SSL_CLIENT_CERT_CHAIN 未传递到后端服务器

Question

我已配置客户端证书并在 Apache 中工作。我想将客户端的 PEM 编码的 X.509 证书传递给后端服务器。

我尝试使用 SSLOptions +ExportCertData。这根本没有任何作用，而文档指出它应该添加 SSL_SERVER_CERT、SSL_CLIENT_CERT 和 SSL_CLIENT_CERT_CHAINn（n = 0,1,2,..）作为标头。任何想法为什么这个选项不起作用？

然后我尝试使用 RequestHeader 自己设置标头。这适用于除 SSL_CLIENT_CERT_CHAIN 之外的所有变量。它在标题中显示为空。为什么没有填充证书链的任何想法？

这是我的第一个 Apache 配置：

<VirtualHost 192.168.56.100:443>
    ServerName www.test.org
    ServerAdmin webmaster@localhost

    DocumentRoot /var/www

    ErrorLog ${APACHE_LOG_DIR}/error.log
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

    SSLEngine on
    SSLProxyEngine on

    SSLCertificateFile     /etc/apache2/ssl/certs/www.test.org.crt
    SSLCertificateKeyFile  /etc/apache2/ssl/private/www.test.org.key
    SSLCACertificateFile   /etc/apache2/ssl/ca/ca.crt

    <Proxy *>
        AddDefaultCharset Off
        Order deny,allow
        Allow from all
    </Proxy>

    <Location /carbon>
        ProxyPass          http://www.test.org:9763/carbon
        ProxyPassReverse   http://www.test.org:9763/carbon
    </Location>

    <Location /services/GbTestProxy>
        SSLVerifyClient require
        SSLVerifyDepth  5
        SSLOptions +ExportCertData

        ProxyPass          http://www.test.org:8888/services/GbTestProxy 
        ProxyPassReverse   http://www.test.org:8888/services/GbTestProxy 
    </Location>
</VirtualHost>

这是我的第二个 Apache 配置：

<VirtualHost 192.168.56.100:443>
    ServerName www.test.org
    ServerAdmin webmaster@localhost

    DocumentRoot /var/www

    ErrorLog ${APACHE_LOG_DIR}/error.log
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

    SSLEngine on
    SSLProxyEngine on

    SSLCertificateFile     /etc/apache2/ssl/certs/www.test.org.crt
    SSLCertificateKeyFile  /etc/apache2/ssl/private/www.test.org.key
    SSLCACertificateFile   /etc/apache2/ssl/ca/ca.crt

    <Proxy *>
        AddDefaultCharset Off
        Order deny,allow
        Allow from all
    </Proxy>

    <Location /carbon>
        ProxyPass          http://www.test.org:9763/carbon
        ProxyPassReverse   http://www.test.org:9763/carbon
    </Location>

    <Location /services/GbTestProxy>
        SSLVerifyClient require
        SSLVerifyDepth  5
        SSLOptions +ExportCertData

        RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
        RequestHeader set SSL_CLIENT_I_DN "%{SSL_CLIENT_I_DN}s"
        RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_SERVER_S_DN_CN}s"
        RequestHeader set SSL_SERVER_S_DN_OU "%{SSL_SERVER_S_DN_OU}s"
        RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
        RequestHeader set SSL_CLIENT_CERT_CHAIN_0 "%{SSL_CLIENT_CERT_CHAIN_0}s"
        RequestHeader set SSL_CLIENT_CERT_CHAIN_1 "%{SSL_CLIENT_CERT_CHAIN_1}s"
        RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"

        ProxyPass          http://www.test.org:8888/services/GbTestProxy 
        ProxyPassReverse   http://www.test.org:8888/services/GbTestProxy 
    </Location>
</VirtualHost>

希望有人能帮忙。

问候，尼基尔

Answer 1

SSLOptions +ExportCertData不会将标头添加到代理请求中，它会添加环境变量 - 您尝试添加到第二个配置中的标头中的环境变量（但它们不在环境中，因为您删除了配置SSLOptions） 。

您将需要配置RequestHeader set和SSLOptions +ExportCertData.