I have configured Apache2 to use Client Certificate AUthentication using:
SSLVerifyClient require
It works, I can access my site with a valid Client Certificate. However, when users connect to it without having a ClientCertificate installed, they get a confusing error from the browser.
(Chrome says 'ERR_SSL_PROTOCOL_ERROR', Firefox says 'ssl_error_handshake_failure_alert', Internet explorer only says 'Internet Explorer cannot display the Webpage'.
I want to show the users a custom ErrorDocument when they try to access without a valid Client Certificate.
The problem is that the site doesn't return a http error code, but aborts the request, so I can't use Apaches' 'ErrorDocument'.
last part of ssl_error_log is this:
[Wed Aug 31 11:11:57 2011] [info] [client 192.168.2.156] SSL library error 1 in handshake (server url:443)
[Wed Aug 31 11:11:57 2011] [info] SSL Library Error: 336105671 error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate No CAs known to server for verification?
[Wed Aug 31 11:11:57 2011] [info] [client 192.168.2.156] Connection closed to child 1 with abortive shutdown (server url:443)
How do I return a valid ErrorDocument for this?
SSLVerifyClient optional
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !=SUCCESS
RewriteRule ^/ http://localhost:8080/missing_cert.html [P,L]