On Fri, Sep 18, 1998, Stefan Livieratos wrote:
> I've installed a VerSign Trial-Certificate on
> my Netscape Navigator and tried to connect with
> my test site whith Apache_1.3.1 + mod_ssl
> (Directive SSLVerifyClient optional). Unfortunately
> the browser can't connect to the secure server stating:
> "The server cannot verify the certificate".
> Here's what Apache+mod_ssl writes in the ssl_misc_log:
>
> [18/Sep/1998:20:43:54 -0100] Verify error:num=19:self signed certificate in
> certificate chain
> [18/Sep/1998:20:43:54 -0100] Verify depth exceeded
> [18/Sep/1998:20:43:54 -0100] SSL Verify return: 0
>
> What is the problem?
> P.S.: with MS IE4 everything runs fine.
The message is a confusing. What here happens is this: Netscape sends not only
your Versign client cert to Apache, Netscape sends additionally the Verisign
cert (which was installed in your cert.db automatically by Netscape). Now
SSLeay verifies the certificate chain: It sees your client cert: fine. It
sees the Verisign cert: Not fine.
Why? Because the Verisign cert is a self-signed one (= root CA cert). That's
the cert SSLeay talks about in the error message. But SSLeay cannot verify
this cert because there is no local copy of this cert to compare it against
(it doesn't trust the cert the client sends, of course). So the message
"self-signed certificate" is correct, because that's what occurs while
verifying. But it here actually means "the cert chain stops with a self-signed
cert from a CA which I cannot verify against a local copy".
So, you have to configure a local copy of the Verisign cert for mod_ssl. The
most simply way is to use the ca-bundle.crt file which comes with mod_ssl
2.0.10. It's already prepared in your httpd.conf, you just have to enable the
SSLCACertificateFile directive.
PS: Why it works with MS IE4 I don't know. Perhaps your MSIE doesn't
send the Verisign cert at all?
Ralf S. Engelschall
[EMAIL PROTECTED]
www.engelschall.com
______________________________________________________________________
Apache Interface to SSLeay (mod_ssl) www.engelschall.com/sw/mod_ssl/
Official Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
