I am attempting to set up a reverse proxy (for deployment to use CAC-PIV software). Before I deploy I get the following error:
This site can’t provide a secure connection
<SITE> didn’t accept your login certificate, or one may not have been provided.
- Try contacting the system admin.
ERR_BAD_SSL_CLIENT_AUTH_CERT
I have confirmed that the site is "secure" and that the certificates appear to be good. If I turn off SSLVerifyClient the error changes to being too many redirects. Here is the VirtualHost section from my httpd.conf:
<VirtualHost *:443>
ServerName <<SERVER>>
ProxyRequests Off
ProxyVia Off
<Proxy *>
# Require all granted
Order allow,deny
Allow from all
</Proxy>
ProxyPass / http://localhost:8080
ProxyPassReverse / http://localhost:8080
SSLEngine On
SSLProxyEngine On
SSLCertificateFile "/etc/httpd/certs/<SERVER>.crt"
SSLCertificateKeyFile "/etc/httpd/certs/<SERVER>.key"
SSLOptions +StdEnvVars +ExportCertData
# Allow username/password fallback
# SSLVerifyClient optional
SSLVerifyClient require
SSLCACertificatePath /etc/pki/tls/ca-dod/
#SSLCACertificateFile /etc/pki/tls/ca-dod/bizops-CA-CA.crt
SSLVerifyDepth 10
# Reset all headers
RequestHeader set SSL_CLIENT_S_DN ""
# Setting headers with data from the certificate
RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
# Rewrite to HTTPS
RewriteEngine on
# redirect requests with arguments with the arguments
RewriteCond %{QUERY_STRING} !^$
RewriteRule ^/(.*)$ https://%{HTTP_HOST}/$1?%{QUERY_STRING} [R,L]
# all others redirect without the argument
RewriteRule ^/(.*)$ https://%{HTTP_HOST}/$1 [R,L]
# Maintain Application Links
RewriteEngine On
RewriteCond %{REMOTE_ADDR} 127.0.0.1 [OR]
RewriteCond %{REMOTE_ADDR} 10.10.2.*
RewriteCond %{SSL:SSL_CLIENT_VERIFY} NONE
RewriteRule ^ - [P,QSA,L]
RewriteCond %{REMOTE_ADDR} !^127.0.0.1
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !SUCCESS
RewriteRule ^ - [F]
# Disable forward proxying
ProxyRequests Off
ProxyVia Off
</VirtualHost>
