[Mod_nss-list] Problem configuring Client certificate Authentication

[Luis Neves]

Hi Tomas,

Its missing something on your post, like the first location, etc, but anyway, is when using the "location" tag that is giving the problem? I dont use it but will make a test to see what happens here

Luis



Date: Mon, 30 Aug 2010 14:24:00 +0200
From: ttormo at indenova.com
To: mod_nss-list at redhat.com
Subject: [Mod_nss-list] Problem configuring Client certificate Authentication










Greetings



I'm trying to configure mod_nss in Apache in order to use it as my
client certificate authentication mechanism, but I'm having problems
with it..



I'd like to use client authentication in some parts of a website... so
I tried to do it as with mod_ssl, using the Location directive with the
NSSVerifyClient require directive inside, but I never works... I always
get this error...



Mon Aug 30 14:17:34 2010] [info] Requesting connection re-negotiation

[Mon Aug 30 14:17:34 2010] [debug] nss_engine_kernel.c(404): Performing
full renegotiation: complete handshake protocol

[Mon Aug 30 14:17:34 2010] [debug] nss_engine_kernel.c(426): Awaiting
re-negotiation handshake

[Mon Aug 30 14:17:34 2010] [info] Read error -12176

[Mon Aug 30 14:17:34 2010] [error] Re-negotiation handshake failed: Not
accepted by client!?

[Mon Aug 30 14:17:34 2010] [debug] mod_deflate.c(615): [client
192.168.125.53] Zlib: Compressed 283 to 216 : URL /files, referer:
https://amsterdam/

[Mon Aug 30 14:17:34 2010] [info] (70014)End of file found: SSL input
filter read failed.

[Mon Aug 30 14:17:34 2010] [info] Connection to child 69 closed (server
amsterdam:443, client 192.168.125.53)



After this, I checked the documentation and it says I can work
per-server or per-directory context... So I tried to do it per-server
and It works perfectly.. but, as I told you, this is not the solution
I'm looking for.. so I tried to configure it per-directory... but it
doesn't work neither...



Here I attach my per-directory configuration... Is just a test but this
is more or less how it should look at the end:







<VirtualHost *:443>



    ServerName amsterdam



    LogLevel debug

    ErrorLog /var/log/apache2/testmodnss/error.log

    CustomLog /var/log/apache2/testmodnss/access.log combined

    DocumentRoot /var/www/testmodnss



    # ssl

    NSSEngine on

    RewriteEngine on

NSSCipherSuite
-des,-desede3,-rc2,-rc2export,-rc4,-rc4export,+rsa_3des_sha,+rsa_des_56_sha,+rsa_des_sha,+rsa_null_md5,+rsa_null_sha,+rsa_rc2_40_md5,+rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_rc4_40_md5,+rsa_rc4_56_sha,+fortezza,+fortezza_rc4_128_sha,+fortezza_null,+fips_des_sha,+fips_3des_sha,+rsa_aes_128_sha,+rsa_aes_256_sha



  NSSProtocol All



## Certificate database. It contains both public and private key of the
ssl server. It also contains the CA certificate of the allowed client
certificates

NSSCertificateDatabase /etc/apache2/certs/nss/



NSSNickName Server-Cert





# ssl client



    <Directive "/var/www/testmodnss/files/">



        AllowOverride all

        NSSVerifyClient require

        NSSOptions +ExportCertData

        NSSOptions +StdEnvVars



    </Location>



</VirtualHost>



NSSPassPhraseHelper /usr/sbin/nss_pcache







Could you please help me?



Thank you very much





-- 
Un saludo,

Tomás Tormo Franco
Area de sistemas

INDENOVA S.L.
C/ Dels Traginers 14, 2º B
Polígono Vara de Quart
46014 Valencia
Tel. (34) 96 381 99 47
Fax. (34) 96 381 99 48

ttormo at indenova.com
http://www.indenova.com

Descárguese gratuitamente el software eSigna Viewer para visualizar documentos firmados electrónicamente: http://www.indenova.com/eSignaViewer.php




_______________________________________________
Mod_nss-list mailing list
Mod_nss-list at redhat.com
https://www.redhat.com/mailman/listinfo/mod_nss-list 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/mod_nss-list/attachments/20100831/66cf9e10/attachment.htm>