Published : 2012-03-24

SSL authentication

Certificate-based authentication lets you replace the traditional login/password pair in an environment with a PKI.

The certificate must be trusted by the web server, either because the CA is recognized on the server side, or because you can additionally filter users on data carried in the certificate.

It also lets you use external devices instead of a keyboard to identify users, such as smart card readers.

This article explains how to enable certificate authentication under Apache.

Configuration

Open the configuration of your VirtualHost and first enable HTTPS support by adding a public key, a private key, and optionally a certificate chain:

SSLEngine on
SSLCertificateFile "/etc/ssl/www.unix-experience.fr.crt"
SSLCertificateKeyFile "/etc/ssl/www.unix-experience.fr.key"
SSLCertificateChainFile "/etc/ssl/myCA.pem"

Now that traffic is encrypted, you can secure access to the VirtualHost by adding the following lines:

SSLVerifyDepth 3
SSLVerifyClient require
SSLCACertificateFile "/etc/ssl/myCA.pem"
SSLOptions +StdEnvVars

Let’s review each option:

  • SSLVerifyDepth: defines how deep the SSL certificate verification goes. Set it to at least 2, depending on how your client certificate is built.
  • SSLVerifyClient: forces certificate authentication when set to require. Otherwise use optional.
  • SSLCACertificateFile: the CA that signs the client certificates.
  • SSLOptions +StdEnvVars: exposes client certificate options to underlying engines (such as PHP).

Now that your server can authenticate certificates issued by the CA in myCA.pem, you need to generate certificates using a CN (Common Name) matching your users’ email addresses, and a fully compatible application on the other side (an SSO such as Shibboleth, for example).

Conclusion

You now know how to configure Apache to authenticate clients with certificates. All that’s left is to set up a PKI.