Listmates, I am having fits accessing my server with SSL. I have built all certificates and installed them and things seems to be working: [22:36 nirvana~/CA/newset] # httpd2 -S -DSSL VirtualHost configuration: wildcard NameVirtualHosts and _default_ servers: _default_:443 www.3111skyline.com (/etc/apache2/vhosts.d/vhost-ssl.conf:37) Syntax OK However, when I try and access the server, I get: Forbidden You don't have permission to access / on this server. Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request. Apache/2.2.4 (Linux/SUSE) Server at www.3111skyline.com Port 443 The apache logs are not that helpful with the problem: error_log says: [Tue May 06 22:36:50 2008] [error] [client 192.168.6.101] access to /srv/www/testdir/ failed, reason: SSL requirement expression not fulfilled (see SSL logfile for more details) [Tue May 06 22:36:50 2008] [error] [client 192.168.6.101] access to /srv/www/htdocs/ failed, reason: SSL requirement expression not fulfilled (see SSL logfile for more details) [Tue May 06 22:36:50 2008] [error] [client 192.168.6.101] access to /usr/share/apache2/error/HTTP_FORBIDDEN.html.var failed, reason: SSL requirement expression not fulfilled (see SSL logfile for more details) ssl_reques_log adds only a little: [06/May/2008:22:36:50 -0500] 192.168.6.101 TLSv1 DHE-RSA-AES256-SHA "GET /testdir/ HTTP/1.1" 300 "-" "Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.9 (like Gecko) SUSE" [06/May/2008:22:36:50 -0500] 192.168.6.101 TLSv1 DHE-RSA-AES256-SHA "GET / HTTP/1.1" - "-" "Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.9 (like Gecko) SUSE" The certificates are seen and accepted both by konqueror and firefox. They give the options to use them "forever". The vhost config is: [23:04 nirvana/etc/apache2/vhosts.d] # grep -v '#' vhost-ssl.conf | grep -v ^$ <IfDefine SSL> <VirtualHost _default_:443> DocumentRoot "/srv/www/htdocs" ServerName www.3111skyline.com:443 ServerAdmin dell@3111skyline.com ErrorLog /var/log/apache2/error_log TransferLog /var/log/apache2/access_log SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLCertificateFile /etc/apache2/ssl.crt/server.crt SSLCertificateKeyFile /etc/apache2/ssl.key/server.key SSLCertificateChainFile /etc/apache2/ssl.crt/server.crt SSLCACertificatePath /etc/apache2/ssl.crt SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt <Location /> SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ </Location> SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire SSLOptions +StdEnvVars </Files> SSLOptions +StdEnvVars </Directory> SetEnvIf User-Agent ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 CustomLog /var/log/apache2/ssl_request_log ssl_combined </VirtualHost> </IfDefine> </IfDefine> With the certificates generated by: #!/bin/bash md newkeyset cd newset/ openssl genrsa -des3 -out server.key 1024 openssl req -new -key server.key -out server.csr cp server.key server.key.protected openssl rsa -in server.key.protected -out server.key openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt cp server.crt /etc/apache2/ssl.crt cp server.key /etc/apache2/ssl.key cp server.csr /etc/apache2/ssl.csr The http.conf.local directory directive looks like: SSLOptions +StrictRequire SSLRequireSSL SSLRequire %{HTTP_HOST} eq "www.3111skyline.com" ErrorDocument 403 https://www.3111skyline.com <snip> But still I must be missing a piece of the puzzle. Anybody have ssl working with apache that wouldn't mind sharing the secret or a good howto, I would much appreciate it. -- David C. Rankin, J.D., P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org