Re: [CentOS] Certificates Revocation Lists and Apache...

2009-11-04 Thread Paul Heinlein
On Wed, 4 Nov 2009, John Doe wrote: > already asked in the openssl mailing list, but just in case you already went > through this... > I need a little help with Certificate Revocation Lists. > I did setup client certificates filtering with apache and it seem to work > fine so far (used a tutoria

Re: [CentOS] Certificates Revocation Lists and Apache...

2009-11-04 Thread nate
John Doe wrote: > The goal is to be able to distribute client certificates to filter web > access to certain resources. How about using just basic user names and passwords? Seems a lot simpler. Client certs can really make things messy and complicated, I worked with them a bunch several years ago

Re: [CentOS] Certificates Revocation Lists and Apache...

2009-11-04 Thread John Doe
From: nate > Any relation to this? > https://issues.apache.org/bugzilla/show_bug.cgi?id=45708 I don't think so; my tests are quite simple: - Start from clean state ( - Generate CA certificate - Generate CASSL certificate signed by CA - Generate Client Certificate signed by CASSL - Gener

Re: [CentOS] Certificates Revocation Lists and Apache...

2009-11-04 Thread nate
John Doe wrote: > [warn] Invalid signature on CRL > [error] Certificate Verification: Error (8): CRL signature failure Any relation to this? https://issues.apache.org/bugzilla/show_bug.cgi?id=45708 I've worked with a lot of ssl stuff in apache but have never touched CRL before. Interestingl

[CentOS] Certificates Revocation Lists and Apache...

2009-11-04 Thread John Doe
Hi, already asked in the openssl mailing list, but just in case you already went through this... I need a little help with Certificate Revocation Lists. I did setup client certificates filtering with apache and it seem to work fine so far (used a tutorial on http://www.adone.info/?p=4, down righ