1

we use a Clientauth configuration for a location without problems for many months

Ubuntu 16.04.5 LTS Apache 2.4.18-2ubuntu3.9 openssl 1.0.2g-1ubuntu4.13

Now we upgraded to use HTTP2

Ubuntu 18.04.1 LTS Apache 2.4.29-1ubuntu4.3 Openssl 1.1.0g-2ubuntu4.1

Apache Conf:

 SSLEngine on
   SSLVerifyDepth 2
   SSLProxyEngine on
   SSLProtocol -All +TLSv1.2 +TLSv1.1

   SSLCipherSuite HIGH:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!EXP:!DES:!RC4:!3DES:!MD5:!PSK:!MEDIUM:!LOW:!SRP:!DSS

   SSLCertificateFile /etc/apache2/ssl/blablub.pem
   SSLCertificateKeyFile /etc/apache2/ssl/blablub.key
   SSLCertificateChainFile /etc/apache2/ssl/blablub.ca_certificates.pem
   SSLCACertificateFile /etc/apache2/ssl/ProductiveCAClientAuth.pem 

....other stuff without ClientAuth...

   <Location /test>
       SSLVerifyClient require
       SSLVerifyDepth 2

       ProxyPass https://server-1/test
       ProxyPassReverse https://server-1/testg

   </Location>

Particularity:

The client certificates are issued by an intermediate CA which is itself RSA-PSS Signed. The root CA and the actual client certificates are signed normally RSA-SHA256. Do not ask why, that's how it was built in the past and has worked so far

Error:

[Tue Sep 25 07:18:27.723798 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(757): [client 89.187.203.114:61120] AH02255: Changed client verification type will force renegotiation
[Tue Sep 25 07:18:27.723803 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02221: Requesting connection re-negotiation
[Tue Sep 25 07:18:27.723827 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(987): [client 89.187.203.114:61120] AH02260: Performing full renegotiation: complete handshake protocol (client does support secu
re renegotiation)
[Tue Sep 25 07:18:27.723867 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02226: Awaiting re-negotiation handshake
[Tue Sep 25 07:18:33.176966 2018] [ssl:error] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02261: Re-negotiation handshake failed
[Tue Sep 25 07:18:33.176987 2018] [ssl:error] [pid 49219:tid 140033499584256] SSL Library Error: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
[Tue Sep 25 07:18:33.177005 2018] [core:trace3] [pid 49219:tid 140033499584256] request.c(119): [client 89.187.203.114:61120] auth phase 'check access (with Satisfy All)' gave status 403: /test/
[Tue Sep 25 07:18:33.177032 2018] [headers:debug] [pid 49219:tid 140033499584256] mod_headers.c(900): AH01503: headers: ap_headers_error_filter()
[Tue Sep 25 07:18:33.177057 2018] [http:trace3] [pid 49219:tid 140033499584256] http_filters.c(1128): [client 89.187.203.114:61120] Response sent with status 403, headers:
[Tue Sep 25 07:18:33.177062 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1135): [client 89.187.203.114:61120]   Date: Tue, 25 Sep 2018 05:18:27 GMT
[Tue Sep 25 07:18:33.177066 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1138): [client 89.187.203.114:61120]   Server: Apache/2.4.34 (Ubuntu)
[Tue Sep 25 07:18:33.177071 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120]   X-Frame-Options: SAMEORIGIN
[Tue Sep 25 07:18:33.177075 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120]   Content-Length: 320
[Tue Sep 25 07:18:33.177080 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120]   Connection: close
[Tue Sep 25 07:18:33.177084 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120]   Content-Type: text/html; charset=iso-8859-1

We tested it all again with client certificates issued by a SHA256 intermediat CA. This works without problems. As I suspect that by updating Apache or openssl there is now a problem with PSS signed issuers. Someone has an idea what you can do to make it fly again?

2 Answers 2

1

main problem solved with updating to OpenSSL 1.1.1 Although the problem has resolved and the ClientAuth work again but it is very slow. Normal login now takes 60-120 seconds. Also an update to Apache 2.4.35 did not help. Various test with the SSLCache options of Apaches also not.

I think since Apache officially does not support openSSL 1.1.1 and TLS 1.3, it just helps to wait until it is officially supported.

4
  • LQ Reviewers: Self-answer! VTC Q instead of A, please?
    – Fabby
    Sep 26, 2018 at 7:19
  • I voted to leave the question open - this is a specific solution...
    – Zanna
    Sep 26, 2018 at 13:05
  • I am new here. what means "VTC Q instead of A, please?"
    – F W
    Sep 27, 2018 at 12:03
  • 1
    Hi F W. VTC means vote to close. Q means question and A means answer. Someone flagged your answer as low-quality which means it got put into a queue for people to review and decide whether it should be deleted. Fabby noticed that this was your own answer and therefore correct by default, but apparently thought the answer was not interesting or useful (I disagree) and so suggested other reviewers of that queue vote to close your question (as not-reproducible) instead (you can't "close" an answer but...). Comments are usually temporary and often used for moderation. Apologies for the confusion.
    – Zanna
    Sep 27, 2018 at 16:31
0

You can now use TLSv1.3 via OpenSSL 1.1.1 via Ondrej Sury PPA for apache2 (or nginx) by adding his repository for apache2 (or nginx), then remove default apache2 (change apache2 to nginx if you use the later) and reinstall as follows:

apache2 and openssl 1.1.1:
add-apt-repository ppa:ondrej/apache2
apt-get update
apt-get -y remove apache2
apt-get -y install apache2 openssl

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.