Client certificates issued by my own CA with Apache

Question

Attempted to get an HTTPS session that uses client certificates from a self-signed CA. The connection should verify that all certificates are valid, both on the client side and on the server side.

The process that I performed is rounded as follows:

• Create a certification authority

  openssl genrsa -out CA.key 4096 openssl req -new -key CA.key -out CA.csr openssl x509 -req -days 365 -in CA.csr -out CA.crt -signkey CA.key 

• Create Server Certificate

   openssl genrsa -out server.key 4096 openssl req -new -key server.key -out server.csr openssl ca -in server.csr -cert CA.crt -keyfile CA.key -out server.crt 

• Create Client Certificate

   openssl genrsa -out client.key 4096 openssl req -new -key client.key -out client.csr openssl ca -in client.csr -cert CA.crt -keyfile CA.key -out client.crt 

• Configure Apache

   <VirtualHost _default_:443> SSLEngine on SSLCertificateFile "server.crt" SSLCertificateKeyFile "server.key" SSLCACertificateFile "CA.crt" <Directory "/var/www"> SSLVerifyClient optional SSLVerifyDepth 10 SSLOptions +StdEnvVars +ExportCertData </Directory> </VirtualHost> 

Now I am trying to make a test connection:

 wget \ --post-data 'id=1234' \ --certificate=client.crt \ --ca-certificate=CA.crt \ https://test.example.com:443 

The resulting wget result shows (over and over), in part:

 HTTP request sent, awaiting response... No data received. Retrying. 

Checking the SSL error log from Apache gives me the following messages:

 [debug] ssl_engine_io.c(1606): [client xx.xx.xx.xx] total of 41 bytes in buffer, eos=1 [client xx.xx.xx.xx] Requesting connection re-negotiation [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#80b075190 [mem: 80b0ca003] [debug] ssl_engine_kernel.c(771): [client xx.xx.xx.xx] Performing full renegotiation: complete handshake protocol (client does support secure renegotiation) [debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start [debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSL renegotiate ciphers [debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 write hello request A [debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 flush data [debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 write hello request C [info] [client xx.xx.xx.xx] Awaiting re-negotiation handshake [debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start [debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: before accept initialization [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#80b075190 [mem: 80b0ca003] [debug] ssl_engine_kernel.c(1929): OpenSSL: Exit: error in SSLv3 read client hello B [error] [client xx.xx.xx.xx] Re-negotiation handshake failed: Not accepted by client!? [debug] ssl_engine_io.c(1650): [client xx.xx.xx.xx] read from buffered SSL brigade, mode 0, 8192 bytes [debug] ssl_engine_io.c(1725): [client xx.xx.xx.xx] buffered SSL brigade exhausted [debug] ssl_engine_io.c(1650): [client xx.xx.xx.xx] read from buffered SSL brigade, mode 2, 0 bytes [info] [client XX:XX:XX:XX::xx] Connection to child 3 established (server register.kiosk.tain.com:443) [info] Seeding PRNG with 656 bytes of entropy [debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start [debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: before/accept initialization 

Run the openssl client to find out if there is anything to help here:

 openssl s_client \ -showcerts \ -connect test.example.com:443 \ -cert client.crt \ -key client.key \ -CAfile CA.crt 

In the answer, I see the following:

 --- Server certificate subject=/C=XX/ST=XXXXX/O=XXXX/CN=test.example.com issuer=/O=XXXX/L=XXXXX/ST=XXXXX/C=SE/CN=XXXX Certificate Authority --- No client certificate CA names sent --- SSL handshake has read 3846 bytes and written 519 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384 Server public key is 4096 bit 

"Missing client CA certificate names" is different than expected. I want to get customer certificates.

Where am I going wrong?

Answer 1

Actually, it makes no sense to talk about a "self-signed CA". Your heading ("Self-Signed Client SSL Certificates [...]") assumes that you are talking about a self-signed client certificate. You are not: you are talking about client certificates issued by your own certification authority.

You have placed your SSLVerifyClient directive in the Directory section, which would mean re-negotiation in order to get the client certificate as soon as the client makes a request trying to access this directory.

Since there is no DocumentRoot directive in your configuration, it does not figure out whether the request to / try to access this directory (this may depend on the compilation options depending on how it was packaged, but /var/www isn’t default otherwise).

Entering SSLVerifyClient directly on your virtual host should at least make openssl s_client request a client certificate. Committing a DocumentRoot might not be enough, since you will need to force the HTTP request to initiate a reconnection.