httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Colpaert, Robert" <robert.colpa...@logica.com>
Subject [users@httpd] Apache SSL Client authentication for BEA Weblogic Client
Date Tue, 01 Feb 2011 14:25:28 GMT
Hi everybody,

I am currently configuring client authentication using SSL and ldap on our apache server.
I'm sorry to say we have a pretty old apache version, but unfortunately we will not be able
to upgrade this in the near future.

Apache version: 2.2.3

Our server hosts a website that is protected with ssl/https and uses the path <domain>/emp/.
This server also provides an access point to several webservices which can be accessed through:
<domain>/b2b/batch/

Configuration:

1.    We have a self signed server certificate which is used for encrypting the connection
and it is configured as follows:
# Our server certificate and key
SSLCertificateFile /u01/env/SIT01/ssl/certs/server.crt
SSLCertificateKeyFile /u01/env/SIT01/ssl/private/server.key

# Server certificate CA chain; Side effect: client certificates from these CA's will also
be accepted
SSLCertificateChainFile /u01/env/SIT01/ssl/ca/cachain.crt

# Enable SSLv3 and TLSv1, but not SSLv2
SSLProtocol all -SSLv2

SSLEngine on
SSLProxyEngine on

2.    We want to enable client authentication only if the url matches <domain>/b2b/batch.
This part is only used for authenticating a user since we do not encrypt the responses using
the client's public key. We configured this part as described below:
<Location /b2b/batch/>
    SSLCACertificateFile /u01/env/SIT01/ssl/ca/cachain.crt
    SSLVerifyClient require
    SSLVerifyDepth 2
    SSLOptions +FakeBasicAuth +StrictRequire
    RequestHeader set Channel "B2B"

    # LDAP Authentication
    AuthName AuthLDAP
    AuthType Basic
    AuthBasicProvider ldap
    AuthzLDAPAuthoritative off
    AuthLDAPUrl "ldap://server1:2031/dc=cmp,dc=nl?userIdExtended"
    AuthLDAPBindDN "xxxx"
    AuthLDAPBindPassword "xxxxx"
    require valid-user

    ProxyPass  http:// server1:2050/
    ProxyPassReverse http:// server1:2050/
</Location>

We have tested the above settings using soapUI and cUrl and both allowed us to successfully
send and receive a request from the webservice behind /b2b/batch.
However, for some reason, we cannot successfully connect to the same webservice using the
BEA client. Even more strange is the fact that it DOES work when we copy the client authentication
part from the <location> directive into the global part of the httpd.conf:

Configuration (working, but not workable):
# Our server certificate and key
SSLCertificateFile /u01/env/SIT01/ssl/certs/server.crt
SSLCertificateKeyFile /u01/env/SIT01/ssl/private/server.key

# Server certificate CA chain; Side effect: client certificates from these CA's will also
be accepted
SSLCertificateChainFile /u01/env/SIT01/ssl/ca/cachain.crt

# Client certificate CA chain
SSLCACertificateFile /u01/env/SIT01/ssl/ca/cachain.crt
SSLVerifyClient require
SSLVerifyDepth 2

# Enable SSLv3 and TLSv1, but not SSLv2
SSLProtocol all -SSLv2

SSLEngine on
SSLProxyEngine on

<Location /b2b/batch/>
    SSLCACertificateFile /u01/env/SIT01/ssl/ca/cachain.crt
    SSLVerifyClient require
    SSLVerifyDepth 2
    SSLOptions +FakeBasicAuth +StrictRequire
    RequestHeader set Channel "B2B"

    # LDAP Authentication
    AuthName AuthLDAP
    AuthType Basic
    AuthBasicProvider ldap
    AuthzLDAPAuthoritative off
    AuthLDAPUrl "ldap://server1:2031/dc=cmp,dc=nl?userIdExtended"
    AuthLDAPBindDN "xxxx"
    AuthLDAPBindPassword "xxxxx"
    require valid-user

    ProxyPass  http:// server1:2050/
    ProxyPassReverse http:// server1:2050/
</Location>

In this case cUrl/soapUI still work and now the BEA WebLogic works also! Though these settings
seem to be working for BEA, these settings also force anyone who tries to access the website,
MUST provide a client certificate and that should not be the case.

We have tried many different settings such as setting the SSLVerifyClient to none/optional
on a global level, experimented with the SSLVerifyDepth and such, but this did not help.

This has become quite an issue and if anyone has any suggestions or if our configuration does
not do what we think it should do... any help would be greatly appreciated!

SSL log (fail):
[Mon Jan 31 17:56:11 2011] [info] Requesting connection re-negotiation
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(616): Performing full renegotiation:
complete handshake protocol
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1752): OpenSSL: Handshake: start
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSL renegotiate
ciphers
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write hello
request A
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 flush data
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write hello
request C
[Mon Jan 31 17:56:11 2011] [info] Awaiting re-negotiation handshake
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1752): OpenSSL: Handshake: start
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: before accept
initialization
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1775): OpenSSL: read 5/5 bytes from BIO#5555757c6df0
[mem: 5555757f3560] (BIO dump follows)
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1722): +-------------------------------------------------------------------------+
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1747): | 0000: 80 9b 62 0d aa         
                         ..b..            |
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1753): +-------------------------------------------------------------------------+
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_kernel.c(1789): OpenSSL: Exit: error in SSLv3
read client hello B
[Mon Jan 31 17:56:11 2011] [error] Re-negotiation handshake failed: Not accepted by client!?
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1561): [client xxx.xxx.xxx.xxx] read from
buffered SSL brigade, mode 0, 8192 bytes
[Mon Jan 31 17:56:11 2011] [debug] ssl_engine_io.c(1623): [client xxx.xxx.xxx.xxx] buffered
SSL brigade now exhausted; removing filter
[Mon Jan 31 17:56:11 2011] [info] [client xxx.xxx.xxx.xxx] Connection to child 4 established
(server <our_domain>:443)


Regards,

Robert Colpaert


Think green - keep it on the screen.

This e-mail and any attachment is for authorised use by the intended recipient(s) only. It
may contain proprietary material, confidential information and/or be subject to legal privilege.
It should not be copied, disclosed to, retained or used by, any other party. If you are not
an intended recipient then please promptly delete this e-mail and any attachment and all copies
and inform the sender. Thank you.


Mime
View raw message