I ran into this problem today and wasted many hours debugging & fixing so I thought I would share with the community..
The issue:
when using self signed certificates for SSL, the apache mod_authnz_crowd module (Crowd Apache Connector) rejects the certificate regardless of configuration on the crowd server.
The symptoms:
when setting CrowdURL to a https value in apache you will receive a 500 error through the browser, looking in the apache error_log you will see: "Failed to send authentication request (CURLcode 60)" - this is returned by the CURL library that the module uses to make its connection, and error code 60 from the CURL library can be found here http://curl.haxx.se/libcurl/c/libcurl-errors.html<br< a=""> />
CURLE_SSL_CACERT (60) - Peer certificate cannot be authenticated with known CA certificates.
A quick look at the CURL manual (http://curl.haxx.se/libcurl/c/curl_easy_setopt.html#CURLOPTSSLVERIFYPEER) reveals: This option determines whether curl verifies the authenticity of the peer's certificate. A value of 1 means curl verifies; 0 (zero) means it doesn't.
The Solution:
Download the source code for mod_authnz_crowd from https://studio.plugins.atlassian.com/svn/CWDAPACHE/tags/2.0.2/ and apply the following patch
--- src/crowd_client.orig 2011-07-29 15:44:46.000000000 +0800
+++ src/crowd_client.c 2011-07-29 15:33:29.000000000 +0800
#endif
|| curl_easy_setopt(curl_easy, CURLOPT_HTTPHEADER, headers)
|| curl_easy_setopt(curl_easy, CURLOPT_TIMEOUT, config->crowd_timeout)
+ || curl_easy_setopt(curl_easy, CURLOPT_SSL_VERIFYPEER, 0)
|| (post && (curl_easy_setopt(curl_easy, CURLOPT_POST, 1)
|| curl_easy_setopt(curl_easy, CURLOPT_READFUNCTION, read_crowd_authentication_request)
|| curl_easy_setopt(curl_easy, CURLOPT_READDATA, &read_data)
recompile the module, install over the old one in apache and self signed certificates in crowd are no longer a problem!
shame on you atlassian for not even documenting that we cannot use self signed certificates with this module!
