Certificat based client authentication with apache server

This post describe how to create and use a custom certification authority to generate client certificate that will later be used to authenticate users against apache mod_ssl and pass the credential to the underlying server that processes the client requests : Tomcat, JBOSS or anything else... Apache mod_ssl will be configured to use client certificat based strong authentication that only accept requests that comes from clients presenting a certificat signed by a trusted authority.

Creating the certificates

Certification authority

The first step is to generate our own certification authority certificate. This will be done using standard openssl command to generate a RSA key stored under ca.key. This key will be used to generate a self signed certificate under ca.crt :

ca.key

The RSA key of our own authority

ca.crt

The self signed certificate associated with our authority

ca.public.key

The public key of our authority

Server certificate

The server certificate will be used by the server and presented to the client. It will be signed by the certification authority certificate created above. During the certificate signing request, we'll be asked for a Distinguished Name (DN) or Common Name (CN). The value of that field MUST match the ServerName used in the Apache httpd.conf configuration file. The generation of an unprotected key will allow apache to start without the prompt of a passphrase... which might be useful in some cases.

Client certificate

The client certificate is generated like the server certificate. Each client will have its own certificate that uniquely identifies him. It will be signed by the same certification authority. during the creation of the X.509 client certificat, you'll be prompted for Subject informations. Those informations will be used as credentials to authenticate the user on the underlying server that actually processes the request.

Apache server configuration

The Apache server will be configured to only accept requests that comes from clients presenting a client certificate that is signed by our own certification authority. This is done in the httpd.conf by using those directives in the dedicated SSL VirtualHost :

SSLVerifyClient

The require value force the client to provide its own X.509 certificate during the SSL handshake.

SSLVerifyDepth

Specifies the minimum depth that will be scanned by the server to check for trusted certification authority in the client certificate. A value of 0 will only allow self signed certificates. A value of 1 will accept both self signed certificates and certificates signed by an authority known by the server. In our case, we will use a value of 2 that will only accept certificates signed by an authority known by the server.

SSLCACertificateFile

Specifies the trusted certification authorities.

Thus, only the requests signed by our clients will be authorized.