CSS and Client Authentication

[patrickg]

I cannot get the CSS to present the web page after I select my local certificate. I have verified access to the page works with SSL without Client Auth. When I enable client authentication I get prompted, I select the cert, and then I get "Page cannot be displayed". I ran a sniff on the client and I can see a successfull SSLv3 handshake and then then nothing happens. I am running WebNS 07.40.1.03.

Please help.

Thx,

Patrick

[Gilles Dufour]

Can you get a 'sho ssl statistics | grep auth' before and after attempting a connection.

See if the authentication is successful or not for the CSS.

Regards,

Gilles.

[patrickg]

I am getting failed client authentications.

Lab-CSS# sh ssl statistics | grep auth

0 Successful client authentications

2 Failed client authentications

0 Successful server authentications

0 Server authentications failed

My SSL works fine and I am pulling my client certs from the same server as the server I setup the SSL with.

Here's my config

ssl associate rsakey helix-ssl rsa1024.pem

ssl associate cert helix-ssl css-cert.cer

ssl associate cert Prophit-CA Prophit-CA1.cer

ssl crl-record mycrl http://176.10.152.16/CertEnroll/ProphIT_CA1.crl Prophit-CA 1

ssl-proxy-list ssl-list1

ssl-server 20

ssl-server 20 rsacert helix-ssl

ssl-server 20 rsakey helix-ssl

ssl-server 20 vip address 172.1.1.11

ssl-server 20 cipher rsa-with-rc4-128-md5 172.1.1.10 80

ssl-server 20 version ssl

ssl-server 20 cacert Prophit-CA

ssl-server 20 cacert helix-ssl

ssl-server 20 authentication enable

ssl-server 20 failure ignore

ssl-server 20 cipher rsa-with-3des-ede-cbc-sha 172.1.1.10 80

ssl-server 20 cipher rsa-with-des-cbc-sha 172.1.1.10 80

ssl-server 20 cipher rsa-with-rc4-128-sha 172.1.1.10 80

active

service helix-ssl

type ssl-accel

slot 3

keepalive type none

add ssl-proxy-list ssl-list1

active

[patrickg]

Correction. I had a HW problem with my SSL module. It rebooted and the SSL module did not come back. OK...after I replaced the module and I show a successful client authentication. Here are the results

Lab-CSS# sh ssl statistics | grep auth

1 Successful client authentications

0 Failed client authentications

0 Successful server authentications

0 Server authentications failed

The config I posted earlier is still valid.

Thanks,

Patrick