Can't get Client certificates to work

[Viator]

(2013-03-25 11:57)mcb30 Wrote:  I haven't tested, but I suspect that Apache wants the CA certificate that signed the client certificate specified here, rather than the client certificate itself. Try:

Code:

SSLCACertificateFile /var/ipxe/src/ca.crt

Michael

Hi Michael!

Thank's for your reply.
I've recreated all keys and certs (the way I did describe in my first post) to be sure they match and then I tried to use ca.crt - same result. With client-certificate verification turned on, the client won't start but does so if the verification is switched off. :-(

Since I know that common-name can't be omitted and must be a valid address I also have tried using the clients ip in the client certificate with no result (even this would work, this would make problems in a real environment since I do not really know the clients ip)

In the "docu" theres a cross certificate mentioned (openssl ca -config ca.cnf -extensions cross -notext -preserveDN -ss_cert startcom.crt -out startcom-cross.crt) but I do not know if an how this is important for me. How should I use this certificates?

Thorsten