Jean-Pierre Guilloteau est absent(e).

Je serai absent(e) du 28/01/2006 au 06/02/2006. Je répondrai à votre message dès mon retour. Vous pouvez en mon absence contacter Aspaway au 01 46 67 88 88. Cordialement. __ Apache Interface to OpenSSL (mod_ssl)

Re: Errors with firefox

Hi there,We don't appear to have an packaged openssl on this system so I don't think that is my particular problem. However I'm somewhat reassured in that other people are seeing this too so it's hopefully not something too stupid that I'm doing! MichaelOn 1/23/06, Yu, Ming [EMAIL PROTECTED]

Errors with firefox

Hello thereNot sure if the underlying problem here is with mod_ssl or openssl or something else - so apologies if this email is going to the wrong place.I have apache compiled on solaris with sun cc with mod_ssl- 2.8.25-1.3.34 and openssl-0.9.8a (I've also tried 0.9.7i).When accessing the site

RE: Errors with firefox

I had exactly the same problem when I compile my new Apache server (2.2.0) with mod_ssl. To be short, I think you are using the packaged OpenSSL. I fixed the problem by re-compiling the OpenSSL on the system with shared option, but first remove the pre-installed OpenSSL package. - Ming

Back in the ModSSL group?

Hi, I quit this forum a while back, and today I am suddenly receiving e-mails again. What's going on? How did I get back in the group? Can someone tell me how to opt-out again? I no longer have any of my old subscription info, and opt-out instructions aren't included in the e-mails like

RE: Back in the ModSSL group?

Me too. What happened? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Sent: Monday, January 23, 2006 9:56 AM To: modssl-users@modssl.org Subject: Back in the ModSSL group? Hi, I quit this forum a while back, and today I am suddenly receiving

RE: Errors with firefox

and with explorer too. Hello out there, [EMAIL PROTECTED] said: had exactly the same problem when I compile my new Apache server (2.2.0) with mod_ssl.  To be short, I think you are using the packaged OpenSSL.  I fixed the problem by re-compiling the OpenSSL on the system with shared option,

Re: Back in the ModSSL group?

Kyle wrote on 01/23/06 06:55: Hi, I quit this forum a while back, and today I am suddenly receiving e-mails again. What's going on? How did I get back in the group? Ditto here. Can someone tell me how to opt-out again? I no longer have any of my old subscription info, and opt-out

Re: Back in the ModSSL group?

It happened to me as well. - Original Message - From: Joachim Feise [EMAIL PROTECTED] To: modssl-users@modssl.org Sent: Monday, January 23, 2006 11:56 AM Subject: Re: Back in the ModSSL group? Kyle wrote on 01/23/06 06:55: Hi, I quit this forum a while back, and today I am suddenly

Re: Back in the ModSSL group?

ditto __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List modssl-users@modssl.org Automated List Manager[EMAIL PROTECTED]

RE: Back in the ModSSL group?

I am just happy to see the list back since it hasn't worked in a few months Jeff __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List

Re: Back in the ModSSL group?

Until the me toos this list received about 1 mail a month...On 1/23/06, Peter Reilly [EMAIL PROTECTED] wrote:It happened to me as well.- Original Message -From: Joachim Feise [EMAIL PROTECTED]To: modssl-users@modssl.orgSent: Monday, January 23, 2006 11:56 AMSubject: Re: Back in the

Re: Back in the ModSSL group?

BJ Swope wrote: Until the me toos this list received about 1 mail a month... And generally about old versions of the module. -- Phil Ehrens [EMAIL PROTECTED]| Fun stuff: The LIGO Laboratory, MS 18-34 | http://www.ralphmag.org California Institute of Technology|

Some changes in mod_ssl API

Hello! I think is good idea to enable common work of two these options: SSLOptions +FakeBasicAuth and SSLUserName When we enable FakeBasicAuth option, we take username not user, but /C=RU/ST=-/L=Moscow/O=example.com/OU=Example/CN=user/[EMAIL PROTECTED] This is in some cases inconveniently --

Re: reduce handshake overhead in a reverse mod_proxy (SSL front-end + SSL back-end)

You could possibly use stunnel to set up a persistent ssl connection. Connecting up to a local port with just http (only listen on localhost). I believe the sessions are reused with stunnel. It's extra config but quick to setup. Regards Matt --- Jeff Ambrosino [EMAIL PROTECTED] wrote: Hi

Re: reduce handshake overhead in a reverse mod_proxy (SSL front-end + SSL back-end)

Interesting idea... but that would require HTTP keepalive support by the back-end, right? (unfortunately keepalive isn't supported by our back-end www server...) JB On 10/20/05, Matt Stevenson [EMAIL PROTECTED] wrote: You could possibly use stunnel to set up a persistent ssl connection.

reduce handshake overhead in a reverse mod_proxy (SSL front-end + SSL back-end)

We use mod_proxy and mod_ssl in a reverse proxy configuration; traffic is accepted by the proxy through SSL, and then proxied backwards to another server over SSL. Unfortunately, for application reasons, we *must* proxy backwards via SSL, even through the proxy and the back-end web server are

Re: reduce handshake overhead in a reverse mod_proxy (SSL front-end + SSL back-end)

Hi Georg, after I emailed the list, I found this info: http://www.covalent.net/resource/documentation/faststart/2.0.0/userguide/html/sslconfigure.php#1176550 It appears that the Apache/mod_ssl SSLProxyProtocol directive lets you limit the ciphers that the proxy will use (as a client) to the

[ANNOUNCE] mod_ssl 2.8.25-1.3.34 for Apache 1.3.34

Apache 1.3.34 was released, so I've upgraded mod_ssl to apply cleanly to this Apache version. No other changes. Fetch mod_ssl 2.8.25-1.3.34 from the usual locations: o http://www.modssl.org/source/ o ftp://ftp.modssl.org/source/ Yours, Ralf S. Engelschall

Why is SSL_SESSION_ID changing?

Hi. We are developing a java-based webapp, a kind of CMS. The problem is, that relatively big group of it's users will have rights to create pages, upload files etc., also upload javascript pages. In this case an attacker will be able to steal somebody's session (e.g. creating JS page which will

Re: Why is SSL_SESSION_ID changing?

On Tue, Oct 18, 2005 at 12:28:31PM +0200, Ryszard Lach wrote: We thought, that one of possible solutions will be binding user's session to SSL_SESSION_ID (i.e. keeping SSL_SESSION_ID in user's session and comparing it at every request with ID read from this request). Don't - SSL_SESSION_ID

Re: Is it possible to not force SSL on port:443?

Also, here is my ssl.conf: - LoadModule ssl_module modules/mod_ssl.so AddType application/x-x509-ca-cert .crt AddType application/x-pkcs7-crl.crl SSLPassPhraseDialog builtin SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)

Is it possible to not force SSL on port:443?

I am helping someone develop a product, and for the next little bit he will need to access port 443 with out the communication being encrypted (aka he could telnet to it if he wanted). But in the very near future, he will want to make 443 encrypted.. Is it possible to not force encryption on

Re: Is it possible to not force SSL on port:443?

On 10/14/05, Pigeon [EMAIL PROTECTED] wrote: I am helping someone develop a product, and for the next little bit he will need to access port 443 with out the communication being encrypted (aka he could telnet to it if he wanted). But in the very near future, he will want to make 443

Fwd: How to allow only certain Certificates

Helps if I send this from the address that is actually subscribed to the list... resending -- Forwarded message -- From: Cliff Woolley Date: Oct 12, 2005 7:41 AM Subject: Re: How to allow only certain Certificates To: modssl-users@modssl.org On 10/12/05, Dr. Harry Knitter

Re: Fwd: How to allow only certain Certificates

Am Freitag, 14. Oktober 2005 13:38 schrieb Cliff Woolley: Helps if I send this from the address that is actually subscribed to the list... resending -- Forwarded message -- From: Cliff Woolley Date: Oct 12, 2005 7:41 AM Subject: Re: How to allow only certain Certificates

Re: Fwd: How to allow only certain Certificates

On 10/14/05, Dr. Harry Knitter [EMAIL PROTECTED] wrote: Thanks, however, I´d prefer something like the Unique Subject Identifyer or perhaps the Fingerprints. DNs can be faked easy. Not if you require your own CA as the issuing authority using SSLCACertificateFile and SSLRequire, they can't...

How to allow only certain Certificates

Hello, how can I restrict access to my Apache to owners of certain individual certificates? I have tried the following (it doesn´t work, however): SSLREQUIRE %{SSL_CLIENT_S_DN_UID} in {Subject Key Identifyer1,Subject Key Identifyer2,...} where Subject Key Identifyer is the X509 extension

Re: engine format keys

Hi Geoff, Alas I can't give you any off-the-top hints about UI_METHOD because I haven't used it myself, so I've CC'd Richard who is the guy who did UI_METHOD. Richard, if there's anything obvious in the above snippet please feel free to comment. However I'd suggest taking this over to the

Environment variables question

Hello, I have a question about the meaning of some environment variables for mod_ssl. What do the fields T, I, G, S, and D in subject or issuer DNs mean, respectively, to which fields of a certificate do they point? Thanks Harry

Re: Environment variables question

Post your certificate and I'd be glad to take a look. BJ On 10/11/05, Dr. Harry Knitter [EMAIL PROTECTED] wrote: Hello,I have a question about the meaning of some environment variables for mod_ssl.What do the fields T, I, G, S, and D in subject or issuer DNs mean,respectively, to which fields of

Re: Environment variables question

Am Dienstag 11 Oktober 2005 13:09 schrieb BJ Swope: Post your certificate and I'd be glad to take a look. BJ for what do you need my certificate to answer this question? I simply would like to know what is the meaning of the following variables Examples: SSL_CLIENT_S_DN_T SSL_CLIENT_S_DN_I

Re: Environment variables question

I simply would like to know what is the meaning of the following variables Examples: SSL_CLIENT_S_DN_T SSL_CLIENT_S_DN_I There's a nice table of these at http://www.covalent.net/resource/documentation/ers/2.0.0/productguide/html/proxymodule.html . I had to dig pretty good to find that,

Re: Environment variables question

Am Dienstag 11 Oktober 2005 13:43 schrieb Cliff Woolley: I simply would like to know what is the meaning of the following variables Examples: SSL_CLIENT_S_DN_T SSL_CLIENT_S_DN_I There's a nice table of these at

Re: Environment variables question

I was wanting a context for the information. Oftentimes context will provide indicators of purpose.

Re: engine format keys

Hi Kent, On October 6, 2005 05:01 pm, Kent Yoder wrote: Yep, passphrase entry is at least part of the problem with calling ENGINE_load_private_key. After a few different attempts, I'm a bit stumped. The load key call wants a UI* passed to it, which eventually has UI_process() called on

configure SSL session timeout

Dear All, I know the SSL session timeout param can be configured by the directive SSLSessionCacheTimeout. Is there any setting or API for the browser or client application to configure the SSL session timeout param and override the server's one such that each application can configure their

Re: configure SSL session timeout

I know the SSL session timeout param can be configured by the directive SSLSessionCacheTimeout. Is there any setting or API for the browser or client application to configure the SSL session timeout param and override the server's one such that each application can configure their timeout

Re: configure SSL session timeout

On Thu, Oct 06, 2005 at 09:51:47AM -0400, Cliff Woolley wrote: I know the SSL session timeout param can be configured by the directive SSLSessionCacheTimeout. Is there any setting or API for the browser or client application to configure the SSL session timeout param and override the

Re: engine format keys

Ah, right. You'll also need to ensure that the initialisation order allows the engine to be properly initialised (including maybe some control commands to prepare anything the engine needs) *before* the key is loaded. I have a vague recollection that this isn't the case? Though I could

Re: engine format keys

Hi Geoff, Sorry I didn't notice this earlier. I added some hooks to modssl ages ago to support engine ctrl-commands if that helps. In fact you may have to Thanks for the patch. I don't think I'm going to be able to accomplish what I wanted with control commands though. Basically I need my

Re: engine format keys

On October 4, 2005 10:56 am, Kent Yoder wrote: Hi Geoff, Sorry I didn't notice this earlier. I added some hooks to modssl ages ago to support engine ctrl-commands if that helps. In fact you may have to Thanks for the patch. I don't think I'm going to be able to accomplish what I

Re: engine format keys

Geoff, Ah, right. You'll also need to ensure that the initialisation order allows the engine to be properly initialised (including maybe some control commands to prepare anything the engine needs) *before* the key is loaded. I have a vague recollection that this isn't the case? Though I

Re: engine format keys

This should be a relatively trivial change to ssl_pphrase_Handle()... if szCryptoDevice is non-NULL, pass the private key path as the key_id to ENGINE_load_private_key. If that fails, fall back to the normal PEM loading code... Kent I've been looking into enabling apache+mod_ssl to use

Re: engine format keys

Hi Kent, On September 29, 2005 12:28 pm, Kent Yoder wrote: I've been looking into enabling apache+mod_ssl to use hardware keys encrypted by a TPM. I have openssl's s_server test working using an openssl TPM engine [1] and trousers [2]. It looks like the key to getting this working in

make certificate hangs

Moin, I've setup modssl with apache. I've followed the example from modssl.org. Then i try make certificate type=custom and it hangs at this point: Getting CA Private Key Verify: matching certificate key modulus Verify: matching certificate signature ../conf/ssl.crt/server.crt: OK After that I

Re: make certificate hangs

make certificate is largely deprecated at this point, as far as I'm concerned... it doesn't even ship with Apache 2.0 + mod_ssl. The expiration could be considered a bug in Apache 1.3's mod_ssl, but IMO the best thing for you to do is to follow the steps in the mod_ssl documentation for creating

Re: Re: Re: httpd configuration problem

Solution (mostly) found. The problem is with a misconfiguration of the Fecora Core 4 http configuration tool: the tool doesn't know about the split in configuration files in core 4 (httpd.conf in /etc/httpd/conf, ssl.conf in /etc/httpd/ conf.d). ssl.conf already contains a Listen on 443

Grr.. where is my CA's Certificate file?

Hello, I am trying to setup apache to use a PKI (I think that is what it is called)... So each client will have to already have a public key to have access to my 'secure' apache server. I might hand out 5 of these public keys, and I want only those users to have access to this server. My

Re: Re:

Dear Cliff, Thanks for your help. On 26/09/2005, at 21:22, Cliff Woolley wrote: It really does sound like there's something else listening on port 443: Starting httpd: (98)Address already in use: make_sock: could not bind to address my IP address:443 no listening sockets available,

Re: Re:

Starting httpd: (98)Address already in use: make_sock: could not bind to address my IP address:443 no listening sockets available, shutting down However the key information really is missing. So it looks like this may be a problem in the fedora httpd configuration tool, because the key

engine format keys

Hi, I've been looking into enabling apache+mod_ssl to use hardware keys encrypted by a TPM. I have openssl's s_server test working using an openssl TPM engine [1] and trousers [2]. It looks like the key to getting this working in apache is support for engine format keys in mod_ssl. Is there

Re: Mod_ssl and how to reduce overhead (Thanks!)

Thanks for all the great info! It definitly gives me a nice footing from which I can start. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List

Re:

It really does sound like there's something else listening on port 443: Starting httpd: (98)Address already in use: make_sock: could not bind to address my IP address:443 no listening sockets available, shutting down That's usually what this message means. You said: Oh, and there isn't

Mod_ssl and how to reduce overhead

Hello, I am trying to plan a system that can handle 10k-100k users. I am only using apache w/mod-ssl What should I look at to reduce overhead of bandwidth/cpu/mem? At what point should I look at ssl accelerators? Should I definitly look at clustering? Also.. I ahve heard about ssl session

Re: Mod_ssl and how to reduce overhead

Hi, A few words about intended usage would be of great help. - How many concurrent users - Type of transactions - You really think the http front is going to be you bottle neck? or are there back end systems that will pose a greater problem (I would think so) Why not just use a normal

Re: Mod_ssl and how to reduce overhead

I use Pound (http://www.apsis.ch/pound/) as an SSL-terminating reverse proxy .. on commodity hardware, it can handle - at least according to quotes from the field - up to around 400 conns/sec. It also affords you some additional firewalling in that you can put the SSL terminating accelerator

Re: Mod_ssl and how to reduce overhead

Also.. I ahve heard about ssl session key caching, anyone know how much this will improve things? Session caching is more or less essential for any kind of reasonable SSL performance. Disabling the session cache will hurt your SSL perf by perhaps as much as an order of magnitude (roughly

Re: Mod_ssl and how to reduce overhead

We are going to have 10k-100k concurrent users (yeah... ) We are transfering EXE files (no not warez) I am just trying to get some ideas.. I am concerned about all because I do not know what to be concerned about :/ thanks Lee - Original Message - From: Martin Strandbygaard

Re: Mod_ssl and how to reduce overhead

On Mon, Sep 26, 2005 at 08:54:30AM -0400, Cliff Woolley wrote: Session caching is more or less essential for any kind of reasonable SSL performance. Disabling the session cache will hurt your SSL perf by perhaps as much as an order of magnitude (roughly speaking -- it's been a long time since

Re: Re:

Thanks Cliff; will check it further Wednesday (the server needs to be up running tomorrow). Thanks for pointing out the udp in the fuser command (embarrassed grin). I checked tcp just now, nothing listening, but of course that may not be the state when I'm trying to run SSL/apache. The

Re: Mod_ssl and how to reduce overhead

Hmm.. 10k -100k are pretty much guaranteed numbers.. So my main computer crunching will be done at the beginning? (and to relive this I can do session key caching.. how long can I cache a key? is this 'secure'?) (also.. all transfers will be ~15megs in size) And using a single server is

Re: Mod_ssl and how to reduce overhead

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Not to mention 15MB download * 100K concurrent users is some *serious* traffic. If you're going to be paying that kind of $$$ for bandwidth, I hope you've got some cash left over for a load balancer and additional web servers. Some quick (and

Re: Mod_ssl and how to reduce overhead

Aaron Turner wrote: I gotta ask though, just what are you doing where you expect 100K people trying to download a 15MB file all at the same time? You working for Microsoft and planning the next security tuesday patch update or something? :) That or he has the video of Gates getting

Re: Mod_ssl and how to reduce overhead

Just wondering, is this for the charter.net music download? I cannot believe you would have 100,000 comcurrent connections for a service such as that. I also see the download file is listed at 1.5MB, not 15. As as for bandwidth, that better be upgraded. It took over a minute just to download the

Re: Mod_ssl and how to reduce overhead

On Mon, Sep 26, 2005 at 11:28:11AM -0400, Pigeon wrote: Hmm.. 10k -100k are pretty much guaranteed numbers.. That's quite a wide margin. Are we talking concurrent users or just number of people who could be using it over a period of xx? So my main computer crunching will be done at the

Re: Mod_ssl and how to reduce overhead

Ok, lets assume I can get a network connection with: A)10mbit B)100mbit C)1000mbit And I will have 10k concurrent downloads (let us throw out 100k for now.. because i can alwasy scale up figures if we get a base). (The reason I say 10k concurrent is because we have an update system (sorta

Re: Mod_ssl and how to reduce overhead

You're not looking at your problem from the right angle. 10K users... asking for the SAME file. Set up a smallish farm of four or five machines and use a HTTP Acclerator. (basically a Squid proxy turned on it's head - the examples exist in the config file for squid .. look at the http

Re: Mod_ssl and how to reduce overhead

Well, the math is simple 1000mbit/1 users = 100 kilobit/sec, or 12K per second, or 1200 seconds, 20 minutes per downlaod. Marginally acceptable by todays standards. To concurrently process that much data, that many connections, you will want a load balancer out front. With the system I'm

Re: Mod_ssl and how to reduce overhead

Pigeon wrote: Ok, lets assume I can get a network connection with: A)10mbit B)100mbit C)1000mbit And I will have 10k concurrent downloads (let us throw out 100k for now.. because i can alwasy scale up figures if we get a base). (The reason I say 10k concurrent is because we have an

Re: Mod_ssl and how to reduce overhead

On 9/26/05, Phil Ehrens [EMAIL PROTECTED] wrote: Pigeon wrote: (The reason I say 10k concurrent is because we have an update system (sorta like windows update).. and as soon as we tell their computer to update, we have 10k boxes saying give me the file!) I think I agree with the guy who

[no subject]

Hello; I would greatly appreciate assistance with an apache setup problem. Aim: Im trying to set up a mixed http/https server. The plan is to hold secure stuff in one file hierarchy, insecure in another. I don't seem to be able to get it to work. I've tried searching both apache/ssl forums

SSLVerifyClient, 2 domains, 1 localhost, JVM1.4

Hi everyone, I'd be very gratefull if someone could help me on this one. I set up my apache/ssl server in order to have strong authentication. The reason of my problems comes from the fact that I use a JVM 1.4 : when I try to download a specific module, the JVM will try to ask a client

SSLVerifyClient, 2 domains (secured and not secured), 1 localhost, JVM1.4

Hi everyone, I'd be very gratefull if someone could help me on this one. I set up my apache/ssl server in order to have strong authentication. The reason of my problems comes from the fact that I use a JVM 1.4 : when I try to download a specific module, the JVM will try to ask a client

Two different physical hosts + IPs, one cert

I am going to install two different servers in two different physical locations which would necessitate two different IPs. I will use multiple identical DNS A records to round-robin traffic like this: 1.1.1.1 - example.com 2.2.2.2 - example.com I'm just not sure about SSL; can I create one

Re: Two different physical hosts + IPs, one cert

The certificate refers to the host by name, not by IP address. So as long as the two hosts have exactly the same FQDN, then you should be fine. --Cliff __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org

Problem with colon in subject DN when using FakeBasicAuth

Hi, I'm using FakeBasicAuth with Apache which works fine with most user certificates. However, user certificates with colons in the subject doesn't work. The following illustrates the problem - FakeBasicAuth works with a user entry like: /CN=Martin Strandbygaard/C=Denmark/L=Copenhagen/

OptRenegotiate and IE problem.

Hello, I've got a problem I've been unable to resolve. Maybe somebody here has the know-how to help me? I've got a Apache+ModSSL webserver with a directory which requires clients to authenticate themselves with a certificate. Certificates (and keys) are on a smartcard. When the client

client certificates won't verify under Apache

I'm running CentOS 4.1 with Apache 2.0.52 and trying to setup client SSL authentication using an internal CA. I've read the docs and checked the list archives for someone having the same problem or any hints, but have come up empty so far. Anyways... Running: openssl verify -CAfile

Re: Why?! BackSex.mpeg

very good movie>>> Video's Media Player. SEX SEX * Sluts Tits Video Mpeg's Mpeg Video ClipsEngelschall.com servers automatically scanned for viruses using McAfee SECURITY =--Movie Attached--=

[ANNOUNCE] mod_ssl 2.8.24-1.3.33

A subtle security bug (CAN-2005-2700) was discovered in mod_ssl where where SSLVerifyClient require was not enforced in per-location context if SSLVerifyClient optional was configured in the global virtual host configuration. This bug is now fixed in mod_ssl 2.8.24 for Apache 1.3.33. Get it from:

Re: preventing client certs to be used by multiple users??

- Original Message - From: Conrad Friedrich [EMAIL PROTECTED] To: modssl-users@modssl.org Sent: Wednesday, August 31, 2005 11:49 PM Subject: preventing client certs to be used by multiple users?? Hello, Is there a way to prevent users (that got a client ssl-certificate (pkcs12) for

Re: strange connections to apache2 port 443

Tom Henderson wrote: Hi, I hope that I describe my problem to the right mailinglist and that someone can give me the hint I need. I´m running a SuSE Linux 9.0 with Apache2 2.0.53 ( installed via rpm from ftp.suse.com ) with mod_ssl. The startup parameter for the apache is -D SSL. But here

Re: strange connections to apache2 port 443

On Wed, Aug 31, 2005 at 10:47:39AM +0200, Bernhard Erdmann wrote: this is exactly what I recognized. When Apache 2.0.54 runs on RHEL AS 3 using SSL, it opens TCP connections to itself on a regular schedule. 2.0 does this to wake up idle child processes, which can then exit, it's perfectly

preventing client certs to be used by multiple users??

Hello, Is there a way to prevent users (that got a client ssl-certificate (pkcs12) for accessing my server) from giving their certs away to others and in that way enabling unwanted users access to my site? Or if there is no elegant solution, maybe someone knows how apache (or a log analyzer

preventing client certs to be used by multiple users??

Hello, Is there a way to prevent users (that got a client ssl-certificate (pkcs12) for accessing my server) from giving their certs away to others and in that way enabling unwanted users access to my site? Or if there is no elegant solution, maybe someone knows how apache (or a log analyzer

Re: preventing client certs to be used by multiple users??

On 8/31/05, Conrad Friedrich [EMAIL PROTECTED] wrote: Is there a way to prevent users (that got a client ssl-certificate (pkcs12) for accessing my server) from giving their certs away to others and in that way enabling unwanted users access to my site? The client certificate acts as the user's

undefined symbol: X509_free

i have downloaded openssl-0.9.8.tar.gz. I untared it then configured it with these switches ./config --prefix=/usr/local shared zlib-dynamic then did make and make install i had apache httpd-2.0.53.tar.gz also untared it then used these switches to configure ./configure --enable-deflate

Re: undefined symbol: X509_free

On 8/29/05, Toney Samuel [EMAIL PROTECTED] wrote: I am getting this error cluster1:/usr/local/apache2/bin # ./apachectl startssl Syntax error on line 234 of /usr/local/apache2/conf/httpd.conf: Cannot load /usr/local/apache2/modules/mod_ssl.so into server:

strange connections to apache2 port 443

Hi, I hope that I describe my problem to the right mailinglist and that someone can give me the hint I need. I´m running a SuSE Linux 9.0 with Apache2 2.0.53 ( installed via rpm from ftp.suse.com ) with mod_ssl. The startup parameter for the apache is -D SSL. But here comes my problem ... I´m

RE: export client certificate CN?

Add the following line to you httpd configuration: JkEnvVar SSL_CLIENT_S_DN none JkEnvVar SSL_CLIENT_CERT none This will make the client cert and distinguished name available through Apache enviroment variables. Then in Java (within a JSP/servlet): String DN = (String)

export client certificate CN?

I am currently using mod_ssl to verify client certs. are issued by trusted CAs (e.g. SSLVerifyClient require), but then using username/password for application identification/authorization, passing this to Oracle via Tomcat using JAVA. However, I'd like to be able to use client certs. for I/A by

Re: export client certificate CN?

I am trying to use mod_auth_ldap with apache2, and I am having trouble figuring out how to generate a trusted Certificate Authority certificate. I tried using the Netscape certificate database file as the apache docs suggest, but I'm still getting a complaint from LDAP that LDAP: ssl connections

RE: export client certificate CN?

I am trying to use mod_auth_ldap with apache2, and I am having trouble figuring out how to generate a trusted Certificate Authority certificate. I tried using the Netscape certificate database file as the apache docs suggest, but I'm still getting a complaint from LDAP that LDAP: ssl

SSL support for a VirtualHost on a port other than 443

Hi, I am trying to set up apache2 to provide SSL support for a VirtualHost running on port 81. The server handles https requests just fine, but when I try connecting with https through port 81 I receive an error (in Firefox The connection to [myhost]:81 has terminated unexpectedly. Some data

Re: SSL support for a VirtualHost on a port other than 443

On Tue, Aug 16, 2005 at 09:57:38AM -0700, Andrew Musselman wrote: I am trying to set up apache2 to provide SSL support for a VirtualHost running on port 81. Have you added a virtualhost for port 81 and the corresponding Listen statement? The server handles https requests just fine, but when

Re: SSL support for a VirtualHost on a port other than 443

Andrew Musselman [EMAIL PROTECTED] [EMAIL PROTECTED] 8/16/2005 11:06 AM On Tue, Aug 16, 2005 at 09:57:38AM -0700, Andrew Musselman wrote: I am trying to set up apache2 to provide SSL support for a VirtualHost running on port 81. Have you added a virtualhost for port 81 and the

chuck lyon/FIU is out of the office.

I will be out of the office starting 08/11/2005 and will not return until 08/29/2005. I will respond to your message when I return. __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support

Re: chuck lyon/FIU is out of the office.

Chuck, Thanks for keeping us in the loop. [EMAIL PROTECTED] 08/16/2005 02:01:39 I will be out of the office starting 08/11/2005 and will not return until08/29/2005.I will respond to your message when I return.__Apache

Re: SSL support for a VirtualHost on a port other than 443

On Tue, Aug 16, 2005 at 11:16:36AM -0700, Andrew Musselman wrote: Listen 81 VirtualHost *:81 ServerAdmin [EMAIL PROTECTED] DocumentRoot /usr/local/www/printers ServerName pc74965.cts.cwu.edu DirectoryIndex index.html index.php ErrorLog /var/log/printers-error_log

<    3   4   5   6   7   8   9   10   11   12   >