Hello all
i am new on this list. linux machine redhat
6.2.
i compiled openssl-0.9.6.
then patch and compiled apache-1.3.14 with no
problems.
after that i have make certs with the following
commands:
cd /usr/local/ssl/private
openssl genrsa -des3 -out MyCA.key
openssl genrsa -des3 -out ServerCA.key
openssl genrsa -des3 -out ClientCA.key
cd ../certs
openssl req -new x509 -days 90 -key
../private/MyCA.key -out MyCA.crt
openssl req -new -key ../private/ServerCA.key -out
ServerCA.csr
openssl req -new -key ../privateClientCA.key -out
ClientCA.csr
openssl ca -cert MyCA.crt -in ServerCA.csr -keyfile
../private/MyCA.key -out ServerCA.crt
openssl ca -cert MyCA.crt -in ClientCA.csr -keyfile
../private/MyCA.key -out ClientCA.crt
openssl pkcs12 -export -in MyCA.crt -inkey
../private/MyCA.key -out MyCA.pfx
in httpd.conf:
SSLCACertificatePath
/usr/local/ssl/certs
SSLCACertificateFile
/usr/local/ssl/certs/ClientCA.crt
SSLCertificateFile
/usr/local/ssl/certs/ServerCA.crt
SSLCertificateKeyFile
/usr/local/ssl/private/ServerCA.key
SSLVerifyClient 1
SSLVerifyDepth 1
with SSLVerifyClient 0 there is no
problem
with SSLVerifyClient 1, i cant cennoct to the
server in the error_log is the following message:
[Tue Feb 20 16:01:14 2001]
/usr/local/src/apache_1.3.14/src/modules/ssl/gcache s
tarted [Tue Feb 20 16:01:14 2001] [debug] apache_ssl.c(369): Random input /dev/urandom( 1024) -> 1024 [Tue Feb 20 16:01:14 2001] [info] created shared memory segment #118657 [Tue Feb 20 16:01:14 2001] /usr/local/src/apache_1.3.14/src/modules/ssl/gcache s tarted [Tue Feb 20 16:01:14 2001] [notice] Apache/1.3.14 Ben-SSL/1.42 (Unix) configured -- resuming normal operations [Tue Feb 20 16:01:14 2001] [info] Server built: Feb 16 2001 16:46:27 [Tue Feb 20 16:01:27 2001] [debug] apache_ssl.c(369): Random input /dev/urandom( 1024) -> 1024 [Tue Feb 20 16:01:29 2001] [error] SSL_accept failed [Tue Feb 20 16:01:29 2001] [error] error:140890B0:SSL routines:SSL3_GET_CLIENT_C ERTIFICATE:no certificates returned what is wrong? i use netscape 4.75
please help
christoph hubmann |
- Re: please help apache-ssl Christoph Hubmann
- Re: please help apache-ssl Jorge Olmos