Client certification

If the client systems (user workstations, proxies, single sign-on systems, etc.) sending client certificates to the web server along with HTTPS requests and a verification of these certificates is required following settings must be done. After this is configured all the requests sent from systems not providing valid client certificates will be rejected.

Copy the certification authority (CA) certificate file of the CA which released the client certificates into the httpd/config.d subdirectory of the HWF installation.

Add the following lines (if they are not already there) in the section of the .conf configuration file of the Web Server of ProcMan:

SSLVerifyClient require
SSLVerifyDepth 10
SSLCACertificateFile conf.d/<ca_certificate_file>
<Location />
 SSLRequire <client_certificate_check>
</Location>

Replace <ca_certificate_file> with the real name of the CA certificate file you previously copied to httpd/config.d.

Replace <client_certificate_check> with an expression for the client certificate validation.

For more information of how these expression looks like, see the Apache documentation (http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslrequire) and the example below.

Example (.conf):

...
<VirtualHost procman.my_company.com:11443>
 ...
 SSLVerifyClient require
 SSLVerifyDepth 10
 SSLCACertificateFile conf.d/company_ca.crt
 <Location />
 SSLRequire %{SSL_CLIENT_S_DN_O} == "My Company Ltd." \
 && %{SSL_CLIENT_S_DN_OU} == "My Company CA" \
 && %{SSL_CLIENT_S_DN_CN} == "procman_client.my_company.com"
 </Location>
 ...
</VirtualHost>
...