X-Git-Url: https://sipb.mit.edu/gitweb.cgi/wiki.git/blobdiff_plain/865e6416a684559514998811e882a58fdbd36fb6..5a9bda6b4cbc3a0c8acbc559b7d49e6b40ab15cc:/doc/apache-client-certs.mdwn diff --git a/doc/apache-client-certs.mdwn b/doc/apache-client-certs.mdwn index 7342483..d4a0642 100644 --- a/doc/apache-client-certs.mdwn +++ b/doc/apache-client-certs.mdwn @@ -4,7 +4,7 @@ While it's certainly possible to configure client-side certificate authenticatio ## Installing the modules -If you're using Ubuntu, [Evan Broder](http://ebroder.net) has packaged the scripts.mit.edu modules for all current Ubuntu releases in a PPA. +If you're using Ubuntu, Evan Broder has packaged the scripts.mit.edu modules for all current Ubuntu releases in a PPA. The [PPA homepage](https://launchpad.net/~broder/+archive/scripts-http-mods) includes instructions on how to install the PPA on your system, but if you're on Ubuntu Karmic or later, you can just run: @@ -20,11 +20,13 @@ You'll also need a working AFS client and the Athena client certificate CA. Both In addition to the standard Apache directives needed to enable SSL, you'll need a few more before the Apache modules work as they do on scripts. Add the following directives to each vhost that will be using SSL client-side certificate authentication: - SSLVerifyClient require - <Location /> + SSLCACertificateFile /etc/ssl/certs/mitCAclient.pem + AuthSSLCertVar SSL_CLIENT_S_DN_Email AuthSSLCertStripSuffix "@MIT.EDU" - </Location> + + +You also need to require certificate authentication. You can either use `SSLVerifyClient required` or `SSLVerifyClient optional`. `SSLVerifyClient required` has the downside that, if visitors don't have client-side certificates, they'll get an obscure OpenSSL error. However, Safari will not present certificates to a site with `SSLVerifyClient optional` set unless the user sets up an Identity Preference. For reference, scripts.mit.edu sets `SSLVerifyClient optional`. You'll also need to enable the Apache modules.