Re: [TLS] [Fwd: WWW-Authenticate challenge for client-certificates]

[Joe Orton <[e-mail]>]

On Tue, Jan 19, 2010 at 02:40:54PM +0000, Bruno Harbulot wrote:
...
> This leads to a couple of problems:
> - The HTTP application is unable to inform the client it would rather
> have another certificate than the one that is presented. Whether-or-not
> to accept the certificate is done by the trust management mechanism of
> the TLS layer, and it is difficult for the HTTP application to deal
> with. Often, once the certificate has been negotiated, browsers usually
> keep the TLS connection open and changing certificate can often only be
> done by closing the browser or letting the connection time out.
> - If a certificate is mandatory, the 'require' mode leads to a handshake
> error code on the client side, resulting in an abrupt error message,
> which is confusing for most users.

I don't see how either of these problems are a consequence of protocol 
design, merely server implementation or configuration.

It is simple to configure mod_ssl to avoid the second problem - you make 
client certificates requested but optional ("SSLVerifyClient optional"), 
and then use an HTTP authorization-level check to present an HTTP 403 
error if in fact the TLS layer did not receive a client cert (using 
"SSLRequire").  The 403 error page can be customized as usual.

You could do something similar for the first problem though the 
configuration might be a little awkward.

Regards, Joe