Question

I have configured Apache2 to use Client Certificate AUthentication using:

SSLVerifyClient require

It works, I can access my site with a valid Client Certificate.
However, when users connect to it without having a ClientCertificate installed, they get a confusing error from the browser.

(Chrome says ‘ERR_SSL_PROTOCOL_ERROR’, Firefox says ‘ssl_error_handshake_failure_alert’, Internet explorer only says ‘Internet Explorer cannot display the Webpage’.

I want to show the users a custom ErrorDocument when they try to access without a valid Client Certificate.

The problem is that the site doesn’t return a http error code, but aborts the request, so I can’t use Apaches’ ‘ErrorDocument’.

last part of ssl_error_log is this:

[Wed Aug 31 11:11:57 2011] [info] [client 192.168.2.156] SSL library error 1 in handshake (server url:443)
[Wed Aug 31 11:11:57 2011] [info] SSL Library Error: 336105671 error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate No CAs known to server for verification?
[Wed Aug 31 11:11:57 2011] [info] [client 192.168.2.156] Connection closed to child 1 with abortive shutdown (server url:443)

How do I return a valid ErrorDocument for this?

Answer 1

SSLVerifyClient optional
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !=SUCCESS
RewriteRule ^/ http://localhost:8080/missing_cert.html [P,L]