I want to implement mutual authentication (two - way ) with apache web server.
after many steps :
- Configuring Apache 2.0 SSL to accept https by editing ssl.conf .
- Creating a Certificate Authority using OpenSSL & importing it to the web browser [link]
- Creating a Web Server Certificate & sign it by CA & put it as apache certificate.[link]
- Creating a Client Certificate & sign it by CA & export it as PKCS#12 format [link]& import it to web browser
I now have an access with https to the server but for all users .
I want just the authorized users who I gave them a signed certificate by CA to access to web pages on my server . I needed to edit ssl.conf in
following this tutorial , I did this to ssl.conf :
SSLVerifyClient require SSLVerifyDepth 2
and of course I had set the certificate to the signed one by CA :
# Server Certificate: #SSLCertificateFile /etc/pki/tls/certs/localhost.crt SSLCertificateFile /var/www/sslConf/server.crt # Server Private Key: #SSLCertificateKeyFile /etc/pki/tls/private/localhost.key SSLCertificateKeyFile /var/www/sslConf/server.key