Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:


                ----------
              |  Root CA  |    // Self-Signed Certificate
                ----------
                    |      
                ----------
              |  SiteA CA  |  // Intermediate Certificate signed by Root CA
                ----------
               |          |
           --------    --------
         | Server1 | | Client1 |  //Certificates signed by SiteA CA
           --------    --------              

in Apache Configuration I edited next:
make a chain crt:

sudo cat server.crt rootca.crt serverCA.crt > server_chain.crt 

edit ssl config :

sudo vi /etc/httpd/conf.d/ssl.conf

edit those four lines :

SSLCertificateFile /etc/pki/tls/server.crt 
SSLCertificateKeyFile /etc/pki/tls/server.key 
SSLCertificateChainFile /etc/pki/tls/server_chain.crt 
SSLCACertificateFile /etc/pki/tls/rootca.crt

and to make it (two-way) Mutual Authentication :

SSLVerifyClient require
SSLVerifyDepth  10

Then : restart apache=httpd service :

sudo service httpd restart

you know that you should give your browser root ca certificate and client certificate and while I was doing a Testing I did next:

I removed rootca.crt from browser and noticed that Firefox and Chrome ask me for client certificate confirmation before telling me that the server is not a trusted, while Opera browser acts right, first tell me that it's not trusted and then show me Client certificate information.

I was told that in IIS there's an option for telling the web server which one to ask about first, but I couldn't find that option here in Apache.
Can anybody help ?

share|improve this question
    
For general SSL, when you chain certs together the most immediate cert is first in the file. Your ultimate root cert is last in the file. –  jeffatrackaid Jun 11 at 16:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.