Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:


                ----------
              |  Root CA  |    // Self-Signed Certificate
                ----------
                    |      
                ----------
              |  SiteA CA  |  // Intermediate Certificate signed by Root CA
                ----------
               |          |
           --------    --------
         | Server1 | | Client1 |  //Certificates signed by SiteA CA
           --------    --------              

in Apache Configuration I edited next:
make a chain crt:

sudo cat server.crt rootca.crt serverCA.crt > server_chain.crt 

edit ssl config :

sudo vi /etc/httpd/conf.d/ssl.conf

edit those four lines :

SSLCertificateFile /etc/pki/tls/server.crt 
SSLCertificateKeyFile /etc/pki/tls/server.key 
SSLCertificateChainFile /etc/pki/tls/server_chain.crt 
SSLCACertificateFile /etc/pki/tls/rootca.crt

and to make it (two-way) Mutual Authentication :

SSLVerifyClient require
SSLVerifyDepth  10

Then : restart apache=httpd service :

sudo service httpd restart

you know that you should give your browser root ca certificate and client certificate and while I was doing a Testing I did next:

I removed rootca.crt from browser and noticed that Firefox and Chrome ask me for client certificate confirmation before telling me that the server is not a trusted, while Opera browser acts right, first tell me that it's not trusted and then show me Client certificate information.

I was told that in IIS there's an option for telling the web server which one to ask about first, but I couldn't find that option here in Apache.
Can anybody help ?

share|improve this question
1  
For general SSL, when you chain certs together the most immediate cert is first in the file. Your ultimate root cert is last in the file. –  jeffatrackaid Jun 11 at 16:17

1 Answer 1

This might help you:
https://www.ssllabs.com/ssltest/analyze.html?d=yourwebsite.com

I recently used this to test security. This returns which protocals are used, possible vulnarebilities, keylengths and certificate chain order.

They give you all sorts of information, very useful, I recommend this for everyone, just do a simple check, it's free and only takes a few minutes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.