Здравствуйте.Необходимо прикрутить к сайту авторизацию по клиентским сертификатам.Генерацию сертификатов сделал. Пытаюсь настроить apache2 что бы принимал клиентские сертификаты.
Дерево папок и файлов где лежат открытый, закрытый серверные ключи.
/etc/ssl$ tree .|-- CA| |-- index.txt| |-- index.txt.attr| |-- index.txt.old| |-- serial| `-- serial.old|-- certs| |-- 01.pem| |-- cacert.pem| `-- server.crt|-- newcerts|-- openssl.cnf`-- private |-- cakey.pem |-- server.key
Скрипты сайта лежат в папке: /var/www/ht/public_html
Конфигурация: /etc/apache2/sites-available/ht
<VirtualHost *:80> ServerAdmin root@127.0.0.1 ServerName 127.0.0.1 ServerAlias 127.0.0.1 DocumentRoot /var/www/ht/public_html <Directory /var/www/ht/public_html> Options Indexes FollowSymLinks MultiViews AllowOverride All Order allow,deny allow from all </Directory> ErrorLog /var/www/ht/error.log CustomLog /var/www/ht/access.log combined</VirtualHost>
<VirtualHost *:443> ServerAdmin root@127.0.0.1 ServerName 127.0.0.1:443 ServerAlias 127.0.0.1:443 DocumentRoot /var/www/ht/public_html SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLProtocol all -SSLv2
#SSLCertificateFile /etc/ssl/certs/server.crt#SSLCertificateKeyFile /etc/ssl/private/server.key#SSLCACertificateFile /etc/ssl/certs/cacert.pemSSLCertificateFile /etc/ssl/certs/server.crtSSLCertificateKeyFile /etc/ssl/private/server.keySSLCACertificateFile /etc/ssl/certs/cacert.pemSSLCACertificatePath /etc/ssl/certs/SSLVerifyClient optionalSSLVerifyDepth 10SSLProxyEngine off<FilesMatch "\.(cgi|shtml|phtml|php)$"> SSLOptions +StdEnvVars +ExportCertData</FilesMatch><Directory /var/www/ht/public_html> SSLRequireSSL SSLVerifyClient optional SSLOptions +StdEnvVars +ExportCertData +StrictRequire Options Indexes FollowSymLinks MultiViews AllowOverride All Order allow,deny allow from all</Directory>ErrorLog /var/www/ht/error.logCustomLog /var/www/ht/access.log combined
</VirtualHost>
Вывожу $_SERVER (Адрес скрипта: /var/www/ht/public_html/admin/ssl.php)
<?phpprint_r($_SERVER);?>
Выводит:
Array ( [HTTPS] => on [SSL_VERSION_INTERFACE] => mod_ssl/2.2.14 [SSL_VERSION_LIBRARY] => OpenSSL/0.9.8k [SSL_PROTOCOL] => TLSv1 [SSL_SECURE_RENEG] => true [SSL_COMPRESS_METHOD] => NULL [SSL_CIPHER] => DHE-RSA-AES256-SHA [SSL_CIPHER_EXPORT] => false [SSL_CIPHER_USEKEYSIZE] => 256 [SSL_CIPHER_ALGKEYSIZE] => 256 [SSL_CLIENT_VERIFY] => NONE [SSL_SERVER_M_VERSION] => 1 [SSL_SERVER_M_SERIAL] => 892EBFCB16811249 [SSL_SERVER_V_START] => Oct 28 18:32:38 2012 GMT [SSL_SERVER_V_END] => Oct 28 18:32:38 2013 GMT [SSL_SERVER_S_DN] => /O=Home/OU=room/emailAddress=admin@test.com/L=Ashukino/ST=Moscow/C=RU/CN=Vladimir [SSL_SERVER_S_DN_C] => RU [SSL_SERVER_S_DN_ST] => Moscow [SSL_SERVER_S_DN_L] => Ashukino [SSL_SERVER_S_DN_O] => Home [SSL_SERVER_S_DN_OU] => room [SSL_SERVER_S_DN_CN] => Vladimir [SSL_SERVER_S_DN_Email] => admin@test.com [SSL_SERVER_I_DN] => /O=Home/OU=room/emailAddress=admin@test.com/L=Ivanovo/ST=Moscow/C=RU/CN=Vladimir [SSL_SERVER_I_DN_C] => RU [SSL_SERVER_I_DN_ST] => Moscow [SSL_SERVER_I_DN_L] => Ivanovo [SSL_SERVER_I_DN_O] => Home [SSL_SERVER_I_DN_OU] => room [SSL_SERVER_I_DN_CN] => Vladimir [SSL_SERVER_I_DN_Email] => admin@test.com [SSL_SERVER_A_KEY] => rsaEncryption [SSL_SERVER_A_SIG] => sha1WithRSAEncryption [SSL_SESSION_ID] => 3ED4181511AD81F50392A765DD988F78B165218C9C6CD7279C87C8FFF046F6DA [SSL_SERVER_CERT] => -----BEGIN CERTIFICATE----- MIIDhDCCAmwCCQCJLr/LFoESSTANBgkqhkiG9w0BAQUFADCBgzENMAsGA1UEChME SG9tZTENMAsGA1UECxMEcm9vbTEfMB0GCSqGSIb3DQEJARYQcHJvbnpuQGdtYWls LmNvbTERMA8GA1UEBxMIQXNodWtpbm8xDzANBgNVBAgTBk1vc2NvdzELMAkGA1UE BhMCUlUxETAPBgNVBAMTCFZsYWRpbWlyMB4XDTEyMTAyODE4MzIzOFoXDTEzMTAy ODE4MzIzOFowgYMxDTALBgNVBAoTBEhvbWUxDTALBgNVBAsTBHJvb20xHzAdBgkq hkiG9w0BCQEWEHByb256bkBnbWFpbC5jb20xETAPBgNVBAcTCEFzaHVraW5vMQ8w DQYDVQQIEwZNb3Njb3cxCzAJBgNVBAYTAlJVMREwDwYDVQQDEwhWbGFkaW1pcjCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALaLuzZnwLqu5N3eDr0Jk5P/ /JALgxAk1oW91IpW+S9amt7jUe8ONyJ50PRsXj0mM8uSrYxWE39TwZu9O1IKg6ag qiNqSz9UrGIRFUlcuVjvzHc+TVL3w+SZ3MOBSyDR934moZSE0DW2IDSXLgFWUmxH rKQtulDyyzQicaAQjxxA5BYptc24IT2Jz6uPpxm2ELVplama1LRth24UCZvRgnsK RCZ7jODQWgEhpjAZcaDgspNNlQEILP1eetj3bmnGdU7UCLdSRZ5wDcqFanM+xX9V db3bn9hT0XsgCV0cbUBF+4Np+LD8EfAn98DpiBY0QJU2i3cbUtXC767xthBGSFsC AwEAATANBgkqhkiG9w0BAQUFAAOCAQEABWOf7lMI4W2hPn3rMbO4PGnxSYf0hGfu hxUnuhSRcfhzB3d7Fmrq6ib7YM4wH4ztYVfkROzX2+JzMB/8Nyx2yTjuw7OXvt0u /pzn0y5FXIPbBnP+TFYaF7hHx5UuJ6xl1AcWCgvD04MemxFAR6y7bbGcaPJoQSki A1qokRI1N0vAkgAICTqM9M49/lM/dzhXDYc/5KrMyrf0EHxcr45sgAIA1pAumAbI IKwV5+7babIo1fvGSRxCvCmLpE7QOXnIsUR5hLAmKUS28Bzpo8Njj0ZA2MGNNKW5 lbB1JbTX5V+11zgCwunNCDZv9oVaf75dVgwQlABiMOcxfAjrVURyAw== -----END CERTIFICATE----- [SSL_CLIENT_CERT] => [HTTP_HOST] => 127.0.0.1 [HTTP_USER_AGENT] => Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:16.0) Gecko/20100101 Firefox/16.0 [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 [HTTP_ACCEPT_LANGUAGE] => ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 [HTTP_ACCEPT_ENCODING] => gzip, deflate [HTTP_CONNECTION] => keep-alive [HTTP_COOKIE] => csrftoken=7UQfPnrVk8djTVIrqgQb4T5ZZmfZYh5n; sessionid=32b06151598d8fbb4249865b6a965d42; PHPSESSID=u4bdfnl6e7g5raq7issp21bb40 [HTTP_CACHE_CONTROL] => max-age=0 [PATH] => /usr/local/bin:/usr/bin:/bin [SERVER_SIGNATURE] =>Apache/2.2.14 (Ubuntu) Server at 127.0.0.1 Port 443[SERVER_SOFTWARE] => Apache/2.2.14 (Ubuntu) [SERVER_NAME] => 127.0.0.1 [SERVER_ADDR] => 127.0.0.1 [SERVER_PORT] => 443 [REMOTE_ADDR] => 127.0.0.1 [DOCUMENT_ROOT] => /var/www/ht/public_html [SERVER_ADMIN] => root@127.0.0.1 [SCRIPT_FILENAME] => /var/www/ht/public_html/admin/ssl.php [REMOTE_PORT] => 44215 [GATEWAY_INTERFACE] => CGI/1.1 [SERVER_PROTOCOL] => HTTP/1.1 [REQUEST_METHOD] => GET [QUERY_STRING] => [REQUEST_URI] => /admin/ssl.php [SCRIPT_NAME] => /admin/ssl.php [PHP_SELF] => /admin/ssl.php [REQUEST_TIME] => 1351497613 )
В SSL_CLIENT_CERT пусто. Значит не приходит сертификат? Помогите пож-та найти ошибку.