Apache2 segmentation fault when using SSLVerifyClient

Hi,

I run an https intranet-Site using Apache2 with mod_ssl. The "pure", server
certified https-tunnel works fine, but when I require a client certificate
by setting SSLVerifyClient to "required", a segmentation fault occurs:

child pid 6364 exit signal Segmentation fault (11)

I am running SuSE Linux 8.2 with apache2-2.0.48-14 and openssl-0.9.6i-19. I
created my own CA which certified the certificates for both server and
client. Root and client-certificate are installed on a WinXP Pro Machine
with the latest patches. Because I read somewhere, that the SSLSessionCache
could be a problem, I set it to "none", but it didn't help... :-(

To achieve SSL-support I changed the following things:

- /etc/sysconfig/apache2: added "ssl" to APACHE_MODULES , set
APACHE_SERVER_FLAGS to "-D SSL -D STATUS"

- /etc/apache2/ssl.conf: set SSLCACertificateFile, SSLCertificateFile,
SSLCertificateKeyFile to the apropriate files, SSLVerifyClient require,
SSLVerifyDepth 10

I would be very thankful for any advises, what could be the problem....

With regards,

Stephan Boldt

> I run an https intranet-Site using Apache2 with mod_ssl. The "pure", server
> certified https-tunnel works fine, but when I require a client certificate
> by setting SSLVerifyClient to "required", a segmentation fault occurs:
>
> child pid 6364 exit signal Segmentation fault (11)

could you please turn up the log level to debug and take post a
snapshot of that failed client auth.

> - /etc/apache2/ssl.conf: set SSLCACertificateFile, SSLCertificateFile,
> SSLCertificateKeyFile to the apropriate files, SSLVerifyClient require,
> SSLVerifyDepth 10

do you need a verify depth of 10? normally if you sign your certs with
your own ca, 1 should be right.

i assume the apache and openssl versions you mentioned are with latest
backported security fixes, there have been quite a lot of holes in the
asn1 parser code used for client certs in openssl lately. otoh, you
own certs should not be malicious, right?

anyways, did you try a client cert from a commercial ca in order to
check that your own ones are not the problem? most commercial ca's
offer free of charge demo certs, a good place is
http://www.tc-trustcenter.de as their demo cert is valid for a whole
year - you need the corresponding class 1 root ca cert too, of
course...

joachim