Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of plot.lost@gmail.com
 designates 209.85.216.45 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:content-type;
        b=EE7VAMfd4yM0jd7NtjZlOtllTI4TIw71d50jU7iCQT5sE0kUkOrIZJ3EITiIV/Pnln
         HmgW5NaX3F/hkC0TiJdJ3PBGQaJkfdkGlmMygyCp3KSyx0gAe+EHHwgTIN8ewgOBe0NH
         XfJuvIP62QBCd270Op9ZFIbyfAgAlDJINloTA=
MIME-Version: 1.0
Date: Wed, 17 Nov 2010 08:12:03 +0400
Message-ID: <AANLkTimUoiiE0=u6vxL5N2K3hvA_qs-Xt86bedVbZZAN@mail.gmail.com>
From: Plot Lost <plot.lost@gmail.com>
To: users@httpd.apache.org
Content-Type: multipart/alternative; boundary=0016e650a4f227ca34049537e053
Subject: [users@httpd] SSL client certificates

--0016e650a4f227ca34049537e053
Content-Type: text/plain; charset=ISO-8859-1

I'm using client certificates to control access to specific sections of a
site.

The relevant parts of the config include:

SSLVerifyClient none
SSLCACertificateFile "/home/apache/certs/client_ca.crt"
in the main part of the ssl config, and then

SSLVerifyClient require
SSLVerifyDepth 1

in the location section that covers that part of the site that certificates
are needed for


This appears to be working, but I am getting an unwanted entries in the
error log.

For example, when connecting from Chrome I get:

[Wed Nov 17 03:54:17 2010] [error] [client x.x.x.x] Re-negotiation handshake
failed: Not accepted by client!?

When connecting from IE I get:

[Wed Nov 17 03:51:57 2010] [error] [client x.x.x.x] Re-negotiation handshake
failed: Not accepted by client!?
[Wed Nov 17 03:52:05 2010] [error] [client x.x.x.x] insecure SSL
re-negotiation required, but a pipelined request is present; keepalive
disabled

Is there anything I can do to stop these happening? The connections do seem
to be working in that when you go to the relevant URL the browers to prompt
for a certificate selection, and once that is done they are able to browser
the site.

If there is nothing that can stop these errors, is there something that can
be done to stop them from being logged - would rather not have the error log
filling up with something that does actaully seem to be working.

This is using Apache 2.2.15 and OpenSSL 0.9.8l

--0016e650a4f227ca34049537e053
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>I&#39;m using client certificates to control access t=
o specific sections of a site.</div>
<div>=A0</div>
<div>The relevant parts of the config include:</div>
<div>=A0</div>
<div>SSLVerifyClient none<br>SSLCACertificateFile &quot;/home/apache/certs/=
client_ca.crt&quot;<br></div>
<div>in the main part of the ssl config, and then</div>
<div>=A0</div>
<div>SSLVerifyClient require<br>SSLVerifyDepth 1</div>
<div>=A0</div>
<div>in the location section that covers that part of the site that certifi=
cates are needed for</div>
<div>=A0</div>
<div>=A0</div>
<div>This appears to be working, but I am getting an unwanted entries in th=
e error log.</div>
<div>=A0</div>
<div>For example, when connecting from Chrome I get:</div>
<div><br>[Wed Nov 17 03:54:17 2010] [error] [client x.x.x.x] Re-negotiation=
 handshake failed: Not accepted by client!?</div>
<div>=A0</div>
<div>When connecting from IE I get:</div>
<div>=A0</div>
<div>[Wed Nov 17 03:51:57 2010] [error] [client x.x.x.x] Re-negotiation han=
dshake failed: Not accepted by client!?<br>[Wed Nov 17 03:52:05 2010] [erro=
r] [client x.x.x.x] insecure SSL re-negotiation required, but a pipelined r=
equest is present; keepalive disabled</div>

<div>=A0</div>
<div>Is there anything I can do to stop these happening? The connections do=
 seem to be working in that when you go to the relevant URL the browers to =
prompt for a certificate selection, and once that is done they are able to =
browser the site.</div>

<div>=A0</div>
<div>If there is nothing that can stop these errors, is there something tha=
t can be done to stop them from being logged - would rather not have the er=
ror log filling up with something that does actaully seem to be working.</d=
iv>

<div>=A0</div>
<div>This is using Apache 2.2.15 and OpenSSL 0.9.8l</div>
<div>=A0</div></div>

--0016e650a4f227ca34049537e053--