Client Cert mapping in Apache

[thomaswoo]

Hi all,

Is there anyway that I can set the "Client Certificate mapping" in Apache, just that in IIS ?

Basically, I just want to open my web site to my client using digitial cert as authorization.

Thanks !

 

[ericbrunson]

Put something like this in your config:

<VirtualHost secure.you.com:443>
    SSLEngine on
    SSLCertificateFile /path/to/apache/conf/ssl.crt/secure.you.com.crt
    SSLCertificateKeyFile /path/to/apache/conf/ssl.key/server.key
</VirtualHost>

 

[nokernel]

Hum, I guess that he want the clients to be authentified by key, like to replace the password. What you offered him wont do it. I know that you can do that but I never did it. What version of apache are you using? Because you can find some information about mod_ssl that will explaing you how to do that if you have apache 1.3. Your best bet is to go at

http://www.apache.org

and look at the ssl module.

 

[ericbrunson]

Ah, right, I read the question wrong. I've never done it either.

 

[ericbrunson]

Try this document:

http://www.apacheweek.com/features/crl

 

[thomaswoo]

Thanks ericbrunson and nokernel !!

nokernel is correct, I would like to use client cert to replace username + password authentication. (sorry, I spell it wronly in my first message.)

The apache version on my inux box is 2.0.50

 

[nokernel]

There is alot of information on the mod_ssl doc for apache 2.0 there.

http://httpd.apache.org/docs-2.0/mod/mod_ssl.html

 

[nokernel]

I have some better stuff for you, witch you can find it there.

http://httpd.apache.org/docs-2.0/ssl/ssl_howto.html#allclients

************************************
How can I authenticate clients based on certificates when I know all my clients?

When you know your user community (i.e. a closed user group situation), as it's the case for instance in an Intranet, you can use plain certificate authentication. All you have to do is to create client certificates signed by your own CA certificate ca.crt and then verify the clients against this certificate.
httpd.conf

# require a client certificate which has to be directly
# signed by our CA certificate in ca.crt
SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile conf/ssl.crt/ca.crt