apache client authentication problem (somewhat long)

Bill Tangren <bjt@xxxxxxxxxxxxxxxx> · Tue, 28 Nov 2006 14:38:22 -0500

I posted this on the Redhat Enterprise Linux 4 (Nahant) list, but I didn't get 

sufficient help to solve my problem, so I'm trying here. I apologize in advance 

if any of you have seen this before.

I am having a problem with client authentication with apache and openssl. I have 

been ordered to get this working, or I will have to be shut down. I think this 

is a complex problem (because my web site is somewhat complex, at least for me) 

but I will try to simplify it as much as possible.

I am trying to set up a test directory that requires client authentication, 

while the parent directory (which is used for web email) does not. I also have 

non-encrypted web sites, and that may be what is bollixing up this process, I 

don't know.

When I use Internet Explorer to access this test directory, I am successfully 

presented with the certificate, and required to provide my client certificate. 

After I do so, however, I get a

"The page cannot be displayed. The page is currently unavailable..."

Nothing shows up in /var/log/httpd/ssl_error_log, or in 

/var/log/httpd/ssl_access_log. However, /var/log/httpd/webmail_error_log shows this:

[Wed Nov 22 11:00:56 2006] [error] Certificate Verification: Error (20): unable 

to get local issuer certificate

[Wed Nov 22 11:00:56 2006] [error] Re-negotiation handshake failed: Not accepted 

by client!?

/var/log/httpd/webmail_access_log indicates an apache 103 error:

schwarzschild.usno.navy.mil - - [22/Nov/2006:11:00:55 -0500] "GET /pkitest/ 

HTTP/1.0" 103 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; 

.NET CLR 1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50727)"

I've never heard of a 103 error. The apache error codes seem to start in the 

200's (http://bignosebird.com/apache/a5.shtml).

Googling comes up with this:

<http://www.mail-archive.com/modssl-users@xxxxxxxxxx/msg17064.html>

which indicated a number of things, which I tried without success.

Googling on the renegotiation handshake error yielded quite a bit on use of 

KeepAlive, but I don't use it, and turning it on didn't help.

There are other, simpler, web sites here at work that only have this client 

authentication, and they were able to implement it without trouble. They are, 

however, on a fedora core 5 system running apache 2.2.x.

I run httpd-2.0.52-28 and openssl-0.9.7a-43.14 on a RHEL ES 4 system. My 

*httpd.conf* contains (in part)

<VirtualHost aa.usno.navy.mil:443>
   ServerAdmin bjt@xxxxxxxxxxxxxxxx
   ServerName aa.usno.navy.mil
   ErrorLog /var/log/httpd/webmail_error_log
   CustomLog /var/log/httpd/webmail_access_log combined
   TransferLog /var/log/httpd/access_log
   SSLEngine on
   SSLCertificateFile    /etc/httpd/conf/ssl.crt/AA_PKI.crt
   SSLCertificateKeyFile /etc/httpd/conf/ssl.key/AA_PKI.key
   SSLCACertificateFile  /etc/httpd/conf/ssl.crt/root.crt
   SSLVerifyClient none

   <Files ~ "\.(cgi|shtml)$">
      SSLOptions +StdEnvVars
   </Files>

   ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
   <Directory "/var/www/cgi-bin">
      SSLOptions +StdEnvVars
      AllowOverride None
      Options None
      Order allow,deny
      Allow from all
   </Directory>

   <Directory "/var/www/html/pkitest">
      Options Indexes FollowSymLinks MultiViews Includes
      AllowOverride None
      Order allow,deny
      Allow from all
      SSLRequireSSL
      SSLVerifyClient require
      SSLVerifyDepth 10
   </Directory>

   SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown \
      downgrade-1.0 force-response-1.0
   CustomLog /etc/httpd/logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x \
      %{SSL_CIPHER}x \"%r\" %b"

   DocumentRoot /var/www/html
   <Directory "/var/www">
      Options -Indexes FollowSymLinks MultiViews Includes
      AllowOverride None
      Order allow,deny
      Allow from all
   </Directory>
   Alias /webmail /usr/share/squirrelmail
</VirtualHost>

My *ssl.conf* contains

LoadModule ssl_module modules/mod_ssl.so
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl
SSLPassPhraseDialog  builtin
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin

<VirtualHost _default_:443>

ServerName aa.usno.navy.mil:443
ServerAdmin bjt@xxxxxxxxxxxxxxxx
RewriteEngine on
RewriteRule ^https://aa/$ https://aa.usno.navy.mil/
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
SSLCertificateFile /etc/httpd/conf/ssl.crt/AA_PKI.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/AA_PKI.key
SSLCACertificateFile /etc/httpd/conf/ssl.crt/root.crt
SSLCACertificatePath /etc/httpd/conf/ssl.crt
SSLVerifyClient optional
SSLVerifyDepth  10
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

Can anyone help?

TIA,

Bill Tangren

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx