RE: [users@httpd] Can Apache 2.0 supply a Client Certifcate to r emote server when acting as Reverse Proxy?

["Fenton, Tim" <Ti...@hen.invesco.com>]

Thanks very much Joe

We have managed to get it working...

-----Original Message-----
From: Joe Orton [mailto:jorton@redhat.com]
Sent: 12 February 2004 11:34
To: Fenton, Tim
Cc: 'users@httpd.apache.org'
Subject: Re: [users@httpd] Can Apache 2.0 supply a Client Certifcate to
remote server when acting as Reverse Proxy?


On Wed, Feb 11, 2004 at 02:57:08PM -0000, Fenton, Tim wrote:
> I'll try to keep this short!
> 
> We have Apache 2.0 set up as a Reverse Proxy as follows:
> 
> Browser ---SSL---> Apache Reverse Proxy ---SSL---> Remote server (IIS) 
> 
> So far so good it's SSL throughout the journey and this works fine.
> 
> The Remote Server wants to "Require" Client Certs but we don't want to
> install Certs on the browser.
> Instead we want Apache to supply the Client Cert to the Remote Server.
> 
> Can this be done? Has anyone done it? How?
> 
> SSLProxyMachineCertificateFile directive looks hopeful but so far we
haven't
> been able to get Apache to co-operate with the connection being refused by
> the Remote Server with "Client Certificate Required".

Yes, that's the directive to use.  The trick is to make sure you have
configured the right set of CA certs which the "remote server" end
trusts: if the CA cert which signed the client cert you specify in
SSLProxyMachineCertFile is not configured, the c.cert will not get sent.
(hope that makes sense)

Set "LogLevel debug" in the SSL vhost config in apache, and see what
error you get: "no client certificate found!?" means that you need to
adjust the IIS config to send the right CA certs.

joe

-----------------------------------------
*****************************************************************
Confidentiality Note: The information contained in this 
message, and any attachments, may contain confidential 
and/or privileged material. It is intended solely for the 
person(s) or entity to which it is addressed. Any review, 
retransmission, dissemination, or taking of any action in 
reliance upon this information by persons or entities other 
than the intended recipient(s) is prohibited. If you received
this in error, please contact the sender and delete the 
material from any computer.
*****************************************************************


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org