidential information.
If you have received this e-mail in error, you are hereby notified that any review,
copying, or distribution of it is strictly prohibited.
Please inform us immediately and destroy the original transmittal. Thank you for your cooperation.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature