Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <CADhqnFoALTbJ_FOWs3_bAaX9oqGQmW76W8uugTuwUsUHkz-D-w@mail.gmail.com>
References: <CADhqnFoALTbJ_FOWs3_bAaX9oqGQmW76W8uugTuwUsUHkz-D-w@mail.gmail.com>
From: Felipe Pereira <felmasper@gmail.com>
Date: Sun, 25 Jun 2017 20:20:08 -0300
Message-ID: <CADhqnFqWEmhKhEcrEBzir4PcWZSKxLgwXozCdty17EJS44NJwQ@mail.gmail.com>
To: "users@httpd.apache.org" <users@httpd.apache.org>
Content-Type: multipart/alternative; boundary="001a1144a0608237b50552d1145d"
Subject: [users@httpd] Re: Access control by root CA of the client certificate
archived-at: Sun, 25 Jun 2017 23:20:34 -0000

--001a1144a0608237b50552d1145d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

=E2=80=8BL
ast
=E2=80=8Bmessage

=E2=80=8BI
 sent
=E2=80=8Bhad
 formatting, I'm sorry.

Hi,
In our reverse proxy, we have a virtual host serving more than one Location=
.

Both locations require client certificate. SSLCACertificateFile includes
all root CAs trusted by both locations.

So, in Location2 I would like to allow access only to certificates where
the chain is:

CLIENT_CERT
\_ INTERMEDIATE_CERT (Issuer)
        \_ ROOT_CA (issuer's Issuer)  <-- can I access this with SSLRequire=
?

QUESTION: is there a way to control access by the root CA that is on top of
the chain?

I tried SSLRequire but it seems I can't access the root cert, only the
client cert and the intermediate (issuer) using SSL_CLIENT_I_DN.

I tried to use CustomLog and show %{SSL_CLIENT_CHAIN_1} and _2 but only the
intermediate is logged in _1, nothing is logged in _2.

It seems the only way to do this is splitting location2 to another virtual
host where I trust only the required root CA using SSLCACertificateFe would
prefer to avoid that, we don't want to change the web service endpoint
(both locations are web services).

Here's what I was trying:

<VirtualHost ws.my.domain>
  SSLCACertificateFile bundle.crt
    VerifyClient require
    SSLVerifyDepth 3
  <Location /location1>
...
  </Location>
  <Location /location2>
     VerfiyClient require
     SSLRequire %{SSL_CLIENT_CERT_CHAIN_1} =3D=3D file("root1.pem")
...
  </Location>
</VirtualHost>

=E2=80=8BI appreciate=E2=80=8B
 any help,
Felipe

--001a1144a0608237b50552d1145d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><span style=3D"font-family:arial,helvetica,sans-serif=
"><div class=3D"gmail_default" style=3D"font-family:arial,helvetica,sans-se=
rif;font-size:small;display:inline">=E2=80=8BL</div>ast <div class=3D"gmail=
_default" style=3D"font-family:arial,helvetica,sans-serif;font-size:small;d=
isplay:inline">=E2=80=8Bmessage</div>=C2=A0<div class=3D"gmail_default" sty=
le=3D"font-family:arial,helvetica,sans-serif;font-size:small;display:inline=
">=E2=80=8BI</div>=C2=A0sent <div class=3D"gmail_default" style=3D"font-fam=
ily:arial,helvetica,sans-serif;font-size:small;display:inline">=E2=80=8Bhad=
</div>=C2=A0formatting, I&#39;m sorry.</span><br></div><div><span style=3D"=
font-family:arial,helvetica,sans-serif"><br></span></div>Hi,<div>In our rev=
erse proxy, we have a virtual host serving more than one Location.<br><br>B=
oth locations require client certificate. SSLCACertificateFile includes all=
 root CAs trusted by both locations.<br><br>So, in Location2 I would like t=
o allow access only to certificates where the chain is: <br><br>CLIENT_CERT=
 <br>\_ INTERMEDIATE_CERT (Issuer) <br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 \_ ROOT_=
CA (issuer&#39;s Issuer) =C2=A0&lt;-- can I access this with SSLRequire?<br=
><br>QUESTION: is there a way to control access by the root CA that is on t=
op of the chain? <br><br>I tried SSLRequire but it seems I can&#39;t access=
 the root cert, only the client cert and the intermediate (issuer) using SS=
L_CLIENT_I_DN.<br><br>I tried to use CustomLog and show %{SSL_CLIENT_CHAIN_=
1} and _2 but only the intermediate is logged in _1, nothing is logged in _=
2.<br><br>It seems the only way to do this is splitting location2 to anothe=
r virtual host where I trust only the required root CA using SSLCACertifica=
teFe would prefer to avoid that, we don&#39;t want to change the web servic=
e endpoint (both locations are web services).<br><br>Here&#39;s what I was =
trying:<br><br>&lt;VirtualHost ws.my.domain&gt;<br>=C2=A0 SSLCACertificateF=
ile bundle.crt<br>=C2=A0 =C2=A0 VerifyClient require<br>=C2=A0 =C2=A0 SSLVe=
rifyDepth 3<br>=C2=A0 &lt;Location /location1&gt;<br>...<br>=C2=A0 &lt;/Loc=
ation&gt;<br>=C2=A0 &lt;Location /location2&gt;<br>=C2=A0 =C2=A0 =C2=A0Verf=
iyClient require<br>=C2=A0 =C2=A0 =C2=A0SSLRequire %{SSL_CLIENT_CERT_CHAIN_=
1} =3D=3D file(&quot;root1.pem&quot;)<br>...<br>=C2=A0 &lt;/Location&gt;<br=
>&lt;/VirtualHost&gt;<br><br><div class=3D"gmail_default" style=3D"font-fam=
ily:arial,helvetica,sans-serif;font-size:small;display:inline">=E2=80=8BI a=
ppreciate=E2=80=8B</div>=C2=A0any help,<br>Felipe</div></div>

--001a1144a0608237b50552d1145d--