我自己的CA与Apache签发的客户端证书
问题描述:
试图使用来自自签名CA的客户端证书来获取HTTPS会话。连接应检查所有证书是否有效,包括客户端和服务器端。我自己的CA与Apache签发的客户端证书
我跟着这个过程全面如下:
-
创建的证书颁发机构
openssl genrsa -out CA.key 4096 openssl req -new -key CA.key -out CA.csr openssl x509 -req -days 365 -in CA.csr -out CA.crt -signkey CA.key
-
创建服务器证书
openssl genrsa -out server.key 4096 openssl req -new -key server.key -out server.csr openssl ca -in server.csr -cert CA.crt -keyfile CA.key -out server.crt
-
创建客户端证书
openssl genrsa -out client.key 4096 openssl req -new -key client.key -out client.csr openssl ca -in client.csr -cert CA.crt -keyfile CA.key -out client.crt
-
配置Apache
<VirtualHost _default_:443> SSLEngine on SSLCertificateFile "server.crt" SSLCertificateKeyFile "server.key" SSLCACertificateFile "CA.crt" <Directory "/var/www"> SSLVerifyClient optional SSLVerifyDepth 10 SSLOptions +StdEnvVars +ExportCertData </Directory> </VirtualHost>
现在,我尝试做一个测试连接:
wget \
--post-data 'id=1234' \
--certificate=client.crt \
--ca-certificate=CA.crt \
https://test.example.com:443
所得到的来自wget的显示输出(一遍又一遍),部分:
HTTP request sent, awaiting response... No data received.
Retrying.
检查Apache的SSL错误日志给我下面的消息:
[debug] ssl_engine_io.c(1606): [client xx.xx.xx.xx] total of 41 bytes in buffer, eos=1
[client xx.xx.xx.xx] Requesting connection re-negotiation
[debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#80b075190 [mem: 80b0ca003]
[debug] ssl_engine_kernel.c(771): [client xx.xx.xx.xx] Performing full renegotiation: complete handshake protocol (client does support secure renegotiation)
[debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSL renegotiate ciphers
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 write hello request A
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 flush data
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: SSLv3 write hello request C
[info] [client xx.xx.xx.xx] Awaiting re-negotiation handshake
[debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: before accept initialization
[debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#80b075190 [mem: 80b0ca003]
[debug] ssl_engine_kernel.c(1929): OpenSSL: Exit: error in SSLv3 read client hello B
[error] [client xx.xx.xx.xx] Re-negotiation handshake failed: Not accepted by client!?
[debug] ssl_engine_io.c(1650): [client xx.xx.xx.xx] read from buffered SSL brigade, mode 0, 8192 bytes
[debug] ssl_engine_io.c(1725): [client xx.xx.xx.xx] buffered SSL brigade exhausted
[debug] ssl_engine_io.c(1650): [client xx.xx.xx.xx] read from buffered SSL brigade, mode 2, 0 bytes
[info] [client XX:XX:XX:XX::xx] Connection to child 3 established (server register.kiosk.tain.com:443)
[info] Seeding PRNG with 656 bytes of entropy
[debug] ssl_engine_kernel.c(1892): OpenSSL: Handshake: start
[debug] ssl_engine_kernel.c(1900): OpenSSL: Loop: before/accept initialization
运行OpenSSL的客户,看看是否有任何事情来帮助在这里:
openssl s_client \
-showcerts \
-connect test.example.com:443 \
-cert client.crt \
-key client.key \
-CAfile CA.crt
在我看到下面的回复:
---
Server certificate
subject=/C=XX/ST=XXXXX/O=XXXX/CN=test.example.com
issuer=/O=XXXX/L=XXXXX/ST=XXXXX/C=SE/CN=XXXX Certificate Authority
---
No client certificate CA names sent
---
SSL handshake has read 3846 bytes and written 519 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
“没有客户端证书CA名称发送”看起来不同于我所期待的。我想要客户端证书。
我哪里错了?
答
谈论“自签名的CA”并没有什么意义。您的标题(“自签名客户端SSL证书”)表明您正在谈论自签名客户端证书。您不是:您正在谈论您自己的CA颁发的客户端证书。
您已将SSLVerifyClient
指令置于Directory
部分,这意味着一旦客户端发出请求尝试访问该目录,就会重新协商以获取客户端证书。
由于没有DocumentRoot
指令,在您的配置,目前还不清楚在/
请求是否会尝试访问该目录(这可能取决于编译选项依赖于它是如何打包,但/var/www
不是默认值除此以外)。
将SSLVerifyClient
直接放入您的虚拟主机应至少让openssl s_client
看到一个客户端证书请求。修正DocumentRoot
可能还不够,因为您需要使HTTP请求触发重新协商。
可能在ServerFault上更好。 – Bruno