3

I had implement a mutual certificate authentication and it worked successfully for following steps :

  1. create root ca (self-signed)
  2. create server certificate and sign it with ca private key
  3. create users certificates and sign them with ca private key
  4. import server.crt as "authority" to browser and user.crt as "your certificates"

  5. configure ssl.conf to add those lines :

    SSLCertificateKeyFile /home/safaa/rootca/certs/server.key SSLCertificateFile /home/safaa/rootca/certs/server.crt SSLCACertificateFile /home/safaa/rootca/certs/rootca.crt SSLVerifyDepth 10 SSLVerifyClient require

now I've added an Intermediate certificate to my flowchart and steps have became :

  1. create root CA (self-signed)
  2. create server CA and sign it with CA private key
  3. create server certificate and sign it with server CA private key
  4. create users certificates and sign them with server CA private key
  5. import server.crt as "authority" to browser and user.crt as "your certificates"

  6. configure ssl.conf to add those lines :

    SSLCertificateKeyFile /home/safaa/serverCA/certs/server.key SSLCertificateFile /home/safaa/serverCA/certs/server.crt SSLCACertificateFile /home/safaa/serverCA/certs/serverCA.crt SSLVerifyDepth 10 SSLVerifyClient require

now when I'm trying to restart httpd service : service httpd restart I'm getting 

#sudo service httpd start Starting httpd: [FAILED] #sudo service httpd status httpd is stopped

I have tried to comment & uncomment lines but I had failed to make it work 

SSLCertificateChainFile /home/safaa/rootca/certs/rootca.crt SSLCACertificateFile /home/safaa/serverCA/certs/serverCA.crt

also , every certificate I had generated I did a verification and all of them five me that verify is OK , I also changed owner and permissions for folders of rootca && serverCA and make them the same for ssl.conf p.s : I'm running my bash for php .

what have I missed ? someone had told me that I can use trusted repository in Linux instead of configuring ssl , is that possible ? where to add my ca to Linux to make it see it as verisign !?

Improve this question

1 Answer 1

Reset to default
0

Answering old question because this came up as a suggestion when searching for another answer:

In general, you shouldn't need to add a server certificate to a browser unless it is self-signed. That is the entire purpose of a trust chain. Going through the trouble of creating an intermediate CA is kind of pointless if you aren't using the root as a trust anchor anywhere.

I also don't think you're fully understanding the use or effects of the directives. I suggest reviewing them in the Apache Documentation here. I think what you may be looking for first is SSLCACertificateFile

As for my initial comment, per the docs, SSLCertificateFile should also load intermediate certs from the same file (simply append the intermediate and (optionally?) root certificates to server.crt). This should allow you to import the root CA's certificate to your browser as a trusted CA rather than the individual server cert(s).

See also: this answer for additional discussion of mutual authentication.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.