Ssl – Apache custom error page (ssl_connection_error)

apache-2.2ssl

How to configure Apache to require client certificate based authentication on a specific direction? (httpd.conf tags)

I've successfully configured Apache to require client certificate based authentication in specific location, but I still wont get it working in specific direction.

I need to do this to make a rewrite rule for custom error page when ssl connection error occures.

Best Answer

You can't create a custom error page for "ssl connection error" because, if this happens, then there is no connection! The browser could not even send an HTTP request for the server to respond to, if SSL/TLS negotiation fails. The browser's built-in message is the only thing you will get. Fortunately, when this happens because of a missing or invalid client certificate, the browser's message will state this.

Related Solutions

Apache – Client-Side Certificates on Linux with OpenSSL

Could be that you are using client certs with the wrong key usage. Please verify that your key usage has:

Critical
Signing
Non-repudiation
Key Encipherment

If you are using extended key usage, check for

Not Critical
TLS Web Client Authentication
E-mail protection

On the server side verify that you have all the ca cert that was used to sign the client cert and the relevant pki hierarchy is set up. In a typical apache setup, this would look like:

<VirtualHost *:443>
    ServerAdmin admin@example.net                                                                                      
    DocumentRoot /var/www/
    ServerName service.example.net
    ScriptAlias /cgi-bin/ /var/www/cgi-bin/
    <Directory "/var/www/cgi-bin">
            AllowOverride None
            Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
            Order allow,deny
            Allow from all
    </Directory>

    <Directory "/var/www/">
            Options Indexes MultiViews FollowSymLinks
            AllowOverride None
    </Directory>

    SSLEngine on
    SSLOptions +StdEnvVars
    SSLCertificateFile    /usr/local/ssl/certs/Server.crt
    SSLCertificateKeyFile /usr/local/ssl/private/Server.key
    SSLCACertificateFile  /usr/local/ssl/certs/caRoot.cacert.pem
    SSLVerifyClient require
    ErrorLog logs/service.example.net-443-error_log
    LogLevel info
    CustomLog logs/service.example.net-443-access.log combined

Finally, you can try debug with good old openssl

openssl s_client -connect server.example.net:443 -CAfile ../ca/caRoot.crt -cert client-Access.crt -key client-Access.key  -showcerts

or curl

curl -kv --key client-Access.key --cert client-Access.crt --cacert ../ca/caRoot.crt  https://server.example.net/

Good luck!

Ssl – Apache ~ how to force SSL client auth for specific IP

Ok so looks like is not possible to do that on Apache < 2.3

I've updated to Apache 2.4 and just added the "if" directive:

<If "%{REMOTE_ADDR} == 'xx.xx.xx.xx">
SSLVerifyClient      require
            SSLOptions           +StrictRequire
            SSLRequire           %{SSL_CIPHER_USEKEYSIZE} >= 128
</If>

Best Answer

Related Solutions

Apache – Client-Side Certificates on Linux with OpenSSL

Ssl – Apache ~ how to force SSL client auth for specific IP

Related Topic