[users@httpd] R: [users@httpd] Re: Apache 2.0.39 SSLProxy - can't authenticate to a remote server

[Claudio Campetto <cc...@sogei.it>]

Thanks for the answer. What I need is precisely what you don't need. I want
the proxy to authenticate itself to the remote server; if you succeded in
doing this or if in the Prentice Hall book gives some tips, can you post the
relevant directives?
Thanks
Claudio Campetto
-----Messaggio originale-----
Da: Janice Eely [mailto:jkeely@nsa.gov]
Inviato: martedi 27 agosto 2002 19.24
A: users@httpd.apache.org
Oggetto: [users@httpd] Re: Apache 2.0.39 SSLProxy - can't authenticate
to a remote server


Claudio,
We were trying the same thing.  I experimented with
SSLProxyMachineCertificateFile and SSLProxyCACertificateFile.    I gave up
after
I read the following from a book from Prentice Hall.

"The proxy acts as an endpoint of one SSL session, accepting the request
from
the client, and as another endpoint of another SSL session, forwarding the
request to the origin server.  These two SSL sessions are not related, other
than being present in the same proxy server's memory.  An important
consequence
of this is that the client certificate-based authentication credentials are
not
relayed to the origin server.  The SSL session between the client and the
(reverse) proxy server authenticates the client to the proxy server.
However,
the SSL session between the proxy and the origin server authenticates the
proxy
server to the origin server.  (That is, the certificate presented to the
origin
server is the reverse proxy server's certificate, and the origin server has
no
knowledge of the certificate of the client that initiated the request.)"

This was no good for us because we needed the origin server to know who was
coming in from the client.  We ended up installing a product from RSA, which
provides additional directives for the httpd.conf file.

Janice Eely




---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org