我自己的CA與Apache簽發的客戶端證書

試圖使用來自自簽名CA的客戶端證書來獲取HTTPS會話。連接應檢查所有證書是否有效，包括客戶端和服務器端。我自己的CA與Apache簽發的客戶端證書

我跟着這個過程全面如下：

創建的證書頒發機構

openssl genrsa -out CA.key 4096 
openssl req -new -key CA.key -out CA.csr 
openssl x509 -req -days 365 -in CA.csr -out CA.crt -signkey CA.key

創建服務器證書

openssl genrsa -out server.key 4096 
openssl req -new -key server.key -out server.csr 
openssl ca -in server.csr -cert CA.crt -keyfile CA.key -out server.crt

創建客戶端證書

openssl genrsa -out client.key 4096 
openssl req -new -key client.key -out client.csr 
openssl ca -in client.csr -cert CA.crt -keyfile CA.key -out client.crt

配置Apache

<VirtualHost _default_:443> 
    SSLEngine on 
    SSLCertificateFile "server.crt" 
    SSLCertificateKeyFile "server.key" 
    SSLCACertificateFile "CA.crt" 
    <Directory "/var/www"> 
     SSLVerifyClient optional 
     SSLVerifyDepth 10 
     SSLOptions +StdEnvVars +ExportCertData 
    </Directory> 
</VirtualHost>

現在，我嘗試做一個測試連接：

wget \ 
    --post-data 'id=1234' \ 
    --certificate=client.crt \ 
    --ca-certificate=CA.crt \ 
    https://test.example.com:443

所得到的來自wget的顯示輸出（一遍又一遍），部分：

HTTP request sent, awaiting response... No data received. 
Retrying.

檢查Apache的SSL錯誤日誌給我下面的消息：

[debug] ssl_engine_io.c(1606): [client xx.xx.xx.xx] total of 41 bytes in buffer, eos=1 
[client xx.xx.xx.xx] Requesting connection re-negotiation 
[debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#80b075190 [mem: 80b0ca003] 
[debug] ssl_engine_kernel.c(771): [client xx.xx.xx.xx] Performing full renegotiation: complete handshake protocol (client does support secure renegotiation) 
[debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start 
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSL renegotiate ciphers 
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 write hello request A 
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 flush data 
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 write hello request C 
[info] [client xx.xx.xx.xx] Awaiting re-negotiation handshake 
[debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start 
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: before accept initialization 
[debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#80b075190 [mem: 80b0ca003] 
[debug] ssl_engine_kernel.c(1929): OpenSSL: Exit: error in SSLv3 read client hello B 
[error] [client xx.xx.xx.xx] Re-negotiation handshake failed: Not accepted by client!? 
[debug] ssl_engine_io.c(1650): [client xx.xx.xx.xx] read from buffered SSL brigade, mode 0, 8192 bytes 
[debug] ssl_engine_io.c(1725): [client xx.xx.xx.xx] buffered SSL brigade exhausted 
[debug] ssl_engine_io.c(1650): [client xx.xx.xx.xx] read from buffered SSL brigade, mode 2, 0 bytes 
[info] [client XX:XX:XX:XX::xx] Connection to child 3 established (server register.kiosk.tain.com:443) 
[info] Seeding PRNG with 656 bytes of entropy 
[debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start 
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: before/accept initialization

運行OpenSSL的客戶，看看是否有任何事情來幫助在這裏：

openssl s_client \ 
    -showcerts \ 
    -connect test.example.com:443 \ 
    -cert client.crt \ 
    -key client.key \ 
    -CAfile CA.crt

在我看到下面的回覆：

--- 
Server certificate 
subject=/C=XX/ST=XXXXX/O=XXXX/CN=test.example.com 
issuer=/O=XXXX/L=XXXXX/ST=XXXXX/C=SE/CN=XXXX Certificate Authority 
--- 
No client certificate CA names sent 
--- 
SSL handshake has read 3846 bytes and written 519 bytes 
--- 
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384 
Server public key is 4096 bit

「沒有客戶端證書CA名稱發送」看起來不同於我所期待的。我想要客戶端證書。

我哪裏錯了？

來源

2013-10-25 user2919956

可能在ServerFault上更好。 – Bruno

談論「自簽名的CA」並沒有什麼意義。您的標題（「自簽名客戶端SSL證書」）表明您正在談論自簽名客戶端證書。您不是：您正在談論您自己的CA頒發的客戶端證書。

您已將SSLVerifyClient指令置於Directory部分，這意味着一旦客戶端發出請求嘗試訪問該目錄，就會重新協商以獲取客戶端證書。

由於沒有DocumentRoot指令，在您的配置，目前還不清楚在/請求是否會嘗試訪問該目錄（這可能取決於編譯選項依賴於它是如何打包，但/var/www不是默認值除此以外）。

將SSLVerifyClient直接放入您的虛擬主機應至少讓openssl s_client看到一個客戶端證書請求。修正DocumentRoot可能還不夠，因爲您需要使HTTP請求觸發重新協商。

來源

2013-10-25 16:55:32 Bruno

我自己的CA與Apache簽發的客戶端證書

回答

相關問題