Following instructions to add client certificate authentication to webmin account, I created a CA, then requested an SSL Certificate on the Webmin Users screen. I used firefox 65.0.2 to login to webmin for the following procedure.
The request fails with the following error when running with the Authentic Theme:
Using configuration from /etc/webmin/acl/openssl.cnf
unable to load Netscape SPKAC structure
139902235817624:error:0D06407A:asn1 encoding routines:a2d_ASN1_OBJECT:first num too large:a_object.c:108:
139902235817624:error:0B081076:x509 certificate routines:NETSCAPE_SPKI_b64_decode:base64 decode error:x509spki.c:94:
Switching to Grey Framed Theme, the request proceeds to the next step correctly:
Your certificate for admin has been successfully generated.
Click here to pick up your certificate and install it in your browser
<- Return to user list
However, clicking the link to pick up certificate results in a failed TLS connection between firefox and webmin:
The connection to the server was reset while the page was loading.
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.
Looking in the /etc/webmin/acl/newcerts/ directory, the new client certificate has been generated and is stored in a pem file. There are no certificate/key pair installed in firefox after clicking the link to "pick up your certificate and install it in your browser" Also, the user record in /etc/webmin/miniserv.user shows it has been modified to use client cert authentication. The user record has to be reverted otherwise the TLS session error is persistent when trying to connect to webmin.
Does anyone have a suggestion on how to get client certificate authentication working? Is there a log file I can attach to assist with troubleshooting?
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Webmin version: 1.900
Authentic Theme: 19.31
Following instructions to add client certificate authentication to webmin account, I created a CA, then requested an SSL Certificate on the Webmin Users screen. I used firefox 65.0.2 to login to webmin for the following procedure.
The request fails with the following error when running with the Authentic Theme:
Using configuration from /etc/webmin/acl/openssl.cnf
unable to load Netscape SPKAC structure
139902235817624:error:0D06407A:asn1 encoding routines:a2d_ASN1_OBJECT:first num too large:a_object.c:108:
139902235817624:error:0B081076:x509 certificate routines:NETSCAPE_SPKI_b64_decode:base64 decode error:x509spki.c:94:
Switching to Grey Framed Theme, the request proceeds to the next step correctly:
Your certificate for admin has been successfully generated.
Click here to pick up your certificate and install it in your browser
<- Return to user list
However, clicking the link to pick up certificate results in a failed TLS connection between firefox and webmin:
The connection to the server was reset while the page was loading.
Looking in the /etc/webmin/acl/newcerts/ directory, the new client certificate has been generated and is stored in a pem file. There are no certificate/key pair installed in firefox after clicking the link to "pick up your certificate and install it in your browser" Also, the user record in /etc/webmin/miniserv.user shows it has been modified to use client cert authentication. The user record has to be reverted otherwise the TLS session error is persistent when trying to connect to webmin.
Does anyone have a suggestion on how to get client certificate authentication working? Is there a log file I can attach to assist with troubleshooting?
I also am experiencing the same problem with 1.910 on Debian 9. I am not sure which attribute its complaining about that is too long.
Last edit: Rob Stevens 2019-06-02