Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Crowd Apache Connector (mod_authnz_crowd) fails when using https with self signed certificates

Moodle Sysadmin July 28, 2011

I ran into this problem today and wasted many hours debugging & fixing so I thought I would share with the community..

The issue:

when using self signed certificates for SSL, the apache mod_authnz_crowd module (Crowd Apache Connector) rejects the certificate regardless of configuration on the crowd server.

The symptoms:

when setting CrowdURL to a https value in apache you will receive a 500 error through the browser, looking in the apache error_log you will see: "Failed to send authentication request (CURLcode 60)" - this is returned by the CURL library that the module uses to make its connection, and error code 60 from the CURL library can be found here<br< a=""> />
CURLE_SSL_CACERT (60) - Peer certificate cannot be authenticated with known CA certificates.

A quick look at the CURL manual ( reveals: This option determines whether curl verifies the authenticity of the peer's certificate. A value of 1 means curl verifies; 0 (zero) means it doesn't.

The Solution:

Download the source code for mod_authnz_crowd from and apply the following patch

--- src/crowd_client.orig    2011-07-29 15:44:46.000000000 +0800
+++ src/crowd_client.c 2011-07-29 15:33:29.000000000 +0800
@@ -517,6 +517,7 @@
|| curl_easy_setopt(curl_easy, CURLOPT_HTTPHEADER, headers)
|| curl_easy_setopt(curl_easy, CURLOPT_TIMEOUT, config->crowd_timeout)
+ || curl_easy_setopt(curl_easy, CURLOPT_SSL_VERIFYPEER, 0)
|| (post && (curl_easy_setopt(curl_easy, CURLOPT_POST, 1)
|| curl_easy_setopt(curl_easy, CURLOPT_READFUNCTION, read_crowd_authentication_request)
|| curl_easy_setopt(curl_easy, CURLOPT_READDATA, &read_data)

recompile the module, install over the old one in apache and self signed certificates in crowd are no longer a problem!

shame on you atlassian for not even documenting that we cannot use self signed certificates with this module!

2 answers

1 accepted

0 votes
Answer accepted
Moodle Sysadmin July 28, 2011

See above.

krishnan August 10, 2011

Hi Jordan,

I too agree that Atlassian hasn't documented well on Connectors for Windows. Which C compiler you used to compile the source. Can you just share this information how you went about generating a connector from the C source. This will too helpful for others who are following the compilation path to generate connectors.

Thanks and Regards,


Moodle Sysadmin August 10, 2011


I'm doubt mod_authnz_crowd will compile on Windows - it is an apache module that depends on unix/linux development libraries.

I use GCC - the default linux compiler package and related development packages (autoconf etc..)

I actually compiled the package directly to an RPM using the spec file provided by atlassian at but the package does include its own Makefile so you could run it through autoconf/make/gcc yourself.

1 vote
Ratsamy Sourinhong
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
February 24, 2013

Since the underlying mechanism to authenticate of the peer's certificate is CURL, you can get around the issue by updating the certificate bundle that CURL uses with your self-signed certificate. You do not need to apply any patches by doing this.

In RedHat Linux, the file and location is: /etc/pki/tls/certs/ca-bundle.crt

(Note: You will need root privileges to update the file as it is owned by root.)

Steps to import your self-signed certificate into the certificate bundle.

1. Export your certificate into a file and store it as Base-64 X.509.

2. On the linux host, use the following command to import the certificate.

$ openssl x509 -in ./your_certificate -text >> /etc/pki/tls/certs/ca-bundle.crt

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events