Crowd Apache Connector (mod_authnz_crowd) fails when using https with self signed certificates

I ran into this problem today and wasted many hours debugging & fixing so I thought I would share with the community..

The issue:

when using self signed certificates for SSL, the apache mod_authnz_crowd module (Crowd Apache Connector) rejects the certificate regardless of configuration on the crowd server.

The symptoms:

when setting CrowdURL to a https value in apache you will receive a 500 error through the browser, looking in the apache error_log you will see: "Failed to send authentication request (CURLcode 60)" - this is returned by the CURL library that the module uses to make its connection, and error code 60 from the CURL library can be found here http://curl.haxx.se/libcurl/c/libcurl-errors.html<br< a=""> />
CURLE_SSL_CACERT (60) - Peer certificate cannot be authenticated with known CA certificates.

A quick look at the CURL manual (
http://curl.haxx.se/libcurl/c/curl_easy_setopt.html#CURLOPTSSLVERIFYPEER) reveals: This option determines whether curl verifies the authenticity of the peer's certificate. A value of 1 means curl verifies; 0 (zero) means it doesn't.

The Solution:

Download the source code for mod_authnz_crowd from https://studio.plugins.atlassian.com/svn/CWDAPACHE/tags/2.0.2/ and apply the following patch

--- src/crowd_client.orig    2011-07-29 15:44:46.000000000 +0800
+++ src/crowd_client.c 2011-07-29 15:33:29.000000000 +0800
@@ -517,6 +517,7 @@
#endif
|| curl_easy_setopt(curl_easy, CURLOPT_HTTPHEADER, headers)
|| curl_easy_setopt(curl_easy, CURLOPT_TIMEOUT, config->crowd_timeout)
+ || curl_easy_setopt(curl_easy, CURLOPT_SSL_VERIFYPEER, 0)
|| (post && (curl_easy_setopt(curl_easy, CURLOPT_POST, 1)
|| curl_easy_setopt(curl_easy, CURLOPT_READFUNCTION, read_crowd_authentication_request)
|| curl_easy_setopt(curl_easy, CURLOPT_READDATA, &read_data)

recompile the module, install over the old one in apache and self signed certificates in crowd are no longer a problem!

shame on you atlassian for not even documenting that we cannot use self signed certificates with this module!

2 answers

1 accepted

Hi Jordan,

I too agree that Atlassian hasn't documented well on Connectors for Windows. Which C compiler you used to compile the source. Can you just share this information how you went about generating a connector from the C source. This will too helpful for others who are following the compilation path to generate connectors.

Thanks and Regards,

Anantha

Anantha,

I'm doubt mod_authnz_crowd will compile on Windows - it is an apache module that depends on unix/linux development libraries.

I use GCC - the default linux compiler package and related development packages (autoconf etc..)

I actually compiled the package directly to an RPM using the spec file provided by atlassian at https://studio.plugins.atlassian.com/svn/CWDAPACHE/tags/2.0.2/packages/mod_authnz_crowd.spec but the package does include its own Makefile so you could run it through autoconf/make/gcc yourself.

Since the underlying mechanism to authenticate of the peer's certificate is CURL, you can get around the issue by updating the certificate bundle that CURL uses with your self-signed certificate. You do not need to apply any patches by doing this.

In RedHat Linux, the file and location is: /etc/pki/tls/certs/ca-bundle.crt

(Note: You will need root privileges to update the file as it is owned by root.)

Steps to import your self-signed certificate into the certificate bundle.

1. Export your certificate into a file and store it as Base-64 X.509.

2. On the linux host, use the following command to import the certificate.

$ openssl x509 -in ./your_certificate -text >> /etc/pki/tls/certs/ca-bundle.crt

Suggest an answer

Log in or Join to answer
Community showcase
Emilee Spencer
Published 6 hours ago in Marketplace Apps

Marketplace Spotlight: DeepAffects

Hello Atlassian Community! My name is Emilee, and I’m a Product Marketing Manager for the Marketplace team. Starting with this post, I'm kicking off a monthly series of Spotlights to highlight Ma...

30 views 0 3
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you
Atlassian Team Tour

Join us on the Team Tour

We're bringing product updates and pro tips on teamwork to ten cities around the world.

Save your spot