Re: [users@httpd] Can Apache 2.0 supply a Client Certifcate to remote server when acting as Reverse Proxy?

[Joe Orton <jo...@redhat.com>]

On Wed, Feb 11, 2004 at 02:57:08PM -0000, Fenton, Tim wrote:
> I'll try to keep this short!
> 
> We have Apache 2.0 set up as a Reverse Proxy as follows:
> 
> Browser ---SSL---> Apache Reverse Proxy ---SSL---> Remote server (IIS) 
> 
> So far so good it's SSL throughout the journey and this works fine.
> 
> The Remote Server wants to "Require" Client Certs but we don't want to
> install Certs on the browser.
> Instead we want Apache to supply the Client Cert to the Remote Server.
> 
> Can this be done? Has anyone done it? How?
> 
> SSLProxyMachineCertificateFile directive looks hopeful but so far we haven't
> been able to get Apache to co-operate with the connection being refused by
> the Remote Server with "Client Certificate Required".

Yes, that's the directive to use.  The trick is to make sure you have
configured the right set of CA certs which the "remote server" end
trusts: if the CA cert which signed the client cert you specify in
SSLProxyMachineCertFile is not configured, the c.cert will not get sent.
(hope that makes sense)

Set "LogLevel debug" in the SSL vhost config in apache, and see what
error you get: "no client certificate found!?" means that you need to
adjust the IIS config to send the right CA certs.

joe

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org