Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:


                ----------
              |  Root CA  |    // Self-Signed Certificate
                ----------
                    |      
                ----------
              |  SiteA CA  |  // Intermediate Certificate signed by Root CA
                ----------
               |          |
           --------    --------
         | Server1 | | Client1 |  //Certificates signed by SiteA CA
           --------    --------              

in Apache Configuration I edited next:
make a chain crt:

sudo cat server.crt rootca.crt serverCA.crt > server_chain.crt 

edit ssl config :

sudo vi /etc/httpd/conf.d/ssl.conf

edit those four lines :

SSLCertificateFile /etc/pki/tls/server.crt 
SSLCertificateKeyFile /etc/pki/tls/server.key 
SSLCertificateChainFile /etc/pki/tls/server_chain.crt 
SSLCACertificateFile /etc/pki/tls/rootca.crt

and to make it (two-way) Mutual Authentication :

SSLVerifyClient require
SSLVerifyDepth  10

Then : restart apache=httpd service :

sudo service httpd restart

you know that you should give your browser root ca certificate and client certificate and while I was doing a Testing I did next:

I removed rootca.crt from browser and noticed that Firefox and Chrome ask me for client certificate confirmation before telling me that the server is not a trusted, while Opera browser acts right, first tell me that it's not trusted and then show me Client certificate information.

I was told that in IIS there's an option for telling the web server which one to ask about first, but I couldn't find that option here in Apache.
Can anybody help ?

share|improve this question
    
While your questions are on-topic here since you're doing all these things on a unix system, you'll find more experts on SSL certificate generation and deployment on Information Security. –  Gilles May 16 '13 at 22:36
    
@Gilles I really don't know what's wrong with you guys ! I asked there at IT Security and they just kept voting down then someone told me I have to put my question on Webmasters Pro ! and at Web masters Pro they just voted up without answering me ! Thanks any way :) –  Nancy Smith May 18 '13 at 8:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.