I am installing a .crl in my apache config. It looks like this:
VirtualHost default
DocumentRoot "web"
ServerName example.com
SSLEngine on
SSLCertificateFile "cert.crt"
SSLCertificateKeyFile "key.key"
SSLCertificateChainFile "cert.ca-bundle"
SSLProtocol -all +SSLv3
SSLCipherSuite SSLv3:+HIGH:+MEDIUM
Directory
Order deny,allow
Allow from all
SSLCACertificateFile "ClientRootCert.crt"
SSLVerifyClient require
SSLVerifyDepth 3
SSLCARevocationFile "CRLList.crl"
Directory
VirtualHost
When Apache is started, I get the error:
SSLCARevocationFile not allowed here
When I place SSLCARevocationFile above the Directory tag, Apache starts, but all client certs are rejected with the message:
ssl_error_expired_cert_alert (both revoked and active certs)
How to solve this?
No comments:
Post a Comment