Hello all
i am new on this list. linux machine redhat 6.2.
i compiled openssl-0.9.6.
then patch and compiled apache-1.3.14 with no problems.
 
after that i have make certs with the following commands:
cd /usr/local/ssl/private
openssl genrsa -des3 -out MyCA.key
openssl genrsa -des3 -out ServerCA.key
openssl genrsa -des3 -out ClientCA.key
cd ../certs
openssl req -new x509 -days 90 -key ../private/MyCA.key -out MyCA.crt
openssl req -new -key ../private/ServerCA.key -out ServerCA.csr
openssl req -new -key ../privateClientCA.key -out ClientCA.csr
openssl ca -cert MyCA.crt -in ServerCA.csr -keyfile ../private/MyCA.key -out ServerCA.crt
openssl ca -cert MyCA.crt -in ClientCA.csr -keyfile ../private/MyCA.key -out ClientCA.crt
openssl pkcs12 -export -in MyCA.crt -inkey ../private/MyCA.key -out MyCA.pfx
 
in httpd.conf:
SSLCACertificatePath /usr/local/ssl/certs
SSLCACertificateFile /usr/local/ssl/certs/ClientCA.crt
SSLCertificateFile /usr/local/ssl/certs/ServerCA.crt
SSLCertificateKeyFile /usr/local/ssl/private/ServerCA.key
SSLVerifyClient 1
SSLVerifyDepth 1
 
with SSLVerifyClient 0 there is no problem
with SSLVerifyClient 1, i cant cennoct to the server in the error_log is the following message:
[Tue Feb 20 16:01:14 2001] /usr/local/src/apache_1.3.14/src/modules/ssl/gcache s
tarted
[Tue Feb 20 16:01:14 2001] [debug] apache_ssl.c(369): Random input /dev/urandom(
1024) -> 1024
[Tue Feb 20 16:01:14 2001] [info] created shared memory segment #118657
[Tue Feb 20 16:01:14 2001] /usr/local/src/apache_1.3.14/src/modules/ssl/gcache s
tarted
[Tue Feb 20 16:01:14 2001] [notice] Apache/1.3.14 Ben-SSL/1.42 (Unix) configured
 -- resuming normal operations
[Tue Feb 20 16:01:14 2001] [info] Server built: Feb 16 2001 16:46:27
[Tue Feb 20 16:01:27 2001] [debug] apache_ssl.c(369): Random input /dev/urandom(
1024) -> 1024
[Tue Feb 20 16:01:29 2001] [error] SSL_accept failed
[Tue Feb 20 16:01:29 2001] [error] error:140890B0:SSL routines:SSL3_GET_CLIENT_C
ERTIFICATE:no certificates returned
 
what is wrong? i use netscape 4.75
 
please help
 
christoph hubmann

Reply via email to