Lighttpd

It is no problem to use self signed CA for client certificates you just need to add the root certificate to the pem file pointed to by ssl.ca-file.

The client certificates are validated against the certificates in ssl.ca-file, not the ones in OS e.g. in /etc/ssl/certs/.

What is your problem with this solution?

To clarify a bit on the error i get, it's this: SSL verify error:num=26:unsupported certificate purpose

The client certificates seem to verify just fine:

lighttpd % openssl verify -CAfile ca.cert.pem -untrusted intermediate.cert.pem client.pem 
client.pem: OK
lighttpd % openssl verify -CAfile ca-chain.cert.pem client.pem 
client.pem: OK

An example of how i try to access the HTTPS + client cert server:

curl --key ca/private/client.key.pem --cert client.pem --cacert ca.cert.pem "https://localhost:3333" 

am i just missing something in the configuration?

You are missing multiple things.

First, never post private certificates to a web forum.

Second, please use the forums to ask questions.
https://redmine.lighttpd.net/projects/lighttpd/boards

This is not a bug. If it were a missing feature, it would be a missing feature.

Third, please try reading the documentation.
https://redmine.lighttpd.net/projects/lighttpd/wiki
https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_ConfigurationOptions
https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_ConfigurationOptions#mod_openssl-TLSSSL-using-openssl

Hint: look at the documentation for config options that start with ssl.*

Finally: please try to understand the options available and try things out before posting questions in the forum.

gstrauss wrote:

am i just missing something in the configuration?

You are missing multiple things.

First, never post private certificates to a web forum.

They are not private certificates, they come from a toy CA never used for anything other than my learning.

Second, please use the forums to ask questions.
https://redmine.lighttpd.net/projects/lighttpd/boards

This is not a bug. If it were a missing feature, it would be a missing feature.

My original question was if this is a missing feature or if i'm missing something in the configuration. The answer seems to be that i'm missing something in the documentation.

Third, please try reading the documentation.
https://redmine.lighttpd.net/projects/lighttpd/wiki
https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_ConfigurationOptions
https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_ConfigurationOptions#mod_openssl-TLSSSL-using-openssl

Hint: look at the documentation for config options that start with ssl.*

I have read them, believe me. It might just be that the documentation isn't as clear to me as it's for you...

Finally: please try to understand the options available and try things out before posting questions in the forum.

I have been trying for two days and cannot get it correct.

I'll try the forum instead. Perhaps i have better luck there...

Based on your posts in the forum, you're trying to do way too many things at once.

Please take the standard build and get it working to serve a simple static file. Then make one change, test it, and if it works, make another change. If it does not work, troubleshoot until it works, and then continue. Rinse and repeat.

Quoting from: https://stackoverflow.com/questions/11884731/openssl-invalid-purpose

There's an extension keyUsage which specifies what can be done with the certificate. Note that some programs are not using this field.

From X509 documentation:

X509_V_ERR_INVALID_PURPOSE: unsupported certificate purpose
the supplied certificate cannot be used for the specified purpose.

Man page x509v3_config(5) lists possible values for the parameter and also for another called extendedKeyUsage

Another explanation:

http://www.openldap.org/lists/openldap-software/200704/msg00129.html

quote:

From the information provided so far, all that's certain is that he has a TLS certificate that is intended for use as a web server authentication certificate. The fact that he's trying to use it in both the server and the client configuration is the problem; the TLS library checks the certificate purpose. The client sent a server cert to the server, and the server won't allow it to be used for client authentication.

So, if the goal is to use certificate-based authentication, then the solution is to generate a proper certificate without any usage restrictions on it, or one that says it can be used for client authentication.

Thanks a lot, your right. The user certificate was indeed holding key usage for an HTTPS server. Everything works after fixing that.

Thanks a lot, you can close this ticket