Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
From: "Sterpu Victor" <victor@caido.ro>
To: users@httpd.apache.org
Date: Sun, 23 Aug 2015 06:51:10 +0000
Message-Id: <em06b72b55-2d5f-4147-ac9e-082b5f7c40a7@victor-pc>
Reply-To: "Sterpu Victor" <victor@caido.ro>
User-Agent: eM_Client/6.0.21372.0
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="------=_MB52D21C19-8A60-45AC-BB39-736050B2634C"
Subject: [users@httpd] SSL - How client certificates are verified?

--------=_MB52D21C19-8A60-45AC-BB39-736050B2634C
Content-Type: text/plain; format=flowed; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hello

I have a web page that asks for client certificate.
These are the options for this:

SSLVerifyClient require
SSLVerifyDepth 10

How does SSLVerifyClient  verifies the client certificate?
This option protects against certificates manual made with a fake 
public-private key pair?
So can someoane make a certificate identical with the original, attach 
another set of public and private keys and pretend to be someoane else?

Thank you

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus


--------=_MB52D21C19-8A60-45AC-BB39-736050B2634C
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD>
<STYLE id=3DeMClientCss>BLOCKQUOTE.cite {
	PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; PADD=
ING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
BLOCKQUOTE.cite2 {
	PADDING-TOP: 0px; PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccc=
cc 1px solid; MARGIN-TOP: 3px; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
=2Eplain PRE {
	FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: =
normal
}
=2Eplain TT {
	FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: =
normal
}
A IMG {
	BORDER-TOP: 0px; BORDER-RIGHT: 0px; BORDER-BOTTOM: 0px; BORDER-LEFT: 0px
}
#x19281657d1d74368b2d0f3fdfc2113d3 {
	FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
=2Eplain PRE {
	FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
=2Eplain TT {
	FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
BODY {
	FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
</STYLE>
</HEAD>
<BODY>
<DIV>Hello</DIV>
<DIV>&nbsp;</DIV>
<DIV>I have a web page that asks for client certificate.</DIV>
<DIV>These are the options for this:</DIV>
<DIV>&nbsp;</DIV>
<DIV>SSLVerifyClient require<BR>SSLVerifyDepth 10<BR><BR>How&nbsp;does <SPA=
N id=3Dx19281657d1d74368b2d0f3fdfc2113d3>SSLVerifyClient</SPAN>&nbsp; verif=
ies the client certificate?</DIV>
<DIV>This option protects against certificates manual made with a fake publ=
ic-private key&nbsp;pair?</DIV>
<DIV>So can someoane make a&nbsp;certificate identical with the original, a=
ttach another set of public and private keys and pretend to be someoane els=
e?</DIV>
<DIV>&nbsp;</DIV>
<DIV>Thank you</DIV>
<br /><br />
<hr style=3D'border:none; color:#909090; background-color:#B0B0B0; height: =
1px; width: 99%;' />
<table style=3D'border-collapse:collapse;border:none;'>
	<tr>
		<td style=3D'border:none;padding:0px 15px 0px 8px'>
			<a href=3D"https://www.avast.com/antivirus">
				<img border=3D0 src=3D"http://static.avast.com/emails/avast-mail-stamp.=
png" alt=3D"Avast logo" />
			</a>
		</td>
		<td>
			<p style=3D'color:#3d4d5a; font-family:"Calibri","Verdana","Arial","Helv=
etica"; font-size:12pt;'>
				This email has been checked for viruses by Avast antivirus software.
				<br><a href=3D"https://www.avast.com/antivirus">www.avast.com</a>
			</p>
		</td>
	</tr>
</table>
<br />

<br>=
<html><body><p><font FACE=3DARIAL size=3D1 color=3DDARKGREEN><I><B>DISCLAIMER</B>: <BR>Acest mesaj de posta electronica si documentele aferente sunt confidentiale. Este interzisa distribuirea, dezvaluirea sau orice alt mod de utilizare a lor. Daca nu sunteti destinatarul acestui mesaj, este interzis sa actionati in baza acestor informatii. Citirea, copierea, distribuirea, dezvaluirea sau utilizarea in alt mod a informatiei continute in acest mesaj constituie o incalcare a legii. Daca ati primit mesajul din greseala, va rugam sa il distrugeti, anuntand expeditorul de eroarea comisa. Intrucat nu poate fi garantat faptul ca posta electronica este un mod sigur si lipsit de erori de transmitere a informatiilor, este responsabilitatea dvs. sa va asigurati ca mesajul (inclusiv documentele alaturate lui) este validat si autorizat spre a fi utilizat in mediul dvs.</I></font></p></body></html>
<br>=
</BODY></HTML>
--------=_MB52D21C19-8A60-45AC-BB39-736050B2634C--