2

I was using Debian Wheezy with Apache and I configured some paths in SSL to be protected by client certificate.

   <Location /admin-page>
     SSLCACertificateFile    /etc/apache2/ssl/leos.pem
     SSLVerifyClient require
     SSLVerifyDepth  0
     SSLRenegBufferSize 10486000
   </Location>

Since I upgraded to Jessie I cannot start Apache2 unless I comment out this part.

Mar 20 16:38:07 apache2[1649]: AH00526: Syntax error on line 51 of /etc/apache2/sites-enabled/default-ssl.conf:
Mar 20 16:38:07 apache2[1649]: Your SSL library does not have support for per-directory CA

How can I get it back working?

Improve this question
5
  • Please try googling for the exact phrase "Your SSL library does not have support for per-directory CA" -- yes, use double quotes when entering it into Google: that's the standard way to make it search for the given text verbatim.
    – kostix
    Mar 20, 2016 at 17:01
  • This setup has no chance of working with any version of any SSL library. The problem is that at the time SSL/TLS handshake happens, the server has no knowledge about the details of the HTTP request the client is about to make: simply because the HTTP exchange will be performed after the handshake -- through the tunnel established using SSL/TLS.
    – kostix
    Mar 20, 2016 at 17:04
  • Since TLSv1, there exists an extension called SNI -- Server Name Identification -- which allows the client to communicate which hostname (Server Name) it wishes to access with its request during the handshake, before the server presents the user its certificate. Using it allows having different certificates for different name-based virtual hosts (which are bound to hostnames) but still it's not possible to use for locations because those exist only in HTTP layer.
    – kostix
    Mar 20, 2016 at 17:05
  • TL;DR Your setup did never work; Apache just was made announce this loudly and fail if it detects such a setup which has no chance of working correctly.
    – kostix
    Mar 20, 2016 at 17:06
  • I googled in the morning. It worked until today. I had to present my certificate in chrome when I accessed that URL.
    – Leos Literak
    Mar 20, 2016 at 18:17

1 Answer 1

Reset to default
3

You need to move the line "SSLCACertificateFile /etc/apache2/ssl/leos.pem" outside the Location stanza (put it alongside your SSLCertificateFile file). If you already have an SSLCACertificateFile - for example used for SSL certificates from an external company - and want to add a self-signed CA for client side authentication, simply add your CA certificate to that file (a single .crt file can - and often does - have multiple certificates).

You can still only force verification for the directories you want to protect.though, with a Location stanza like:

<LocationMatch "^/(admin|internal)($|/)">
          SSLVerifyClient require
           SSLVerifyDepth 1
           SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
           and %{SSL_CLIENT_I_DN_O} in {"CompanyName} \
           and %{SSL_CLIENT_S_DN_OU} in {"OU1","OU2"} )
</LocationMatch>

I see no reason why this would not work with Location rather then location match, but I've not tried that. I use location match because I've implemented it on the proxy.

You can also get rid of / change the SSL_CLIENT_* lines to match your certificate. In one place I work we have different types of certificates for different people, with different permissions - identifying the Organisation Unit, along with appropriate certs allows different groups different permissions - which translates to access to different locations.

I note that the same VM Container is used by end users without a cert - of-course they can't access the parts with "SSLVerifyClient require".

Improve this answer
1
  • I moved SSLCACertificateFile line before Location and it works.
    – Leos Literak
    Mar 26, 2016 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .