semanticscuttle-devel

[Semanticscuttle-devel] Work on #3163623 started: SSL Client Certificates

[Christian W. <cw...@cw...>]

Hi,


I started working on SSL client certificate support today, and you get
already automatically logged in when your client cert ist registered
in the sc_users_sslclientcerts table. Currently you need to manually do
that because the interface to assign them is yet to be written :)

I'm using the following SSL virtual host settings in the apache
configuration:

    SSLEngine On
    SSLCertificateFile /etc/ssl/private/bm.bogo.cweiske.de-cacert.pem
    SSLCertificateKeyFile /etc/ssl/private/bm.bogo.cweiske.de.key

    SSLCACertificateFile /etc/ssl/private/cacert-1and3.crt

    #enable client certificate login
    SSLOptions +StdEnvVars
    SSLVerifyClient optional
    SSLVerifyDepth 1

I used the CAcert CSR generator[1] to generate the key and the csr
file, used the .csr to apply for the certificate @cacert and saved the
certificate I got from them as the .pem. Then I put both their
public class1 (root) and class3 certificates into the cacert-1and3.crt
file and restarted apache.

The option "SSLVerifyClient optional" tells apache to ask for a client
certificate but not to require it, so that users can login normally if
they wish.

If a registered client certificate is provided by the browser, the user
get automatically logged in. Branch is ssl-client-certs; I hope to get
it into 0.98.0.


[1] http://wiki.cacert.org/CSRGenerator


-- 
Regards/Mit freundlichen Grüßen
Christian Weiske

-=≡ Geeking around in the name of science since 1982 ≡=-

Re: [Semanticscuttle-devel] Work on #3163623 started: SSL Client Certificates

[Christian W. <cw...@cw...>]

Hello all,


SSL Client certificate support is finished, apart from documentation.
It would be awesome if someone could test it. Basically you need to
setup HTTPS on your web server, register a client certificate in your
browser and visit your profile page to register the certificate with
your user profile. After that, you will be automatically logged into
SemanticScuttle.

I got my server and client certificate from CAcert.org and used the
following settings in apache:

    SSLEngine On
    SSLCertificateFile /etc/ssl/private/bm.bogo.cweiske.de-cacert.pem
    SSLCertificateKeyFile /etc/ssl/private/bm.bogo.cweiske.de.key

    SSLCACertificateFile /etc/ssl/private/cacert-1and3.crt

    #enable client certificate login
    SSLOptions +StdEnvVars
    SSLVerifyClient optional
    SSLVerifyDepth 1



-- 
Regards/Mit freundlichen Grüßen
Christian Weiske

-=≡ Geeking around in the name of science since 1982 ≡=-

Re: [Semanticscuttle-devel] Work on #3163623 started: SSL Client Certificates

[Christian W. <cw...@cw...>]

Hello Brett,


> > SSL Client certificate support is finished, apart from
> > documentation. It would be awesome if someone could test it.
> Does this need to be tested before 0.98.0?

That would be great. I wrote (hopefully) exhaustive documentation in
doc/ssl-client-certs.rst that you can follow. If you want pretty HTML,
install the docutils package and use rst2html, or just read
http://tmp.cweiske.de/ssl-client-certificates.html


-- 
Regards/Mit freundlichen Grüßen
Christian Weiske

-=≡ Geeking around in the name of science since 1982 ≡=-

Re: [Semanticscuttle-devel] Work on #3163623 started: SSL Client Certificates

[Brett D. <bs...@fr...>]

Hello, Christian.

This is taking me a bit longer than I anticipated, mostly because I'm
still using a Windows environment, but I'll keep chipping away at it
over the next week.

Rgrds,
Brett

On Fri, 13 May 2011 07:36:01 +0200, Christian Weiske
<cw...@cw...> wrote:
> Hello Brett,
> 
> 
>> > SSL Client certificate support is finished, apart from
>> > documentation. It would be awesome if someone could test it.
>> Does this need to be tested before 0.98.0?
> 
> That would be great. I wrote (hopefully) exhaustive documentation in
> doc/ssl-client-certs.rst that you can follow. If you want pretty HTML,
> install the docutils package and use rst2html, or just read
> http://tmp.cweiske.de/ssl-client-certificates.html