我希望Apache在授权用户进入网站之前validation客户的authentication。
在Chrome中，我的错误是：
192.168.2.57 didn't accept your login certificate, or one may not have been provided. Try contacting the system admin. ERR_BAD_SSL_CLIENT_AUTH_CERT` 在Firefox中，我的错误是：
An error occurred during a connection to 192.168.2.57. SSL peer was unable to negotiate an acceptable set of security parameters. Error code: SSL_ERROR_HANDSHAKE_FAILURE_ALERT`
我认为问题在于我甚至没有提示提供我的客户端证书。 我怎样才能启用这两个浏览器？
其他一些信息：我的根和中间的CA存储在Apache上。 他们签署了我的站点证书和我的客户端证书，这些证书也存储在Apache上。 所有这些证书（根CA，中间CA，服务器和客户端）已经加载到我的浏览器。
我的Apacheconfiguration：
<IfModule mod_ssl.c> <VirtualHost 192.168.2.57:443> ServerName 192.168.2.57:443 DocumentRoot /var/www ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined SSLEngine On SSLCertificateFile "/etc/apache2/ssl/ca/intermediate/certs/AlexSite.cert.pem" SSLCertificateKeyFile "/etc/apache2/ssl/ca/intermediate/private/AlexSite.key.pem" SSLProtocol TLSv1 TLSv1.1 SSLCACertificateFile "/etc/apache2/ssl/ca/intermediate/certs/intermediate.cert.pem" <Directory /var/www/> Options Indexes FollowSymLinks MultiViews DirectoryIndex /cgi-bin/index.html AllowOverride None Order allow,deny Allow from all AddHandler mod_python .py PythonHandler mod_python.publisher PythonDebug On SSLVerifyClient require SSLVerifyDepth 1 </Directory> Alias "/mysql-files/" "/var/lib/mysql-files/" <Directory "/var/lib/mysql-files/"> Require all granted Options +Indexes </Directory> ScriptAlias /cgi-bin/ /var/www/cgi-bin/ <Directory /var/www/cgi-bin> AllowOverride None Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from all AddHandler cgi-script .cgi .py </Directory> <FilesMatch "\.(cgi|shtml|phtml|php)$"> SSLOptions +StdEnvVars </FilesMatch> <Directory /usr/lib/cgi-bin> SSLOptions +StdEnvVars </Directory> BrowserMatch "MSIE [2-6]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown </VirtualHost> </IfModule>`
我想到了。 在我的Apache设置中，我改变了：
SSLCACertificatePath到~~~~~~/ca/certs/ca.cert.pem
SSLVerifyDepth 1到SSLVerifyDepth 10
而我改变的最重要的事情是我将客户端证书从pem转换为pfx