The question is very clear but I did not find any useful tutorial online. So I wish I could have some luck here.
Basically, I want to build a client certificate authentication with Apache. I configured the conf file for Apache for the site I am hosting. The conf I put is here:
SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile /etc/apache2/ssl/client.crt
However I have no idea how to generate the certificate and key file for the client. And also, what file should I put on the SSLCACertificateFile in the Apache server configurations?
Does the server simply compare the certificate file sent from client with the certificate file on the server? What exactly the client certificate authentication is doing ?
You'll find instructions on how to create a CA cert and certs signed by this CA cert here:
http://pages.cs.wisc.edu/~zmiller/ca-howto/
Things go like this:
you setup your root CA key and cert
client generates his private key and certificate request
they send you the certificate request
you generate the certificate using the certificate request, your root CA cert and root CA key
you return the certificate to the client
You can then check that the client presents a certificate which is "signed" by the CA.
It is important to understand SSLVerifyClient and the other directives.
From Practical Issues with TLS Client Certificate
Authentication (page 3):
The default value none of SSLVerifyClient does
not require CCA; therefore the server will not include a
CertificateRequest message in the TLS handshake.
The value require will require CCA, and thus the
CertificateRequest message will be included in the
handshake. If the client does not provide any certificate in
the client’s Certificate message or mod_ssl fails to
verify the certificate provided, the TLS handshake will be
aborted and a fatal TLS alert message will be sent to the
client.
The value optional is the same as require, but
an empty client’s Certificate message will be tolerated.
The last possible value optional_no_ca is the same as
optional, but in addition it allows a client’s certificate to be
submitted that does not chain up to the CA trusted by the server
(because of a bug in OpenSSL [6] not yet valid or expired
non-self-signed client certificates will also be accepted).
The
value optional_no_ca can be used to perform certificate
verification at an application level or to implement PKI-less
public-key authentication that uses X.509 certificates as a
public-key transport.
Related
We have a K8S service leveraging NGINX and in some flows would like to accept client certificate authentication.
Service has a dynamic list of public trusted client certificates (PEM format), and the root CAs aren't known.
In NGINX, it seems like the best setting to use would be:
nginx.ingress.kubernetes.io/auth-tls-verify-client: optional_no_ca
While sending the full certificate ($ssl_client_escaped_cert) to the upstream service to compare the entire public cert.
The question is whether NGINX will still perform the client cert validations during SSL handshake (and only skips CA checks), to verify the request is indeed sent by the one and only owner of the cert and its private key.
It will still check in the TLS handshake that the public key in the certificate can be used to verify the signature in CertificateVerify, i.e. that the client actually owns the private key to the sent certificate.
It will not check that the certificate itself is issued by a trusted CA etc - such verification are expected to be done elsewhere.
I secure successfully a Nifi Node (localhost) with SSL but I have always a yellow padlock in my browser as you can see in the pic here
Do you have any idea?
Thanks
If you used an untrusted certificate then this is expected behavior. You would have to purchase a real certificate for a real domain name in order for the browser to not warn you.
I see the description below:
Standalone : generates the certificate authority, keystores, truststores, and nifi.properties files in one command
Client/Server mode : uses a Certificate Authority Server that accepts Certificate Signing Requests from clients, signs them, and sends the resulting certificates back. Both client and server validate the other’s identity through a shared secret.
Standalone and client, both generate the certificate authority, keystores, truststores.
Sorry, I don't see the difference.
We have done client certificate authentication via SSLVerifyClient require method. Now authentication is being done as required.
Now we want to store the client certificate which we is being presented by the client during SSL handshake.
Is there a way I can save the client certificate which I am getting during authentication into a directory or somewhere? I need to get the public key and CN information from the client certificate.
Apache provides the full certificates and extracted parts of it using a variety of environment variables, like SSL_CLIENT_CERT for the full certificate or SSL_CLIENT_S_DN for the subject DN. See the documentation for more details on this.
I'm reading tutorial http://www.impetus.us/~rjmooney/projects/misc/clientcertauth.html
There is a part "Install the CA Certificate on the Web Server":
<VirtualHost _default_:443>
...
SSLCACertificateFile /var/www/conf/ssl.crt/ca.crt
...
</VirtualHost>
I wonder why I have to add on www server CA certificate and not generated client or server signed by CA certificate. CA certificate looks like it is universal and widely available for everyone, so somebody could sign in CA own csr and try to login ony my server.
Regards
A client certificate is used to identify a specific client. Usually you have multiple clients and each of them got their own certificate from your CA. While you could give the server all client certificates you ever generated (I don't know if this is possible with apache), it is much easier to give the server just the CA which issued these certificates and let the server verify, that the client certificate was issued by this CA.
I'm trying to create web application with client certificates, generated programmatically. My main problem is following: I've added generated .p12 keystore to my web browser, but it doesn't send certificate to the server.
How does browser understand which x509 certificate it should use? And is it possible to debug SSL in Chrome of Firefox?
SSL/TLS server sends Certificate Request message (see RFC 4346 for TLS 1.1 or others). In this message there is only certificate type and acceptable certificate authorities names, so server doesn't tell anything about particular certificate.
The possible reason is that your certificate of invalid type (i.e. DSA instead of RSA but key exchange algorithm depends on client RSA certificate), or server requests certificate of different certificate authority.