Mailing List Archive: Apache: Bugs

[Bug 52630] Firefox can't access SSL websites with client authentication and when using a symlink to a directory of CA certs

Index | Next | Previous | View Threaded

bugzilla at apache

Apr 4, 2012, 6:27 AM

Post #1 of 5 (96 views)
Permalink

[Bug 52630] Firefox can't access SSL websites with client authentication and when using a symlink to a directory of CA certs

bugzilla at apache

Apr 4, 2012, 4:23 PM

Post #2 of 5 (85 views)
Permalink

[Bug 52630] Firefox can't access SSL websites with client authentication and when using a symlink to a directory of CA certs [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=52630

Christoph Anton Mitterer <calestyo [at] scientia> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |

--- Comment #13 from Christoph Anton Mitterer <calestyo [at] scientia> 2012-04-04 23:23:57 UTC ---
Hey Kaspar.

Sorry, when I got back from holidays I concentrated on that other issue with
SNI/SSL/client auth (which btw. got solved in the meantime) and totally forgot
about this one.

So let me see:

It took me some time to realise that I had to trace for stat (yeah it was late
and I was tired ;) )... so same command just s/stat64/stat/:

With the _working_ config (i.e. absolute pathnames) I then get:
[pid 4522] 01:01:23 stat("/etc/grid-security/certificates/dd4b34ea.0",
{st_mode=S_IFREG|0444, st_size=1631, ...}) = 0

With the (still) not wokring config (i.e. relative pathnames I get:
[pid 5697] 01:03:17
stat("/etc/apache2/pki/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/client.crt.d/dd4b34ea.0",
0x7f4207c076d0) = -1 EACCES (Permission denied)

I then immediately knew the reason (a colleague read pki and and made all the
dirs root-read/list-able only).

>If you still maintain that this is not an issue with your
>particular configuration, then do this:
So actually you were all the time right and it was a configuration mistake on
my site (I should have checked this again but didn't expect someone else to
mess up with that server)...

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Apr 4, 2012, 4:31 PM

Post #3 of 5 (90 views)
Permalink

[Bug 52630] Firefox can't access SSL websites with client authentication and when using a symlink to a directory of CA certs [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=52630

--- Comment #14 from Christoph Anton Mitterer <calestyo [at] scientia> 2012-04-04 23:31:05 UTC ---
Nevertheless may I suggest to "use" this ticket to clarify documentation a bit:
As far as I understand, Apache starts as user root and after some
initialisation suids to some other user (e.g. www-data or so).

I must assume, that mod_ssl already loads some of its files in the root-user
context, because all the host certificates/keys, i.e. the files specified by:
- SSLCertificateFile
- SSLCertificateKeyFile
- SSLCertificateChainFile
were then root owned (and root-only readable), too.

But apparently (which is why I had all the troubles above) this is different
for some/all of the files specified by:
- SSLCACertificateFile/Path
- SSLCADNRequestFile/Path
- SSLCARevocationFile/Path
and they are read as (e.g.) www-data.

So could you please add information to mod_ssls documentation for ALL of the 9
directives mentioned above:
a) under which context the files are read (root or apache-user)
b) whether they are constantly re-read or not
This is not only important as the they suid has already happened "later" but
also in general, as these files may change and people want to know whether they
have to restart the server for changes to get noticed.

Cheers,
Chris.

Oh and btw: Thanks for all your help with this "issue". :-)

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Apr 4, 2012, 9:52 PM

Post #4 of 5 (89 views)
Permalink

[Bug 52630] Firefox can't access SSL websites with client authentication and when using a symlink to a directory of CA certs [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=52630

Kaspar Brand <asfbugz [at] velox> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |INVALID
Summary|clarify mod_ssl |Firefox can't access SSL
|documentation on the |websites with client
|UID/GID context under which |authentication and when
|PKI related files are |using a symlink to a
|loaded and whether they are |directory of CA certs
|reloaded periodically |
Severity|enhancement |normal

--- Comment #17 from Kaspar Brand <asfbugz [at] velox> 2012-04-05 04:52:31 UTC ---
Please file a separate bug for this (under the "Documentation" component,
possibly). Repeatedly morphing the topic of a bug makes it really hard to keep
track of an issue.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Apr 5, 2012, 4:26 AM

Post #5 of 5 (85 views)
Permalink

[Bug 52630] Firefox can't access SSL websites with client authentication and when using a symlink to a directory of CA certs [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=52630

--- Comment #18 from Christoph Anton Mitterer <calestyo [at] scientia> 2012-04-05 11:26:50 UTC ---
Of course.
Done as bug #53037.

Cheers,
Chris.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads