Topic: allow only clients who have certificates to access...

[andre_nn]

How can I allow only clients who have certificates to access a particular URL?


http://httpd.apache.org/docs/2.2/ssl/ssl_howto.html
"How can I allow only clients who have certificates to access a particular URL, but allow all clients to access the rest of the server?"

I get an error:

[James Blond]

Please see http://www.impetus.us/~rjmooney/projects/misc/clientcertauth.html and http://www.modssl.org/docs/2.8/ssl_howto.html#ToC6

wasn't hard to google. My google words: apache auth certs

[andre_nn]

I did:
1) Create your own self-signed trusted certificate (ca.crt) and private key (ca.key). They will sign the server and client certificates
openssl req -new -newkey rsa:1024 -x509 -days 3650 -nodes -out ca.crt -keyout ca.key -subj /C=RU/ST=-/L=Moscow/O=Reki.ru/OU=Certificate_Issuer/CN=bugzilla.ru/emailAddress=admin@reki.ru -config "openssl.cnf"

2) Preparing configuration ca.config
[ca]
default_ca = CA_CLIENT

[CA_CLIENT]
dir = ./db
certs = $dir/certs
new_certs_dir = $dir/newcerts

database = $dir/index.txt
serial = $dir/serial
certificate = ./ca.crt
private_key = ./ca.key

default_days = 365

default_crl_days = 7
default_md = md5
policy = policy_anything

[policy_anything]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

3) Creating a private server key and request a server certificate
openssl req -new -newkey rsa:1024 -nodes -keyout server.key -out server.csr -subj /C=RU/ST=-/L=Moscow/O=Reki.ru/OU=SVN/CN=bugzilla.ru/emailAddress=svn@svn.reki.ru -config "openssl.cnf"

4) Signing the request to the server certificate using сa.crt and obtain a server certificate
openssl ca -config ca.config -in server.csr -out server.crt -batch

5) Creating a private key and client request a client certificate
openssl req -new -newkey rsa:1024 -nodes -keyout stellar.key -out stellar.csr -subj /C=RU/ST=-/L=Moscow/O=Reki.ru/OU=SVN/CN=bugzilla.ru/emailAddress=svn@svn.reki.ru -config "openssl.cnf"

6) Signing the request for a client certificate using sa.crt and get a client certificate
openssl ca -config ca.config -in stellar.csr -out stellar.crt –batch

[andre_nn]

Then editing \Program Files\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf
------------------
#SSLRandomSeed startup file:/dev/random 512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random 512
#SSLRandomSeed connect file:/dev/urandom 512


Listen 443

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl

SSLPassPhraseDialog builtin

SSLSessionCache "shmcb:C:/Program Files/Apache Software Foundation/Apache2.2/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex default

<VirtualHost 192.168.2.59:443>
DocumentRoot "c:/site/bugzilla/www"
ServerName 192.168.2.59:443
ErrorLog "c:/site/bugzilla/error.log"
TransferLog "c:/site/bugzilla/access.log"

CustomLog "c:/site/bugzilla/ssl_request.log" \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"


<Directory C:/Site/Bugzilla/www>
Options Indexes FollowSymLinks ExecCGI
AllowOverride All
Order allow,deny
Allow from all
ScriptInterpreterSource Registry-Strict


#==================================
SSLVerifyClient require
SSLOptions +FakeBasicAuth
AuthName "secret server"
AuthType Basic
AuthUserFile "C:/passwd"
Require valid-user
#==================================

</Directory>


SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

SSLCertificateFile "C:/Site/SSL/server.crt"

SSLCertificateKeyFile "C:/Site/SSL/server.key"

SSLCertificateChainFile "C:/Site/SSL/ca.key"
#SSLCACertificatePath "C:/Program Files/Apache Software Foundation/Apache2.2/conf/ssl.crt"
SSLCACertificateFile "C:/Site/SSL/ca.crt"

#SSLCARevocationPath "C:/Program Files/Apache Software Foundation/Apache2.2/conf/ssl.crl"
#SSLCARevocationFile "C:/Program Files/Apache Software Foundation/Apache2.2/conf/ssl.crl/ca-bundle.crl"

SSLVerifyClient require
SSLVerifyDepth 1

#<Location />
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#</Location>

#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire

<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>

<Directory "C:/Program Files/Apache Software Foundation/Apache2.2/cgi-bin">
SSLOptions +StdEnvVars
</Directory>

BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0


</VirtualHost>
----------------------------------------

[andre_nn]

File "C: / passwd" contains:


/C=RU/ST=-/L=Moscow/O=Reki.ru/OU=SVN/CN=bugzilla.ru/emailAddress=svn@svn.reki.ru:xxj31ZMTZzkVA
/C=RU/ST=-/L=Moscow/O=Reki.ru/OU=SVN/CN=bugzilla.ru/emailAddress=svn@svn.reki.ru:1

[andre_nn]

In the authorization window me what data type?

[andre_nn]

I pass the certificate validation and get login screen, but authentication can not pass. In the logs I receive an error:

[James Blond]

Dude, you mixed the cert auth with basic auth.

as in the first link I posted there should be

[andre_nn]

[andre_nn]

[andre_nn]

I do not want to have a solution - Authorization for client certificate authentication, or BASIC (passwd). I want to have a solution - linking client certificates to user accounts. All this is described on the official website (link in my first post), but I have some reason, this solution does not work: (

If you disable "SSLOptions FakeBasicAuth", then the authentication works. But this decision is not binding the client certificate to user account. If you disable "SSLOptions FakeBasicAuth" lost all washed away.

[andre_nn]

[James Blond]

ok... so your problem is now the password mismatch? Please try

[andre_nn]

[andre_nn]

Created password using the program http://web9.2020media.com/other/htpasswd.jsp


File "C: / passwd" contains:

[andre_nn]

It's a miracle! )))))))

The old error disappeared! )))))

A new error:
"Encountered FakeBasicAuth spoof"

Thank you!!!


We will solve the next problem?