ERR_BAD_SSL_CLIENT_AUTH_CERT

[Mark Cogan]

I am attempting to set up a reverse proxy (for deployment to use CAC-PIV software).  Before I deploy I get the following error:

This site can’t provide a secure connection

<SITE> didn’t accept your login certificate, or one may not have been provided.

• Try contacting the system admin.

ERR_BAD_SSL_CLIENT_AUTH_CERT

I have confirmed that the site is "secure" and that the certificates appear to be good.  If I turn off SSLVerifyClient the error changes to being too many redirects.  Here is the VirtualHost section from my httpd.conf:

<VirtualHost *:443>
ServerName <<SERVER>>
ProxyRequests Off
ProxyVia Off

<Proxy *>
# Require all granted
Order allow,deny
Allow from all
</Proxy>

ProxyPass / http://localhost:8080
ProxyPassReverse / http://localhost:8080

SSLEngine On
SSLProxyEngine On
SSLCertificateFile "/etc/httpd/certs/<SERVER>.crt"
SSLCertificateKeyFile "/etc/httpd/certs/<SERVER>.key"
SSLOptions +StdEnvVars +ExportCertData

# Allow username/password fallback
# SSLVerifyClient optional
SSLVerifyClient require

SSLCACertificatePath /etc/pki/tls/ca-dod/
#SSLCACertificateFile /etc/pki/tls/ca-dod/bizops-CA-CA.crt
SSLVerifyDepth 10
# Reset all headers
RequestHeader set SSL_CLIENT_S_DN ""
# Setting headers with data from the certificate
RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
# Rewrite to HTTPS
RewriteEngine on
# redirect requests with arguments with the arguments
RewriteCond %{QUERY_STRING} !^$
RewriteRule ^/(.*)$ https://%{HTTP_HOST}/$1?%{QUERY_STRING} [R,L]
# all others redirect without the argument
RewriteRule ^/(.*)$ https://%{HTTP_HOST}/$1 [R,L]
# Maintain Application Links
RewriteEngine On
RewriteCond %{REMOTE_ADDR} 127.0.0.1 [OR]
RewriteCond %{REMOTE_ADDR} 10.10.2.*
RewriteCond %{SSL:SSL_CLIENT_VERIFY} NONE
RewriteRule ^ - [P,QSA,L]
RewriteCond %{REMOTE_ADDR} !^127.0.0.1
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !SUCCESS
RewriteRule ^ - [F]
# Disable forward proxying
ProxyRequests Off
ProxyVia Off

</VirtualHost>

[Mark Cogan]

So I realized I didn't have a CRL identified either and added it, no luck.

SSLEngine On
SSLProxyEngine On
SSLCertificateFile "/etc/httpd/certs/<SERVER>.crt"
SSLCertificateKeyFile "/etc/httpd/certs/<SERVER>.key"
SSLOptions +StdEnvVars +ExportCertData

# Allow username/password fallback
SSLVerifyClient require

SSLCACertificatePath /etc/pki/tls/ca-dod/
SSLCARevocationPath /etc/pki/tls/ca-dod/
SSLVerifyDepth 10

Is there anything else I'm missing here?

[Mark Cogan]

I suspect at this point if I can get the certificate to be recognized things will work.  It looks like it's rejecting the newly generated certificate.  It may be format.  If I change  SSLVerifyClient to optional it gets caught in an infinite loop trying to forward, getting kicked back to 8080, then trying to forward again.

[Sanket Parmar]

It could be due to a few things.

1. Expired client certificate
2. Misconfigured settings
3. Outdated browser or OS
4. Incorrect date/time on the client side
5. Conflict with browser extensions or other software

Update your browser to the latest version, then clear your browser Cache and Cookies.

Here it's explained in detail - https://cheapsslweb.com/resources/how-to-fix-the-err_bad_ssl_client_auth_cert-error