Instalei o Apache no Ubuntu, instalei o módulo GNUTLS e tudo funcionou bem:
root@ilnwad15:~# apache2 -v
Server version: Apache/2.2.22 (Ubuntu)
Server built: Jul 12 2013 13:37:15
Agora, quero que na porta 1443, se o CA do certificado do cliente não for o CA do meu servidor, ele será bloqueado.
Foi assim que configurei em /etc/apache2/apache2.conf
Listen *:443
Listen *:1443
<VirtualHost *:443>
GnuTLSEnable on
GnuTLSKeyFile /etc/apache2/certs/ilnwad15.tlv.sap.corp.key
GnuTLSCertificateFile /etc/apache2/certs/ilnwad15.tlv.sap.corp.crt
DocumentRoot /disk2/var/www/html
GnuTLSPriorities EXPORT
ServerName ilnwad15
</VirtualHost>
<VirtualHost *:1443>
GnuTLSEnable on
GnuTLSKeyFile /etc/apache2/certs/ilnwad15.tlv.sap.corp.key
GnuTLSCertificateFile /etc/apache2/certs/ilnwad15.tlv.sap.corp.crt
GnuTLSPriorities EXPORT
GnuTLSClientCAFile /etc/apache2/certs/ca.pem
GNUTLSClientVerify require
DocumentRoot /disk2/var/www/html
ServerName ilnwad15
</VirtualHost>
O que acontece agora é, ao enviar uma solicitação sem certificado, obter um erro interno.
[root@ilnwadv56 ~]# wget --save-headers --no-check-certificate HTTPs://ilnwad15.tlv.sap.corp:1443
--2013-12-18 17:23:01-- https://ilnwad15.tlv.sap.corp:1443/
Resolving ilnwadv62... 172.16.162.21
Connecting to ilnwadv62|172.16.162.21|:18080... connected.
WARNING: cannot verify ilnwad15.tlv.sap.corp's certificate, issued by `/C=IL/L=Raanana/O=SAP/OU=AccAD/CN=Dummy device':
Unable to locally verify the issuer's authority.
WARNING: certificate common name `dummy.service.com' doesn't match requested host name `ilnwad15.tlv.sap.corp'.
Proxy request sent, awaiting response... 500 Server Error
2013-12-18 17:23:01 ERROR 500: Server Error.
No entanto, quando a solicitação tem um certificado cuja CA não corresponde à CA do servidor, recebo 200 OK Internet Explorere nenhum 403 Proibido. Ao fazer isso, wgetestou recebendo ofailed: Service Unavailable to establish SSL connection.
[root@ilnwadv56 ~]# wget --save-headers --no-check-certificate --certificate=/sapmnt/accad/other/client.crt --private-key=/sapmnt/accad/other/client.key HTTPs://ilnwad15.tlv.sap.corp:443
--2013-12-18 17:46:17-- https://ilnwad15.tlv.sap.corp/
Resolving ilnwadv62... 172.16.162.21
Connecting to ilnwadv62|172.16.162.21|:18080... connected.
Proxy tunneling failed: Service UnavailableUnable to establish SSL connection.
Alguém tem uma ideia de onde está o meu erro? Desde já, obrigado.
Responder1
OK, em primeiro lugar, obrigado a todos que tentaram ajudar (especialmente ao @MadHatter). O problema é que usei um proxy, então precisei unset https_proxye o problema foi resolvido.
No momento, funciona corretamente. Ao enviar um certificado fictício (não fornecendo nenhum certificado por meio de wget)
wget --save-headers --no-check-certificate HTTPS://ilnwad15.tlv.sap.corp:1443
--2013-12-22 10:37:02-- https://ilnwad15.tlv.sap.corp:1443/
Resolving ilnwad15.tlv.sap.corp... 172.16.60.21
Connecting to ilnwad15.tlv.sap.corp|172.16.60.21|:1443... connected.
OpenSSL: error:1409442F:SSL routines:SSL3_READ_BYTES:tlsv1 alert insufficient security
Unable to establish SSL connection.
Ao fornecer um certificado correto.
wget --save-headers --certificate=/sapmnt/accad/other/ilnwad15.tlv.sap.corp.crt --private-key=/sapmnt/accad/other/ilnwad15.tlv.sap.corp.key --no-check-certificate HTTPS://ilnwad15.tlv.sap.corp:1443
--2013-12-22 10:33:59-- https://ilnwad15.tlv.sap.corp:1443/
Resolving ilnwad15.tlv.sap.corp... 172.16.60.21
Connecting to ilnwad15.tlv.sap.corp|172.16.60.21|:1443... connected.
WARNING: cannot verify ilnwad15.tlv.sap.corp's certificate, issued by /C=IL/ST=Central District/L=Raanana/O=SAP AG/OU=AccAD/CN=AccAD CA/[email protected]:
Unable to locally verify the issuer's authority.
HTTP request sent, awaiting response... 200 OK
Length: 4598 (4.5K) [text/html]
Saving to: `index.html'
100%[======================================>] 4,598 --.-K/s in 0s
2013-12-22 10:33:59 (38.5 MB/s) - `index.html' saved [4598/4598]
Obrigado! :D