Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to implement mutual authentication (two - way ) with apache web server.

References :
1.Failed to sign CSR with the CA root key
2.Firefox error message when adding client certificate signed by CA

after many steps :

  1. Configuring Apache 2.0 SSL to accept https by editing ssl.conf .
  2. Creating a Certificate Authority using OpenSSL & importing it to the web browser [link]
  3. Creating a Web Server Certificate & sign it by CA & put it as apache certificate.[link]
  4. Creating a Client Certificate & sign it by CA & export it as PKCS#12 format [link]& import it to web browser

I now have an access with https to the server but for all users .
I want just the authorized users who I gave them a signed certificate by CA to access to web pages on my server . I needed to edit ssl.conf in /etc/httpd/conf.d/ssl.conf following this tutorial , I did this to ssl.conf :

SSLVerifyClient require
SSLVerifyDepth 2

Update#1 :

and of course I had set the certificate to the signed one by CA :

#   Server Certificate:
#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateFile /var/www/sslConf/server.crt
#   Server Private Key:
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateKeyFile /var/www/sslConf/server.key

and as a result I got this message and after pressing ok this message (in firefox). what's the mistake I had committed ?

share|improve this question
    
I'd go through this tutorial and see what steps you're either missing or differ: linuxconfig.org/apache-web-server-ssl-authentication –  slm Apr 28 '13 at 13:18

1 Answer 1

up vote 0 down vote accepted

Look into the Apache logs to see what is wrong. It looks like apache isn't able to verify the client certificate.

Do you have the SSLCACertificateFile directive set correctly? This is necessarry, apache cannot verify certificate otherwise.

share|improve this answer
    
yes , you are right , I forget to set it :D , it gave me the same massage and not it's https correctly :) –  Nancy Smith Apr 30 '13 at 6:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.