Configuring Apache to Require a Client Certificate

Question

I want to implement mutual authentication (two - way ) with apache web server.

References :
1.Failed to sign CSR with the CA root key
2.Firefox error message when adding client certificate signed by CA

after many steps :

1. Configuring Apache 2.0 SSL to accept https by editing ssl.conf .
2. Creating a Certificate Authority using OpenSSL & importing it to the web browser [link]
3. Creating a Web Server Certificate & sign it by CA & put it as apache certificate.[link]
4. Creating a Client Certificate & sign it by CA & export it as PKCS#12 format [link]& import it to web browser

I now have an access with https to the server but for all users .
I want just the authorized users who I gave them a signed certificate by CA to access to web pages on my server . I needed to edit ssl.conf in /etc/httpd/conf.d/ssl.conf following this tutorial , I did this to ssl.conf :

SSLVerifyClient require
SSLVerifyDepth 2

Update#1 :

and of course I had set the certificate to the signed one by CA :

#   Server Certificate:
#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateFile /var/www/sslConf/server.crt
#   Server Private Key:
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateKeyFile /var/www/sslConf/server.key

and as a result I got this message and after pressing ok this message (in firefox). what's the mistake I had committed ?

Answer 1

Look into the Apache logs to see what is wrong. It looks like apache isn't able to verify the client certificate.

Do you have the SSLCACertificateFile directive set correctly? This is necessarry, apache cannot verify certificate otherwise.