|
Hi everybody, I am currently configuring client authentication using SSL and ldap on our apache server. I’m sorry to say we have a pretty old apache version, but unfortunately we will not be able to upgrade this in the near future. Apache version: 2.2.3 Our server hosts a website that is protected with ssl/https and uses the path <domain>/emp/. This server also provides an access point to several webservices
which can be accessed through: <domain>/b2b/batch/ Configuration:
1.
We have a self signed server certificate which is used for encrypting the connection and it is configured as follows: 2.
We want to enable client authentication only if the url matches <domain>/b2b/batch. This part is only used for authenticating a user since we do not
encrypt the responses using the client’s public key. We configured this part as described below: We have tested the above settings using soapUI and cUrl and both allowed us to successfully send and receive a request from the webservice behind /b2b/batch. However, for some reason, we cannot successfully connect to the same webservice using the BEA client. Even more strange is the fact that it DOES work when we
copy the client authentication part from the <location> directive into the global part of the httpd.conf: Configuration (working, but not workable):
# Our server certificate and key <Location /b2b/batch/> In this case cUrl/soapUI still work and now the BEA WebLogic works also! Though these settings seem to be working for BEA, these settings also force anyone
who tries to access the website, MUST provide a client certificate and that should not be the case. We have tried many different settings such as setting the SSLVerifyClient to none/optional on a global level, experimented with the SSLVerifyDepth and such,
but this did not help. This has become quite an issue and if anyone has any suggestions or if our configuration does not do what we think it should do… any help would be greatly appreciated! SSL log (fail): [Mon Jan 31 17:56:11 2011] [info] Requesting connection re-negotiation [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(616): Performing full renegotiation: complete handshake protocol [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1752): OpenSSL: Handshake: start [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSL renegotiate ciphers [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write hello request A [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 flush data [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write hello request C [Mon Jan 31 17:56:11 2011] [info] Awaiting re-negotiation handshake [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1752): OpenSSL: Handshake: start [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: before accept initialization [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1775): OpenSSL: read 5/5 bytes from BIO#5555757c6df0 [mem: 5555757f3560] (BIO dump follows) [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1722): +-------------------------------------------------------------------------+ [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1747): | 0000: 80 9b 62 0d aa ..b.. | [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1753): +-------------------------------------------------------------------------+ [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1789): OpenSSL: Exit: error in SSLv3 read client hello B [Mon Jan 31 17:56:11 2011] [error] Re-negotiation handshake failed: Not accepted by client!? [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1561): [client xxx.xxx.xxx.xxx] read from buffered SSL brigade, mode 0, 8192 bytes [Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1623): [client xxx.xxx.xxx.xxx] buffered SSL brigade now exhausted; removing filter [Mon Jan 31 17:56:11 2011] [info] [client xxx.xxx.xxx.xxx] Connection to child 4 established (server <our_domain>:443) Regards, Robert Colpaert Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. |
|