Creating the certificates
Certification authorityThe first step is to generate our own certification authority certificate. This will be done using standard openssl command to generate a RSA key stored under ca.key. This key will be used to generate a self signed certificate under ca.crt :
- The RSA key of our own authority
- The self signed certificate associated with our authority
- The public key of our authority
Server certificateThe server certificate will be used by the server and presented to the client. It will be signed by the certification authority certificate created above. During the certificate signing request, we'll be asked for a Distinguished Name (DN) or Common Name (CN). The value of that field MUST match the ServerName used in the Apache httpd.conf configuration file. The generation of an unprotected key will allow apache to start without the prompt of a passphrase... which might be useful in some cases.
Client certificateThe client certificate is generated like the server certificate. Each client will have its own certificate that uniquely identifies him. It will be signed by the same certification authority. during the creation of the X.509 client certificat, you'll be prompted for Subject informations. Those informations will be used as credentials to authenticate the user on the underlying server that actually processes the request.
Apache server configurationThe Apache server will be configured to only accept requests that comes from clients presenting a client certificate that is signed by our own certification authority. This is done in the httpd.conf by using those directives in the dedicated SSL VirtualHost :
- The require value force the client to provide its own X.509 certificate during the SSL handshake.
- Specifies the minimum depth that will be scanned by the server to check for trusted certification authority in the client certificate. A value of 0 will only allow self signed certificates. A value of 1 will accept both self signed certificates and certificates signed by an authority known by the server. In our case, we will use a value of 2 that will only accept certificates signed by an authority known by the server.
- Specifies the trusted certification authorities.