SSL Client Authentication Using Smartcards

Question

I have configured Apache to require a client certificate to access resources via SSL on port 443 using:

<VirtualHost _default_:443>

  [other stuff]

    SSLEngine on

    SSLProtocol all -SSLv2
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

    SSLCertificateFile /PATH_TO_CERTS/server.crt
    SSLCertificateKeyFile /PATH_TO_PRIVATE/server.key
    SSLCACertificateFile /PATH_TO_CERTS/ca.cer

    SSLVerifyClient require
    SSLVerifyDepth  10
    SSLOptions +StdEnvVars +ExportCertData

  [other stuff]

</VirtualHost>

When I establish a self signed CA and use it to issue a client cert to a client I have no problems, SSL client authentication is achieved.

What I really want to do, however, is require client certs that are issued by a third party trusted CA which issues said certs in the form of smartcards. So, what I did is change SSLCACertificateFile to /PATH_TO_CERTS/ca-bundle.crt, which contains a bundle of CA certs including intermediate smartcard issuing CA and its root CA. The subject and issuer values of these CA's are:

  Root CA:
    subject= /C=US/O=U.S. Government/OU=EXAMPLE DEPARTMENT/OU=Certification Authorities/OU=EXAMPLE DEPARTMENT Root CA
    issuer= /C=US/O=U.S. Government/OU=EXAMPLE DEPARTMENT/OU=Certification Authorities/OU=EXAMPLE DEPARTMENT Root CA

  Intermediate CA issuing cert:
    subject= /C=US/O=U.S. Government/OU=EXAMPLE AGENCY/OU=Certification Authorities/OU=EXAMPLE AGENCY Operational CA
    issuer= /C=US/O=U.S. Government/OU=EXAMPLE DEPARTMENT/OU=Certification Authorities/OU=EXAMPLE DEPARTMENT Root CA

I expect Apache to accept a valid smartcard cert from the client, however instead I get the following error: "Certificate Verification: Error (20): unable to get local issuer certificate".

I'm not sure what to make of this. Is it likely I am I doing something wrong or does "SSLVerifyClient require" only work with client certs issued by a locally established CA?

Any insight into this matter would be greatly appreciated.

I'm running Apache 2.2 on RHEL6.

Answer 1

Maybe you need to add this line into your Apache conf:

SSLCertificateChainFile /PATH_TO_CERSTS/intermediateCA.crt

Answer 2

This is an example of configuration for mutual authentication. it is important to run the rehash command on the certificate directory. You must ensure that you have all the certificates of the CAs that have issued the client's certificates. The certification chain must be satisfied.

If it can be useful on this repository Apache HTTP 2.4 per SmartCard TS-CNS (Tessera Sanitaria - Carta Nazionale Servizi) you will find a complete docker container.

<IfModule mod_ssl.c>
    <VirtualHost _default_:${APACHE_SSL_PORT}>
            ServerAdmin ${APACHE_SERVER_ADMIN}
            ServerName ${APACHE_SERVER_NAME}

            DocumentRoot /var/www/html

            # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
            # error, crit, alert, emerg.
            # It is also possible to configure the loglevel for particular
            # modules, e.g.

            LogLevel ${APACHE_LOG_LEVEL} ssl:${APACHE_SSL_LOG_LEVEL}

            ErrorLog ${APACHE_LOG_DIR}/${APACHE_SERVER_NAME}_error.log
            CustomLog ${APACHE_LOG_DIR}/${APACHE_SERVER_NAME}_access.log "%h %{SSL_PROTOCOL}x %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""

            #   SSL Engine Switch:
            #   Enable/Disable SSL for this virtual host.
            SSLEngine on

            #   A self-signed (snakeoil) certificate can be created by installing
            #   the ssl-cert package. See
            #   /usr/share/doc/apache2/README.Debian.gz for more info.
            #   If both key and certificate are stored in the same file, only the
            #   SSLCertificateFile directive is needed.
            SSLCertificateFile      /etc/ssl/certs/${APACHE_SSL_CERTS}
            SSLCertificateKeyFile /etc/ssl/private/${APACHE_SSL_PRIVATE}


            #   Certificate Authority (CA):
            #   Set the CA certificate verification path where to find CA
            #   certificates for client authentication or alternatively one
            #   huge file containing all of them (file must be PEM encoded)
            #   Note: Inside SSLCACertificatePath you need hash symlinks
            #                to point to the certificate files. Use the provided
            #                Makefile to update the hash symlinks after changes.
            SSLCACertificatePath /etc/ssl/certs/
            #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt

            #   Client Authentication (Type):
            #   Client certificate verification type and depth.  Types are
            #   none, optional, require and optional_no_ca.  Depth is a
            #   number which specifies how deeply to verify the certificate
            #   issuer chain before deciding the certificate is not valid.
            SSLVerifyClient require
            SSLVerifyDepth  5

            SSLUserName SSL_CLIENT_S_DN_CN

            #   SSL Engine Options:
            #   Set various options for the SSL engine.
            #   o FakeBasicAuth:
            #        Translate the client X.509 into a Basic Authorisation.  This means that
            #        the standard Auth/DBMAuth methods can be used for access control.  The
            #        user name is the `one line' version of the client's X.509 certificate.
            #        Note that no password is obtained from the user. Every entry in the user
            #        file needs this password: `xxj31ZMTZzkVA'.
            #   o ExportCertData:
            #        This exports two additional environment variables: SSL_CLIENT_CERT and
            #        SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
            #        server (always existing) and the client (only existing when client
            #        authentication is used). This can be used to import the certificates
            #        into CGI scripts.
            #   o StdEnvVars:
            #        This exports the standard SSL/TLS related `SSL_*' environment variables.
            #        Per default this exportation is switched off for performance reasons,
            #        because the extraction step is an expensive operation and is usually
            #        useless for serving static content. So one usually enables the
            #        exportation for CGI and SSI requests only.
            #   o OptRenegotiate:
            #        This enables optimized SSL connection renegotiation handling when SSL
            #        directives are used in per-directory context.
            #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
            <FilesMatch "\.(cgi|shtml|phtml|php)$">
                            SSLOptions +ExportCertData +StdEnvVars
            </FilesMatch>
            <Directory /usr/lib/cgi-bin>
                            SSLOptions +StdEnvVars
            </Directory>
    </VirtualHost>