Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I had implement a mutual certificate authentication and it worked successfully for following steps :

  1. create root ca (self-signed)
  2. create server certificate and sign it with ca private key
  3. create users certificates and sign them with ca private key
  4. import server.crt as "authority" to browser and user.crt as "your certificates"
  5. configure ssl.conf to add those lines :

    SSLCertificateKeyFile /home/safaa/rootca/certs/server.key
    
    SSLCertificateFile /home/safaa/rootca/certs/server.crt
    
    SSLCACertificateFile /home/safaa/rootca/certs/rootca.crt
    
    SSLVerifyDepth  10
    
    SSLVerifyClient require
    

now I've added an Intermediate certificate to my flowchart and steps have became :

  1. create root CA (self-signed)
  2. create server CA and sign it with CA private key
  3. create server certificate and sign it with server CA private key
  4. create users certificates and sign them with server CA private key
  5. import server.crt as "authority" to browser and user.crt as "your certificates"
  6. configure ssl.conf to add those lines :

    SSLCertificateKeyFile /home/safaa/serverCA/certs/server.key
    
    SSLCertificateFile /home/safaa/serverCA/certs/server.crt
    
    SSLCACertificateFile /home/safaa/serverCA/certs/serverCA.crt
    
    SSLVerifyDepth  10
    
    SSLVerifyClient require
    

now when I'm trying to restart httpd service : service httpd restart I'm getting

#sudo service httpd start
Starting httpd:                                            [FAILED]

#sudo service httpd status
 httpd is stopped

I have tried to comment & uncomment lines but I had failed to make it work

SSLCertificateChainFile /home/safaa/rootca/certs/rootca.crt
SSLCACertificateFile /home/safaa/serverCA/certs/serverCA.crt

also , every certificate I had generated I did a verification and all of them five me that verify is OK , I also changed owner and permissions for folders of rootca && serverCA and make them the same for ssl.conf p.s : I'm running my bash for php .

what have I missed ? someone had told me that I can use trusted repository in Linux instead of configuring ssl , is that possible ? where to add my ca to Linux to make it see it as verisign !?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.