0

Здравствуйте.Необходимо прикрутить к сайту авторизацию по клиентским сертификатам.Генерацию сертификатов сделал. Пытаюсь настроить apache2 что бы принимал клиентские сертификаты.

Дерево папок и файлов где лежат открытый, закрытый серверные ключи.

/etc/ssl$ tree .|-- CA|   |-- index.txt|   |-- index.txt.attr|   |-- index.txt.old|   |-- serial|   `-- serial.old|-- certs|   |-- 01.pem|   |-- cacert.pem|   `-- server.crt|-- newcerts|-- openssl.cnf`-- private    |-- cakey.pem    |-- server.key

Скрипты сайта лежат в папке: /var/www/ht/public_html

Конфигурация: /etc/apache2/sites-available/ht

<VirtualHost *:80> ServerAdmin root@127.0.0.1 ServerName 127.0.0.1 ServerAlias 127.0.0.1 DocumentRoot /var/www/ht/public_html <Directory /var/www/ht/public_html> Options Indexes FollowSymLinks MultiViews AllowOverride All Order allow,deny allow from all </Directory> ErrorLog /var/www/ht/error.log CustomLog /var/www/ht/access.log combined</VirtualHost>

<VirtualHost *:443> ServerAdmin root@127.0.0.1 ServerName 127.0.0.1:443 ServerAlias 127.0.0.1:443 DocumentRoot /var/www/ht/public_html SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLProtocol all -SSLv2

#SSLCertificateFile /etc/ssl/certs/server.crt#SSLCertificateKeyFile /etc/ssl/private/server.key#SSLCACertificateFile /etc/ssl/certs/cacert.pemSSLCertificateFile /etc/ssl/certs/server.crtSSLCertificateKeyFile /etc/ssl/private/server.keySSLCACertificateFile /etc/ssl/certs/cacert.pemSSLCACertificatePath /etc/ssl/certs/SSLVerifyClient  optionalSSLVerifyDepth  10SSLProxyEngine off<FilesMatch "\.(cgi|shtml|phtml|php)$">    SSLOptions +StdEnvVars +ExportCertData</FilesMatch><Directory /var/www/ht/public_html>    SSLRequireSSL    SSLVerifyClient  optional    SSLOptions +StdEnvVars +ExportCertData +StrictRequire    Options Indexes FollowSymLinks MultiViews    AllowOverride All    Order allow,deny    allow from all</Directory>ErrorLog /var/www/ht/error.logCustomLog /var/www/ht/access.log combined

</VirtualHost>

Вывожу $_SERVER (Адрес скрипта: /var/www/ht/public_html/admin/ssl.php)

<?phpprint_r($_SERVER);?>

Выводит:

 Array ( [HTTPS] => on [SSL_VERSION_INTERFACE] => mod_ssl/2.2.14 [SSL_VERSION_LIBRARY] => OpenSSL/0.9.8k [SSL_PROTOCOL] => TLSv1 [SSL_SECURE_RENEG] => true [SSL_COMPRESS_METHOD] => NULL [SSL_CIPHER] => DHE-RSA-AES256-SHA [SSL_CIPHER_EXPORT] => false [SSL_CIPHER_USEKEYSIZE] => 256 [SSL_CIPHER_ALGKEYSIZE] => 256 [SSL_CLIENT_VERIFY] => NONE [SSL_SERVER_M_VERSION] => 1 [SSL_SERVER_M_SERIAL] => 892EBFCB16811249 [SSL_SERVER_V_START] => Oct 28 18:32:38 2012 GMT [SSL_SERVER_V_END] => Oct 28 18:32:38 2013 GMT [SSL_SERVER_S_DN] => /O=Home/OU=room/emailAddress=admin@test.com/L=Ashukino/ST=Moscow/C=RU/CN=Vladimir [SSL_SERVER_S_DN_C] => RU [SSL_SERVER_S_DN_ST] => Moscow [SSL_SERVER_S_DN_L] => Ashukino [SSL_SERVER_S_DN_O] => Home [SSL_SERVER_S_DN_OU] => room [SSL_SERVER_S_DN_CN] => Vladimir [SSL_SERVER_S_DN_Email] => admin@test.com [SSL_SERVER_I_DN] => /O=Home/OU=room/emailAddress=admin@test.com/L=Ivanovo/ST=Moscow/C=RU/CN=Vladimir [SSL_SERVER_I_DN_C] => RU [SSL_SERVER_I_DN_ST] => Moscow [SSL_SERVER_I_DN_L] => Ivanovo [SSL_SERVER_I_DN_O] => Home [SSL_SERVER_I_DN_OU] => room [SSL_SERVER_I_DN_CN] => Vladimir [SSL_SERVER_I_DN_Email] => admin@test.com [SSL_SERVER_A_KEY] => rsaEncryption [SSL_SERVER_A_SIG] => sha1WithRSAEncryption [SSL_SESSION_ID] => 3ED4181511AD81F50392A765DD988F78B165218C9C6CD7279C87C8FFF046F6DA [SSL_SERVER_CERT] => -----BEGIN CERTIFICATE----- MIIDhDCCAmwCCQCJLr/LFoESSTANBgkqhkiG9w0BAQUFADCBgzENMAsGA1UEChME SG9tZTENMAsGA1UECxMEcm9vbTEfMB0GCSqGSIb3DQEJARYQcHJvbnpuQGdtYWls LmNvbTERMA8GA1UEBxMIQXNodWtpbm8xDzANBgNVBAgTBk1vc2NvdzELMAkGA1UE BhMCUlUxETAPBgNVBAMTCFZsYWRpbWlyMB4XDTEyMTAyODE4MzIzOFoXDTEzMTAy ODE4MzIzOFowgYMxDTALBgNVBAoTBEhvbWUxDTALBgNVBAsTBHJvb20xHzAdBgkq hkiG9w0BCQEWEHByb256bkBnbWFpbC5jb20xETAPBgNVBAcTCEFzaHVraW5vMQ8w DQYDVQQIEwZNb3Njb3cxCzAJBgNVBAYTAlJVMREwDwYDVQQDEwhWbGFkaW1pcjCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALaLuzZnwLqu5N3eDr0Jk5P/ /JALgxAk1oW91IpW+S9amt7jUe8ONyJ50PRsXj0mM8uSrYxWE39TwZu9O1IKg6ag qiNqSz9UrGIRFUlcuVjvzHc+TVL3w+SZ3MOBSyDR934moZSE0DW2IDSXLgFWUmxH rKQtulDyyzQicaAQjxxA5BYptc24IT2Jz6uPpxm2ELVplama1LRth24UCZvRgnsK RCZ7jODQWgEhpjAZcaDgspNNlQEILP1eetj3bmnGdU7UCLdSRZ5wDcqFanM+xX9V db3bn9hT0XsgCV0cbUBF+4Np+LD8EfAn98DpiBY0QJU2i3cbUtXC767xthBGSFsC AwEAATANBgkqhkiG9w0BAQUFAAOCAQEABWOf7lMI4W2hPn3rMbO4PGnxSYf0hGfu hxUnuhSRcfhzB3d7Fmrq6ib7YM4wH4ztYVfkROzX2+JzMB/8Nyx2yTjuw7OXvt0u /pzn0y5FXIPbBnP+TFYaF7hHx5UuJ6xl1AcWCgvD04MemxFAR6y7bbGcaPJoQSki A1qokRI1N0vAkgAICTqM9M49/lM/dzhXDYc/5KrMyrf0EHxcr45sgAIA1pAumAbI IKwV5+7babIo1fvGSRxCvCmLpE7QOXnIsUR5hLAmKUS28Bzpo8Njj0ZA2MGNNKW5 lbB1JbTX5V+11zgCwunNCDZv9oVaf75dVgwQlABiMOcxfAjrVURyAw== -----END CERTIFICATE----- [SSL_CLIENT_CERT] => [HTTP_HOST] => 127.0.0.1 [HTTP_USER_AGENT] => Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:16.0) Gecko/20100101 Firefox/16.0 [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 [HTTP_ACCEPT_LANGUAGE] => ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 [HTTP_ACCEPT_ENCODING] => gzip, deflate [HTTP_CONNECTION] => keep-alive [HTTP_COOKIE] => csrftoken=7UQfPnrVk8djTVIrqgQb4T5ZZmfZYh5n; sessionid=32b06151598d8fbb4249865b6a965d42; PHPSESSID=u4bdfnl6e7g5raq7issp21bb40 [HTTP_CACHE_CONTROL] => max-age=0 [PATH] => /usr/local/bin:/usr/bin:/bin [SERVER_SIGNATURE] =>Apache/2.2.14 (Ubuntu) Server at 127.0.0.1 Port 443[SERVER_SOFTWARE] => Apache/2.2.14 (Ubuntu) [SERVER_NAME] => 127.0.0.1 [SERVER_ADDR] => 127.0.0.1 [SERVER_PORT] => 443 [REMOTE_ADDR] => 127.0.0.1 [DOCUMENT_ROOT] => /var/www/ht/public_html [SERVER_ADMIN] => root@127.0.0.1 [SCRIPT_FILENAME] => /var/www/ht/public_html/admin/ssl.php [REMOTE_PORT] => 44215 [GATEWAY_INTERFACE] => CGI/1.1 [SERVER_PROTOCOL] => HTTP/1.1 [REQUEST_METHOD] => GET [QUERY_STRING] => [REQUEST_URI] => /admin/ssl.php [SCRIPT_NAME] => /admin/ssl.php [PHP_SELF] => /admin/ssl.php [REQUEST_TIME] => 1351497613 )

В SSL_CLIENT_CERT пусто. Значит не приходит сертификат? Помогите пож-та найти ошибку.

1 ответ 1

2

Всем спасибо. Вот тут нашел решение своего вопроса: пользовательские SSL-сертификаты. Может быть еще кто то столкнется с такой же проблемой. Есть некоторые неточности, но их без труда можно поправить.

Ваш ответ

By clicking “Отправить ответ”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Всё ещё ищете ответ? Посмотрите другие вопросы с метками или задайте свой вопрос.