3

I had implement a mutual certificate authentication and it worked successfully for following steps :

  1. create root ca (self-signed)
  2. create server certificate and sign it with ca private key
  3. create users certificates and sign them with ca private key
  4. import server.crt as "authority" to browser and user.crt as "your certificates"
  5. configure ssl.conf to add those lines :

    SSLCertificateKeyFile /home/safaa/rootca/certs/server.key
    
    SSLCertificateFile /home/safaa/rootca/certs/server.crt
    
    SSLCACertificateFile /home/safaa/rootca/certs/rootca.crt
    
    SSLVerifyDepth  10
    
    SSLVerifyClient require
    

now I've added an Intermediate certificate to my flowchart and steps have became :

  1. create root CA (self-signed)
  2. create server CA and sign it with CA private key
  3. create server certificate and sign it with server CA private key
  4. create users certificates and sign them with server CA private key
  5. import server.crt as "authority" to browser and user.crt as "your certificates"
  6. configure ssl.conf to add those lines :

    SSLCertificateKeyFile /home/safaa/serverCA/certs/server.key
    
    SSLCertificateFile /home/safaa/serverCA/certs/server.crt
    
    SSLCACertificateFile /home/safaa/serverCA/certs/serverCA.crt
    
    SSLVerifyDepth  10
    
    SSLVerifyClient require
    

now when I'm trying to restart httpd service : service httpd restart I'm getting

#sudo service httpd start
Starting httpd:                                            [FAILED]

#sudo service httpd status
 httpd is stopped

I have tried to comment & uncomment lines but I had failed to make it work

SSLCertificateChainFile /home/safaa/rootca/certs/rootca.crt
SSLCACertificateFile /home/safaa/serverCA/certs/serverCA.crt

also , every certificate I had generated I did a verification and all of them five me that verify is OK , I also changed owner and permissions for folders of rootca && serverCA and make them the same for ssl.conf p.s : I'm running my bash for php .

what have I missed ? someone had told me that I can use trusted repository in Linux instead of configuring ssl , is that possible ? where to add my ca to Linux to make it see it as verisign !?

0

Answering old question because this came up as a suggestion when searching for another answer:

In general, you shouldn't need to add a server certificate to a browser unless it is self-signed. That is the entire purpose of a trust chain. Going through the trouble of creating an intermediate CA is kind of pointless if you aren't using the root as a trust anchor anywhere.

I also don't think you're fully understanding the use or effects of the directives. I suggest reviewing them in the Apache Documentation here. I think what you may be looking for first is SSLCACertificateFile

As for my initial comment, per the docs, SSLCertificateFile should also load intermediate certs from the same file (simply append the intermediate and (optionally?) root certificates to server.crt). This should allow you to import the root CA's certificate to your browser as a trusted CA rather than the individual server cert(s).

See also: this answer for additional discussion of mutual authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.