SSLVerifyClient require

This is a multi-part message in MIME format.

------=_NextPart_000_005B_01C3D924.6AEDB840
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

I am having a problem with client authentication getting client certificates
to work -

Have installed the client certificate in internet explorer, this also
installs the server certificate as a 'trusted root certificate'.
When access basic https area of website all works correctly, when attempt to
go into the area where SSLVerifyClient is required, the certificate is
prompted for. But when chosen get "The page cannot be displayed" error.

The error in the ssl_error_log is: [Fri Jan 09 11:37:48 2004] [error]
Re-negotiation handshake failed: Not accepted by client!?

If certificates are viewed IE says that they are valid etc.

I was after references to good HowTo's or any views on whether this is a IE,
modssl, Apache or just a certificates problem.

Thanks in advance

Our server is
Apache-AdvancedExtranetServer/2.0.47 (Mandrake Linux/6mdk) mod_perl/1.99_09
Perl/v5.8.1 mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.2!

And clients are Internet Explorer IE6 and Opera 7.2

*****
SETUP CERTIFICATES AS FOLLOWS in directory /home/test/CA/:
*****
CERTIFICATION AUTHORITY
Generate New Certification Authority
perl CA.pl -newca (when prompted I set the CN name to the servers ip
address)

SERVER CERTIFICATE
Generate new certificate request for SERVER (newreq.pem)
perl CA.pl -newreq (when prompted I set the CN name to the servers ip
address)
Sign it (generates newcert.pem)
perl CA.pl -sign
Get Key from it
openssl rsa < newreq.pem > newkey.pem

CLIENT CERTIFICATE
Generate Unencrypted Key for CLIENT
openssl genrsa -out client_unsecure.key 1024
Generate new certificate request for CLIENT
openssl req -new -key client_unsecure.key -out client_unsecure.csr (when
prompted I set the CN name to the client ip address)
Sign it
openssl ca -config /<somepath>/openssl.cnf -policy policy_anything -out
client_unsecure.crt -infiles client_unsecure.csr
Create format for Internet Explorer
openssl pkcs12 -export -in client_unsecure.crt -inkey
client_unsecure.key -name "Client Cert" -certfile ./demoCA/cacert.pem -out
clientcert.p12

41_MOD_SSL.DEFAULT-VHOST.CONF SETTINGS AS FOLLOWS:
DocumentRoot "/var/www/html/secure"
ErrorLog logs/ssl_error_log
<IfModule mod_log_config.c>
TransferLog logs/ssl_access_log
</IfModule>
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on

# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLProtocol all
SSLCipherSuite HIGH:MEDIUM

# Server Certificate:
SSLCertificateFile /home/test/CA/newcert.pem

# Server Private Key:
SSLCertificateKeyFile /home/test/CA/newkey.pem

# Server Certificate Chain:

# Certificate Authority (CA):
SSLCACertificateFile /home/test/CA/demoCA/cacert.pem

# Certificate Revocation Lists (CRL):

# Client Authentication (Type):
#SSLVerifyClient require
#SSLVerifyDepth 10

<Location /audit>
SSLVerifyClient require
SSLVerifyDepth 1
</Location>

------=_NextPart_000_005B_01C3D924.6AEDB840
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<meta name=3DProgId content=3DWord.Document>
<meta name=3DGenerator content=3D"Microsoft Word 9">
<meta name=3DOriginator content=3D"Microsoft Word 9">
<link rel=3DFile-List href=3D"cid:filelist.xml [at] 01C3D924.6A62B650">

<style>

</style>
</head>

<body lang=3DEN-GB style=3D'tab-interval:36.0pt'>

<div class=3DSection1>

I am having a problem with client authentication getting client
certificates to work - <o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

Have installed the client certificate in internet explorer, this =
also
installs the server certificate as a 'trusted root certificate'. =
<o:p></o:p>

When access basic https area of website all works correctly, when
attempt to go into the area where SSLVerifyClient is required, the =
certificate
is prompted for. But when chosen get "The page cannot be =
displayed"
error.<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

The error in the ssl_error_log is: [Fri Jan 09 11:37:48 2004] =
[error]
Re-negotiation handshake failed: Not accepted by client!? =
<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

If certificates are viewed IE says that they are valid =
etc.<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

I was after references to good HowTo's or any views on whether =
this is a
IE, modssl, Apache or just a certificates problem. <o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

Thanks in advance<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

Our server is<o:p></o:p>

Apache-AdvancedExtranetServer/2.0.47 (Mandrake Linux/6mdk)
mod_perl/1.99_09 Perl/v5.8.1 mod_ssl/2.0.47 OpenSSL/0.9.7b =
PHP/4.3.2!<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

And clients are Internet Explorer IE6 and Opera =
7.2<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

*****<o:p></o:p>

SETUP CERTIFICATES AS FOLLOWS in directory =
/home/test/CA/:<o:p></o:p>

*****<o:p></o:p>

CERTIFICATION AUTHORITY<o:p></o:p>

Generate New Certification =
Authority<o:p></o:p>

 perl =
CA.pl
-newca (when prompted I set the CN name to the servers ip =
address)<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

SERVER CERTIFICATE<o:p></o:p>

Generate new certificate request for SERVER =
(newreq.pem)<o:p></o:p>

 perl =
CA.pl
-newreq (when prompted I set the CN name to the servers ip =
address)<o:p></o:p>

Sign it (generates =
newcert.pem)<o:p></o:p>

 perl =
CA.pl
-sign<o:p></o:p>

Get Key from it<o:p></o:p>

 =
openssl rsa
< newreq.pem > newkey.pem<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

CLIENT CERTIFICATE<o:p></o:p>

Generate Unencrypted Key for =
CLIENT<o:p></o:p>

 =
openssl genrsa
-out client_unsecure.key 1024<o:p></o:p>

Generate new certificate request for =
CLIENT<o:p></o:p>

 =
openssl req
-new -key client_unsecure.key -out client_unsecure.csr (when prompted I =
set the
CN name to the client ip address)<o:p></o:p>

Sign it<o:p></o:p>

 =
openssl ca
-config /<somepath>/openssl.cnf -policy policy_anything -out
client_unsecure.crt -infiles =
client_unsecure.csr<o:p></o:p>

Create format for Internet =
Explorer<o:p></o:p>

 =
openssl pkcs12
-export -in client_unsecure.crt -inkey client_unsecure.key -name =
"Client
Cert" -certfile ./demoCA/cacert.pem -out =
clientcert.p12<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

41_MOD_SSL.DEFAULT-VHOST.CONF SETTINGS AS =
FOLLOWS:<o:p></o:p>

DocumentRoot =
"/var/www/html/secure"<o:p></o:p>

ErrorLog logs/ssl_error_log<o:p></o:p>

<IfModule =
mod_log_config.c><o:p></o:p>

TransferLog =
logs/ssl_access_log<o:p></o:p>

</IfModule><o:p></o:p>

# SSL Engine =
Switch:<o:p></o:p>

# =
Enable/Disable SSL
for this virtual host.<o:p></o:p>

SSLEngine on<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

# SSL Cipher =
Suite:<o:p></o:p>

# List the =
ciphers
that the client is permitted to =
negotiate.<o:p></o:p>

# See the =
mod_ssl
documentation for a complete list.<o:p></o:p>

SSLProtocol all<o:p></o:p>

SSLCipherSuite HIGH:MEDIUM<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

# Server =
Certificate:<o:p></o:p>

SSLCertificateFile =
/home/test/CA/newcert.pem<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

# Server =
Private Key:<o:p></o:p>

SSLCertificateKeyFile =
/home/test/CA/newkey.pem<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

# Server =
Certificate
Chain:<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

# =
Certificate
Authority (CA):<o:p></o:p>

SSLCACertificateFile =
/home/test/CA/demoCA/cacert.pem<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

# =
Certificate
Revocation Lists (CRL):<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

# Client
Authentication (Type):<o:p></o:p>

#SSLVerifyClient require<o:p></o:p>

#SSLVerifyDepth =
10<o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

<Location /audit><o:p></o:p>


SSLVerifyClient require<o:p></o:p>


SSLVerifyDepth =
1<o:p></o:p>

</Location><o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p>

<![if =
!supportEmptyParas]> <![endif]><o:p></o:p><=
/p>

</div>

</body>

</html>

------=_NextPart_000_005B_01C3D924.6AEDB840--

____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users [at] modssl.org
Automated List Manager majordomo [at] modssl.org