I was asked to setup an Apache webserver to use Mutual Authentication in order to protect access to a specific folder/file.

The access to this specific file/folder should be granted only if the client sends a trusted self-signed client certificate.

On the webserver I've already set up HTTPS with a valid certificate signed by a trusted CA(that was the easy part)

I've never done something like that and I don't know where to start and how to check if it's working.

I also don't know what files the client should send to me to start the setup: I suppose they should send the client certificate and their CA used to sign the cert, is this the best approach?

Can you help me with the setup?


You can check any of several online tutorials on this topic.

Basically you activate TLS normally, then add an authorization rule that will require a client certificate:

SSLVerifyClient require

This will cause the access to fail and the browser to ask the customer to select among the available certificates, that must have been already installed in the client operating system or browser. Once the chosen certificate is loaded in the client, it will be automatically sent to the server.

Now, adding also SSLOptions +StdEnvVars will tell Apache to extract info from the certificate, which will allow you to distinguish between users.

Now you have that precious info in the environment, and can use it to authenticate further, either in an app or in Apache.

Env vars you want are probably SSL_CLIENT_S_<something>. SSL_CLIENT_S_DN_CN is the Common Name in the client certificate. You can then restrict the clients' parameters however you want:

SSLOptions  +StdEnvVars +ExportCertData +OptRenegotiate +FakeBasicAuth
SSLVerifyClient   require
SSLRequire %{SSL_CLIENT_I_DN_CN} eq "Issuer DN's Common Name"
       and %{SSL_CLIENT_S_DN_O}  eq "Subject DN's Organisation"
       and %{SSL_CLIENT_S_DN_CN} eq "Leonardo Serni"

Note that, as @UlrichSchwarz correctly pointed out, you should enforce the Certification Authority. Otherwise anyone could self-sign a certificate stating anything, with you none the wiser.

So you should create a CA of your own, and use that to generate the signed certificates that will then be distributed to your clients.

UPDATE: the I variables relate to the (I)ssuer, while the S relate to the (S)ubject, that is, the one doing the authentication (i.e., your client). You can find the complete list and their meaning in the docs for mod_ssl.

  • 1
    As a corollary to your example, this doesn't scale well if you can't enforce which CA your clients should use. – Ulrich Schwarz Jan 12 '20 at 16:52
  • @UlrichSchwarz very good point, amended answer. Thanks! – LSerni Jan 12 '20 at 17:16
  • It is more clear now. I just don't understand your last point regarding the CA: should I use my CA to sign the client certificate and send it to the customer or it is more convenient to import the counterpart's CA into my server? – r00tsys Jan 12 '20 at 18:02
  • You can do both. But you said "self signed certificate", so, how much do you trust your client? If you accept their bogey CA, then in the future they can generate whatever certificate they want. I'd suggest you either supply your certificates, or ask for a reputable certification authority. – LSerni Jan 12 '20 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.