Topic: Unable to configure X.509 CRL storage certificate revocation

[Truta]

Dear Guru´s
We´re implementing a CRL that cannnot runs when client certificate revogation list paths are activated :
error:

ssl_engine_init.c(661): Configuring permitted SSL ciphers [ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+SSLv3:+EXP:+eNULL ssl_engine_init.c(686): Configuring certificate revocation facility
.[error] Unable to configure X.509 CRL storage for certificate revocation

Landscape :
Apache 2.2
Windows_server2003
server also have a server certificate working fine

Any good tip can be rewarded !
Thank you in advance!
Truta


==> Conf details below:
http-ssl.conf


Listen myserver.org:443


AddType D:/Apache2.2/application/x-x509-ca-cert .crt
AddType D:/Apache2.2/application/x-pkcs7-crl .crl


SSLPassPhraseDialog builtin

SSLSessionCache "shmcb:D:/Apache2.2/logs/ssl_scache"
SSLSessionCacheTimeout 300

SSLMutex default


## SSL Virtual Host Context

<VirtualHost _default_:443>

# General setup for the virtual host
DocumentRoot "D:/Apache2.2/htdocs"
ServerName myserver.org:443
ServerAdmin mymail@mail.com
ErrorLog "D:/Apache2.2/logs/error.log"
TransferLog "D:/Apache2.2/logs/access.log"

# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on

###Export Certifificate to Tomcat##

SSLOptions +ExportCertData
SSLOptions +StdEnvVars

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+SSLv3:+EXP:+eNULL

#SSLCertificateFile "D:/Apache2.2/conf/server-dsa.crt"
SSLCertificateFile conf/ssl/CERT/myserver.org.crt

#SSLCertificateKeyFile "D:/Apache2.2/conf/server-dsa.key"

SSLCertificateKeyFile conf/ssl/CERT/myserver.org_NOKEY.key

#SSLCertificateChainFile "D:/Apache2.2/conf/server-ca.crt"

SSLCertificateChainFile conf/ssl/CERT/Hierarquia-ICP-Brasil.p7b

############# Client Autentication , may I use 2 differents CA´s ?

#SSLCACertificatePath "D:/Apache2.2/conf/ssl.crt"
#SSLCACertificateFile "D:/Apache2.2/conf/ssl.crt/ca-bundle.crt"

SSLCACertificatePath "D:/Apache2.2/conf/ssl/CLI"
SSLCACertificateFile "D:/Apache2.2/conf/ssl/CLI/CA_PEM.crt"

SSLCACertificatePath conf/ssl/CLI2
SSLCACertificateFile conf/ssl/CLI2finalv2.cer


SSLVerifyClient optional_no_ca

<Location /internal>
SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ and %{SSL_CLIENT_S_DN_O} eq "test1" )
#and %{SSL_CLIENT_S_DN_O} eq "Corp" \
#and %{SSL_CLIENT_S_DN_OU} in {"Rio de Janeiro", "BR", "Corp"} )
# \ and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
#and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
#or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/


# Proxy Reverse
ProxyPass http://server1.orgntw.myserver.org:8080/int
ProxyPassReverse http://server1.orgntw.myserver.org:8080/int

## Cookie pass para acessoo JSP###
ProxyPassReverseCookieDomain .server1.orgntw.myserver.org .myserver.org/internal
ProxyPassReverseCookiePath / /internal

</Location>

####SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "D:/Apache2.2/cgi-bin">
SSLOptions +StdEnvVars
</Directory>

nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0


CustomLog "D:/Apache2.2/logs/ssl_request.log" \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>[code][code][/code]

[James Blond]

Did you try a different SSLSessionCache ?