TLS 1.2 client ignoring "Acceptable CA" list for Apache ClientCertificateRequest

user1055568

11/18/23, 11:39 PM

I have TLS 1.2 mutual authentication working on Apache 2.4.54 with a self-signed CA and test clients on iOS and MacOS. Everything works, except the clients do not recognize the "Acceptable client certificate CA" on the CertificateRequest, so user/app must know which one to choose. On my iOS app, the URLAuthenticationChallenge.protectionSpace.distinguishedNames field that is supposed to deliver this list is empty. On MacOS Safari it asks the user to choose a certificate among all installed, even though only 1 has the correct issuer CA. Using

openssl s_client -connect myserver.com:443 -prexit

returns

Acceptable client certificate CA names
/C=US/ST=x/L=x/O=x/OU=x/CN=myca.com/emailAddress=x

Relevant apache config is like so.

SSLCACertificateFile /etc/pki/CA/cacert.pem
SSLCADNRequestFile /etc/pki/CA/cacert.pem
SSLVerifyClient require
SSLVerifyDepth  1

I get same result without SSLCADNRequestFile. Looking at apache logs with LogLevel trace8 appears to show the proper distinguished name being written on the CertificateRequest. This is raw dump, so I can't read the binary fields, but I can see the right ASCII for my CA CN. I guess iOS/MacOS must be seeing this data, but deciding not useable.

The CA certificate has X509v3 Basic Constraints: CA:TRUE, but no keyUsage specs. Since the authentication works, I assume the cert is okay, as long as client chooses right cert.

Any ideas what I am doing wrong, or how to debug further?

232

1 + 0

authentication

ios

ssl-certificate

apache-2.4

Score:0

Server

user1055568

11/19/23, 4:40 PM

I was wrong. The acceptable CA list is being delivered to my iOS app (whether I include the SSLCADNRequestFile or not). There are two app callbacks at the start of the connection, and the DER-encoded CA list is delivered on the second. I still need to figure out why MacOS Safari gave me option to choose certs with wrong CA, but at least the list is being delivered.

+ 1

ProfHase85

5/16/24, 10:30 AM

Could you figure out, why the wrong certificate was delivered?

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: TLS 1.2 client ignoring "Acceptable CA" list for Apache ClientCertificateRequest

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.