logobossstupid

The question is very clear but I did not find any useful tutorial online. So I wish I could have some luck here.

1. Client Authentication In Ssl Email
2. Openssl Client Certificate Authentication Example

Client Authentication In Ssl Email

Configuring client certificates for mutual authentication on IIS 8. Make your website to require client certificate By clicking on SSL Settings On the SSL Settings make sure you tick the Require SSL checkbox and on the Client certificates section choose the require option to make any client connection require a certificate to the website. The SSL or TLS handshake enables the SSL or TLS client and server to establish the. Authenticate each other by exchanging and validating digital certificates.

Basically, I want to build a client certificate authentication with Apache. I configured the conf file for Apache for the site I am hosting. The conf I put is here:

However I have no idea how to generate the certificate and key file for the client. And also, what file should I put on the SSLCACertificateFile in the Apache server configurations?

Does the server simply compare the certificate file sent from client with the certificate file on the server? What exactly the client certificate authentication is doing ?

user3354832user3354832

Openssl Client Certificate Authentication Example

2 Answers

You'll find instructions on how to create a CA cert and certs signed by this CA cert here:http://pages.cs.wisc.edu/~zmiller/ca-howto/

Things go like this:

• you setup your root CA key and cert
• client generates his private key and certificate request
• they send you the certificate request
• you generate the certificate using the certificate request, your root CA cert and root CA key
• you return the certificate to the client

You can then check that the client presents a certificate which is 'signed' by the CA.

jcaronjcaron

It is important to understand SSLVerifyClient and the other directives.From Practical Issues with TLS Client CertificateAuthentication (page 3):

The default value none of SSLVerifyClient does not require CCA; therefore the server will not include a CertificateRequest message in the TLS handshake.

The value require will require CCA, and thus the CertificateRequest message will be included in the handshake. If the client does not provide any certificate in the client’s Certificate message or mod_ssl fails to verify the certificate provided, the TLS handshake will be aborted and a fatal TLS alert message will be sent to the client.

The value optional is the same as require, but an empty client’s Certificate message will be tolerated.

The last possible value optional_no_ca is the same as optional, but in addition it allows a client’s certificate to be submitted that does not chain up to the CA trusted by the server (because of a bug in OpenSSL [6] not yet valid or expired non-self-signed client certificates will also be accepted).

The value optional_no_ca can be used to perform certificate verification at an application level or to implement PKI-less public-key authentication that uses X.509 certificates as a public-key transport.

mwfearnley

Not the answer you're looking for? Browse other questions tagged apacheauthenticationsslcertificate or ask your own question.

For excessively paranoid client authentication.

Updated Apr 5 2019:

because this is a gist from 2011 that people stumble into and maybe you should AES instead of 3DES in the year of our lord 2019.

some other notes:

I've noticed that across platforms, some browsers/devices like like PFX bundles, others like PEMs, some things will import ECC certs just fine but fail to list them in the 'select certificate' menu when the server wants it. Server-side stuff seems good, with most things supporting ECC, but clients are a crapshoot. I'd say unless you've got some time to experiment, you may want to stick to RSA.

(In my own dev servers i just ended up configuring both an RSA CA and an ECC CA and using them both on the server, and provisioning one of each type for each client and trying them both. if, like nginx, your server only lets you use one CA cert root, you can concatenate multiple CA PEMs together and then use that combined file.)

Using self-signed certificate.

Create a Certificate Authority root

This'll represent you / your org / your server -- basically the thing that vouches for the validity of a key.

Create the Client Key and CSR

Bundle the private key & cert for end-user client use

basically https://www.digicert.com/ssl-support/pem-ssl-creation.htm , with the entire trust chain

Bundle client key into a PFX file

Most browsers will happily use this if they don't like the raw ascii PEM file. You'll possibly need to set a password here, which you'll need on the browser/client end when you import the key+cert PFX bundle.

Install Client Key on client device (OS or browser)

Use client.full.pfx (most commonly accepted in GUI apps) and/or client.full.pem. Actual instructions vary.

Install CA cert on nginx

So that the Web server knows to ask for (and validate) a user's Client Keyagainst the internal CA certificate.

Configure nginx to pass the authentication data to the backend application:

• Client Side Certificate Auth in Nginx, section “Passing to PHP.”

See also:

• my other gist, on doing the key / CSR dance for your HTTPS server: https://gist.github.com/mtigas/6177424
• mozilla's SSL configuration generator: https://mozilla.github.io/server-side-tls/ssl-config-generator/

Using CACert Keys

(removed)