Lighttpd Client Certificate Authentication

Question

I'm trying to enable client certificate authentication with lighttpd using my own internal windows CA's. Disclaimer: I'm still very new to PKI :D

I have an offline root CA and a subordinate CA in my homelab. I've already imported the root CA into Firefox under trusted CA's. For the client certificate, I used openssl to generate a CSR which I signed with my subordinate CA using a template that has client authentication enabled. This client certificate is also imported into Firefox as a pfx file. I've also configured lighttpd as follows:

ssl.pemfile = "/etc/lighttpd/certs/lighttpd.pem"
ssl.ca-file = "/etc/lighttpd/certs/ca.cer"
ssl.verifyclient.activate = "enable"
ssl.verifyclient.enforce = "enable"
ssl.verifyclient.username = "SSL_CLIENT_S_DN_CN"

I get the following error:

Firefox Error:

Peer does not recognize and trust the CA that issued your certificate.
Error code: SSL_ERROR_UNKNOWN_CA_ALERT

Lighttpd Error:

SSL: 1 error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed 
SSL: 1 -1 error:140E0197:SSL routines:SSL_shutdown:shutdown while in ini

Other:

Acceptable client certificate CA names
DC = org, DC = homelab, CN = homelab-V-2019-ICA-CA
Client Certificate Types: RSA sign, DSA sign, ECDSA sign

CA.cer

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:00:00:00:02:47:18:65:49:6e:51:2a:56:00:00:00:00:00:02
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=V-2019-RCA-CA
        Validity
            Not Before: Nov 24 06:00:19 2020 GMT
            Not After : Nov 24 06:10:19 2021 GMT
        Subject: DC=org, DC=homelab, CN=homelab-V-2019-ICA-CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)

Client Certificate

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            56:00:00:00:23:c0:0e:f2:75:d8:de:ef:65:00:00:00:00:00:23
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: DC = org, DC = homelab, CN = homelab-V-2019-ICA-CA
        Validity
            Not Before: Dec  1 23:54:33 2020 GMT
            Not After : Nov 24 06:10:19 2021 GMT
        Subject: C = US, ST = Rhode Island, L = Providence, O = HOMELAB, OU = HOMELAB, CN = homelab-V-2019-ICA-CA.homelab.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
...
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.21.10:

Not sure where to go from here. Any help or articles would be very much appreciated. :)

score 0 · Accepted Answer · answered Dec 22 '20 at 19:42

0

I figured what the issue was if anyone runs into this. It's kind of obvious now that I think of it. I was using the subordinate CA certificate that I downloaded from the ADCS web enrollment page. I instead used the root CA certificate that I exported from the subordinate CA certificate by clicking Certification Path -> View Certificate (On Root CA) -> Details -> Copy to File -> Base-64 encoded X.509). I used this for this line.

ssl.ca-file = "/etc/lighttpd/certs/ca.cer"

I imported the client cert into Firefox and it works fine.

answered Dec 22 '20 at 19:42

poppopretn

21
3

With lighttpd, the recommendation is to include the cert and the intermediate certificate chain in `ssl.pemfile` instead of using a separate file for `ssl.ca-file`. This works for `ssl.pemfile` in the global scope and `$SERVER["socket"]` scope in lighttpd, and in lighttpd 1.4.56 and later, additional works in `$HTTP["host"]` scope in lighttpd.conf. – gstrauss Aug 10 '21 at 05:35

Lighttpd Client Certificate Authentication

1 Answers1