Update 16.04 LTS - 18.04 LTS - tls_process_client_certificate:certificate verify failed - when using a PSS...












1















we use a Clientauth configuration for a location without problems for many months



Ubuntu 16.04.5 LTS
Apache 2.4.18-2ubuntu3.9
openssl 1.0.2g-1ubuntu4.13



Now we upgraded to use HTTP2



Ubuntu 18.04.1 LTS
Apache 2.4.29-1ubuntu4.3
Openssl 1.1.0g-2ubuntu4.1



Apache Conf:



 SSLEngine on
SSLVerifyDepth 2
SSLProxyEngine on
SSLProtocol -All +TLSv1.2 +TLSv1.1

SSLCipherSuite HIGH:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!EXP:!DES:!RC4:!3DES:!MD5:!PSK:!MEDIUM:!LOW:!SRP:!DSS

SSLCertificateFile /etc/apache2/ssl/blablub.pem
SSLCertificateKeyFile /etc/apache2/ssl/blablub.key
SSLCertificateChainFile /etc/apache2/ssl/blablub.ca_certificates.pem
SSLCACertificateFile /etc/apache2/ssl/ProductiveCAClientAuth.pem

....other stuff without ClientAuth...

<Location /test>
SSLVerifyClient require
SSLVerifyDepth 2

ProxyPass https://server-1/test
ProxyPassReverse https://server-1/testg

</Location>


Particularity:



The client certificates are issued by an intermediate CA which is itself RSA-PSS Signed.
The root CA and the actual client certificates are signed normally RSA-SHA256.
Do not ask why, that's how it was built in the past and has worked so far



Error:



[Tue Sep 25 07:18:27.723798 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(757): [client 89.187.203.114:61120] AH02255: Changed client verification type will force renegotiation
[Tue Sep 25 07:18:27.723803 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02221: Requesting connection re-negotiation
[Tue Sep 25 07:18:27.723827 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(987): [client 89.187.203.114:61120] AH02260: Performing full renegotiation: complete handshake protocol (client does support secu
re renegotiation)
[Tue Sep 25 07:18:27.723867 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02226: Awaiting re-negotiation handshake
[Tue Sep 25 07:18:33.176966 2018] [ssl:error] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02261: Re-negotiation handshake failed
[Tue Sep 25 07:18:33.176987 2018] [ssl:error] [pid 49219:tid 140033499584256] SSL Library Error: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
[Tue Sep 25 07:18:33.177005 2018] [core:trace3] [pid 49219:tid 140033499584256] request.c(119): [client 89.187.203.114:61120] auth phase 'check access (with Satisfy All)' gave status 403: /test/
[Tue Sep 25 07:18:33.177032 2018] [headers:debug] [pid 49219:tid 140033499584256] mod_headers.c(900): AH01503: headers: ap_headers_error_filter()
[Tue Sep 25 07:18:33.177057 2018] [http:trace3] [pid 49219:tid 140033499584256] http_filters.c(1128): [client 89.187.203.114:61120] Response sent with status 403, headers:
[Tue Sep 25 07:18:33.177062 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1135): [client 89.187.203.114:61120] Date: Tue, 25 Sep 2018 05:18:27 GMT
[Tue Sep 25 07:18:33.177066 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1138): [client 89.187.203.114:61120] Server: Apache/2.4.34 (Ubuntu)
[Tue Sep 25 07:18:33.177071 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] X-Frame-Options: SAMEORIGIN
[Tue Sep 25 07:18:33.177075 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Content-Length: 320
[Tue Sep 25 07:18:33.177080 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Connection: close
[Tue Sep 25 07:18:33.177084 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Content-Type: text/html; charset=iso-8859-1


We tested it all again with client certificates issued by a SHA256 intermediat CA. This works without problems.
As I suspect that by updating Apache or openssl there is now a problem with PSS signed issuers.
Someone has an idea what you can do to make it fly again?










share|improve this question



























    1















    we use a Clientauth configuration for a location without problems for many months



    Ubuntu 16.04.5 LTS
    Apache 2.4.18-2ubuntu3.9
    openssl 1.0.2g-1ubuntu4.13



    Now we upgraded to use HTTP2



    Ubuntu 18.04.1 LTS
    Apache 2.4.29-1ubuntu4.3
    Openssl 1.1.0g-2ubuntu4.1



    Apache Conf:



     SSLEngine on
    SSLVerifyDepth 2
    SSLProxyEngine on
    SSLProtocol -All +TLSv1.2 +TLSv1.1

    SSLCipherSuite HIGH:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!EXP:!DES:!RC4:!3DES:!MD5:!PSK:!MEDIUM:!LOW:!SRP:!DSS

    SSLCertificateFile /etc/apache2/ssl/blablub.pem
    SSLCertificateKeyFile /etc/apache2/ssl/blablub.key
    SSLCertificateChainFile /etc/apache2/ssl/blablub.ca_certificates.pem
    SSLCACertificateFile /etc/apache2/ssl/ProductiveCAClientAuth.pem

    ....other stuff without ClientAuth...

    <Location /test>
    SSLVerifyClient require
    SSLVerifyDepth 2

    ProxyPass https://server-1/test
    ProxyPassReverse https://server-1/testg

    </Location>


    Particularity:



    The client certificates are issued by an intermediate CA which is itself RSA-PSS Signed.
    The root CA and the actual client certificates are signed normally RSA-SHA256.
    Do not ask why, that's how it was built in the past and has worked so far



    Error:



    [Tue Sep 25 07:18:27.723798 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(757): [client 89.187.203.114:61120] AH02255: Changed client verification type will force renegotiation
    [Tue Sep 25 07:18:27.723803 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02221: Requesting connection re-negotiation
    [Tue Sep 25 07:18:27.723827 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(987): [client 89.187.203.114:61120] AH02260: Performing full renegotiation: complete handshake protocol (client does support secu
    re renegotiation)
    [Tue Sep 25 07:18:27.723867 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02226: Awaiting re-negotiation handshake
    [Tue Sep 25 07:18:33.176966 2018] [ssl:error] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02261: Re-negotiation handshake failed
    [Tue Sep 25 07:18:33.176987 2018] [ssl:error] [pid 49219:tid 140033499584256] SSL Library Error: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
    [Tue Sep 25 07:18:33.177005 2018] [core:trace3] [pid 49219:tid 140033499584256] request.c(119): [client 89.187.203.114:61120] auth phase 'check access (with Satisfy All)' gave status 403: /test/
    [Tue Sep 25 07:18:33.177032 2018] [headers:debug] [pid 49219:tid 140033499584256] mod_headers.c(900): AH01503: headers: ap_headers_error_filter()
    [Tue Sep 25 07:18:33.177057 2018] [http:trace3] [pid 49219:tid 140033499584256] http_filters.c(1128): [client 89.187.203.114:61120] Response sent with status 403, headers:
    [Tue Sep 25 07:18:33.177062 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1135): [client 89.187.203.114:61120] Date: Tue, 25 Sep 2018 05:18:27 GMT
    [Tue Sep 25 07:18:33.177066 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1138): [client 89.187.203.114:61120] Server: Apache/2.4.34 (Ubuntu)
    [Tue Sep 25 07:18:33.177071 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] X-Frame-Options: SAMEORIGIN
    [Tue Sep 25 07:18:33.177075 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Content-Length: 320
    [Tue Sep 25 07:18:33.177080 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Connection: close
    [Tue Sep 25 07:18:33.177084 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Content-Type: text/html; charset=iso-8859-1


    We tested it all again with client certificates issued by a SHA256 intermediat CA. This works without problems.
    As I suspect that by updating Apache or openssl there is now a problem with PSS signed issuers.
    Someone has an idea what you can do to make it fly again?










    share|improve this question

























      1












      1








      1








      we use a Clientauth configuration for a location without problems for many months



      Ubuntu 16.04.5 LTS
      Apache 2.4.18-2ubuntu3.9
      openssl 1.0.2g-1ubuntu4.13



      Now we upgraded to use HTTP2



      Ubuntu 18.04.1 LTS
      Apache 2.4.29-1ubuntu4.3
      Openssl 1.1.0g-2ubuntu4.1



      Apache Conf:



       SSLEngine on
      SSLVerifyDepth 2
      SSLProxyEngine on
      SSLProtocol -All +TLSv1.2 +TLSv1.1

      SSLCipherSuite HIGH:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!EXP:!DES:!RC4:!3DES:!MD5:!PSK:!MEDIUM:!LOW:!SRP:!DSS

      SSLCertificateFile /etc/apache2/ssl/blablub.pem
      SSLCertificateKeyFile /etc/apache2/ssl/blablub.key
      SSLCertificateChainFile /etc/apache2/ssl/blablub.ca_certificates.pem
      SSLCACertificateFile /etc/apache2/ssl/ProductiveCAClientAuth.pem

      ....other stuff without ClientAuth...

      <Location /test>
      SSLVerifyClient require
      SSLVerifyDepth 2

      ProxyPass https://server-1/test
      ProxyPassReverse https://server-1/testg

      </Location>


      Particularity:



      The client certificates are issued by an intermediate CA which is itself RSA-PSS Signed.
      The root CA and the actual client certificates are signed normally RSA-SHA256.
      Do not ask why, that's how it was built in the past and has worked so far



      Error:



      [Tue Sep 25 07:18:27.723798 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(757): [client 89.187.203.114:61120] AH02255: Changed client verification type will force renegotiation
      [Tue Sep 25 07:18:27.723803 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02221: Requesting connection re-negotiation
      [Tue Sep 25 07:18:27.723827 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(987): [client 89.187.203.114:61120] AH02260: Performing full renegotiation: complete handshake protocol (client does support secu
      re renegotiation)
      [Tue Sep 25 07:18:27.723867 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02226: Awaiting re-negotiation handshake
      [Tue Sep 25 07:18:33.176966 2018] [ssl:error] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02261: Re-negotiation handshake failed
      [Tue Sep 25 07:18:33.176987 2018] [ssl:error] [pid 49219:tid 140033499584256] SSL Library Error: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
      [Tue Sep 25 07:18:33.177005 2018] [core:trace3] [pid 49219:tid 140033499584256] request.c(119): [client 89.187.203.114:61120] auth phase 'check access (with Satisfy All)' gave status 403: /test/
      [Tue Sep 25 07:18:33.177032 2018] [headers:debug] [pid 49219:tid 140033499584256] mod_headers.c(900): AH01503: headers: ap_headers_error_filter()
      [Tue Sep 25 07:18:33.177057 2018] [http:trace3] [pid 49219:tid 140033499584256] http_filters.c(1128): [client 89.187.203.114:61120] Response sent with status 403, headers:
      [Tue Sep 25 07:18:33.177062 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1135): [client 89.187.203.114:61120] Date: Tue, 25 Sep 2018 05:18:27 GMT
      [Tue Sep 25 07:18:33.177066 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1138): [client 89.187.203.114:61120] Server: Apache/2.4.34 (Ubuntu)
      [Tue Sep 25 07:18:33.177071 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] X-Frame-Options: SAMEORIGIN
      [Tue Sep 25 07:18:33.177075 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Content-Length: 320
      [Tue Sep 25 07:18:33.177080 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Connection: close
      [Tue Sep 25 07:18:33.177084 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Content-Type: text/html; charset=iso-8859-1


      We tested it all again with client certificates issued by a SHA256 intermediat CA. This works without problems.
      As I suspect that by updating Apache or openssl there is now a problem with PSS signed issuers.
      Someone has an idea what you can do to make it fly again?










      share|improve this question














      we use a Clientauth configuration for a location without problems for many months



      Ubuntu 16.04.5 LTS
      Apache 2.4.18-2ubuntu3.9
      openssl 1.0.2g-1ubuntu4.13



      Now we upgraded to use HTTP2



      Ubuntu 18.04.1 LTS
      Apache 2.4.29-1ubuntu4.3
      Openssl 1.1.0g-2ubuntu4.1



      Apache Conf:



       SSLEngine on
      SSLVerifyDepth 2
      SSLProxyEngine on
      SSLProtocol -All +TLSv1.2 +TLSv1.1

      SSLCipherSuite HIGH:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!EXP:!DES:!RC4:!3DES:!MD5:!PSK:!MEDIUM:!LOW:!SRP:!DSS

      SSLCertificateFile /etc/apache2/ssl/blablub.pem
      SSLCertificateKeyFile /etc/apache2/ssl/blablub.key
      SSLCertificateChainFile /etc/apache2/ssl/blablub.ca_certificates.pem
      SSLCACertificateFile /etc/apache2/ssl/ProductiveCAClientAuth.pem

      ....other stuff without ClientAuth...

      <Location /test>
      SSLVerifyClient require
      SSLVerifyDepth 2

      ProxyPass https://server-1/test
      ProxyPassReverse https://server-1/testg

      </Location>


      Particularity:



      The client certificates are issued by an intermediate CA which is itself RSA-PSS Signed.
      The root CA and the actual client certificates are signed normally RSA-SHA256.
      Do not ask why, that's how it was built in the past and has worked so far



      Error:



      [Tue Sep 25 07:18:27.723798 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(757): [client 89.187.203.114:61120] AH02255: Changed client verification type will force renegotiation
      [Tue Sep 25 07:18:27.723803 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02221: Requesting connection re-negotiation
      [Tue Sep 25 07:18:27.723827 2018] [ssl:debug] [pid 49219:tid 140033499584256] ssl_engine_kernel.c(987): [client 89.187.203.114:61120] AH02260: Performing full renegotiation: complete handshake protocol (client does support secu
      re renegotiation)
      [Tue Sep 25 07:18:27.723867 2018] [ssl:info] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02226: Awaiting re-negotiation handshake
      [Tue Sep 25 07:18:33.176966 2018] [ssl:error] [pid 49219:tid 140033499584256] [client 89.187.203.114:61120] AH02261: Re-negotiation handshake failed
      [Tue Sep 25 07:18:33.176987 2018] [ssl:error] [pid 49219:tid 140033499584256] SSL Library Error: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
      [Tue Sep 25 07:18:33.177005 2018] [core:trace3] [pid 49219:tid 140033499584256] request.c(119): [client 89.187.203.114:61120] auth phase 'check access (with Satisfy All)' gave status 403: /test/
      [Tue Sep 25 07:18:33.177032 2018] [headers:debug] [pid 49219:tid 140033499584256] mod_headers.c(900): AH01503: headers: ap_headers_error_filter()
      [Tue Sep 25 07:18:33.177057 2018] [http:trace3] [pid 49219:tid 140033499584256] http_filters.c(1128): [client 89.187.203.114:61120] Response sent with status 403, headers:
      [Tue Sep 25 07:18:33.177062 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1135): [client 89.187.203.114:61120] Date: Tue, 25 Sep 2018 05:18:27 GMT
      [Tue Sep 25 07:18:33.177066 2018] [http:trace5] [pid 49219:tid 140033499584256] http_filters.c(1138): [client 89.187.203.114:61120] Server: Apache/2.4.34 (Ubuntu)
      [Tue Sep 25 07:18:33.177071 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] X-Frame-Options: SAMEORIGIN
      [Tue Sep 25 07:18:33.177075 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Content-Length: 320
      [Tue Sep 25 07:18:33.177080 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Connection: close
      [Tue Sep 25 07:18:33.177084 2018] [http:trace4] [pid 49219:tid 140033499584256] http_filters.c(957): [client 89.187.203.114:61120] Content-Type: text/html; charset=iso-8859-1


      We tested it all again with client certificates issued by a SHA256 intermediat CA. This works without problems.
      As I suspect that by updating Apache or openssl there is now a problem with PSS signed issuers.
      Someone has an idea what you can do to make it fly again?







      apache2 ssl






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Sep 25 '18 at 9:07









      F WF W

      165




      165






















          2 Answers
          2






          active

          oldest

          votes


















          1














          main problem solved with updating to OpenSSL 1.1.1
          Although the problem has resolved and the ClientAuth work again but it is very slow. Normal login now takes 60-120 seconds.
          Also an update to Apache 2.4.35 did not help.
          Various test with the SSLCache options of Apaches also not.



          I think since Apache officially does not support openSSL 1.1.1 and TLS 1.3, it just helps to wait until it is officially supported.






          share|improve this answer


























          • LQ Reviewers: Self-answer! VTC Q instead of A, please?

            – Fabby
            Sep 26 '18 at 7:19











          • I voted to leave the question open - this is a specific solution...

            – Zanna
            Sep 26 '18 at 13:05











          • I am new here. what means "VTC Q instead of A, please?"

            – F W
            Sep 27 '18 at 12:03








          • 1





            Hi F W. VTC means vote to close. Q means question and A means answer. Someone flagged your answer as low-quality which means it got put into a queue for people to review and decide whether it should be deleted. Fabby noticed that this was your own answer and therefore correct by default, but apparently thought the answer was not interesting or useful (I disagree) and so suggested other reviewers of that queue vote to close your question (as not-reproducible) instead (you can't "close" an answer but...). Comments are usually temporary and often used for moderation. Apologies for the confusion.

            – Zanna
            Sep 27 '18 at 16:31



















          0














          You can now use TLSv1.3 via OpenSSL 1.1.1 via Ondrej Sury PPA for apache2 (or nginx) by adding his repository for apache2 (or nginx), then remove default apache2 (change apache2 to nginx if you use the later) and reinstall as follows:



          apache2 and openssl 1.1.1:
          add-apt-repository ppa:ondrej/apache2
          apt-get update
          apt-get -y remove apache2
          apt-get -y install apache2 openssl





          share|improve this answer

























            Your Answer








            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "89"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1078247%2fupdate-16-04-lts-18-04-lts-tls-process-client-certificatecertificate-verify%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            1














            main problem solved with updating to OpenSSL 1.1.1
            Although the problem has resolved and the ClientAuth work again but it is very slow. Normal login now takes 60-120 seconds.
            Also an update to Apache 2.4.35 did not help.
            Various test with the SSLCache options of Apaches also not.



            I think since Apache officially does not support openSSL 1.1.1 and TLS 1.3, it just helps to wait until it is officially supported.






            share|improve this answer


























            • LQ Reviewers: Self-answer! VTC Q instead of A, please?

              – Fabby
              Sep 26 '18 at 7:19











            • I voted to leave the question open - this is a specific solution...

              – Zanna
              Sep 26 '18 at 13:05











            • I am new here. what means "VTC Q instead of A, please?"

              – F W
              Sep 27 '18 at 12:03








            • 1





              Hi F W. VTC means vote to close. Q means question and A means answer. Someone flagged your answer as low-quality which means it got put into a queue for people to review and decide whether it should be deleted. Fabby noticed that this was your own answer and therefore correct by default, but apparently thought the answer was not interesting or useful (I disagree) and so suggested other reviewers of that queue vote to close your question (as not-reproducible) instead (you can't "close" an answer but...). Comments are usually temporary and often used for moderation. Apologies for the confusion.

              – Zanna
              Sep 27 '18 at 16:31
















            1














            main problem solved with updating to OpenSSL 1.1.1
            Although the problem has resolved and the ClientAuth work again but it is very slow. Normal login now takes 60-120 seconds.
            Also an update to Apache 2.4.35 did not help.
            Various test with the SSLCache options of Apaches also not.



            I think since Apache officially does not support openSSL 1.1.1 and TLS 1.3, it just helps to wait until it is officially supported.






            share|improve this answer


























            • LQ Reviewers: Self-answer! VTC Q instead of A, please?

              – Fabby
              Sep 26 '18 at 7:19











            • I voted to leave the question open - this is a specific solution...

              – Zanna
              Sep 26 '18 at 13:05











            • I am new here. what means "VTC Q instead of A, please?"

              – F W
              Sep 27 '18 at 12:03








            • 1





              Hi F W. VTC means vote to close. Q means question and A means answer. Someone flagged your answer as low-quality which means it got put into a queue for people to review and decide whether it should be deleted. Fabby noticed that this was your own answer and therefore correct by default, but apparently thought the answer was not interesting or useful (I disagree) and so suggested other reviewers of that queue vote to close your question (as not-reproducible) instead (you can't "close" an answer but...). Comments are usually temporary and often used for moderation. Apologies for the confusion.

              – Zanna
              Sep 27 '18 at 16:31














            1












            1








            1







            main problem solved with updating to OpenSSL 1.1.1
            Although the problem has resolved and the ClientAuth work again but it is very slow. Normal login now takes 60-120 seconds.
            Also an update to Apache 2.4.35 did not help.
            Various test with the SSLCache options of Apaches also not.



            I think since Apache officially does not support openSSL 1.1.1 and TLS 1.3, it just helps to wait until it is officially supported.






            share|improve this answer















            main problem solved with updating to OpenSSL 1.1.1
            Although the problem has resolved and the ClientAuth work again but it is very slow. Normal login now takes 60-120 seconds.
            Also an update to Apache 2.4.35 did not help.
            Various test with the SSLCache options of Apaches also not.



            I think since Apache officially does not support openSSL 1.1.1 and TLS 1.3, it just helps to wait until it is officially supported.







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited Sep 27 '18 at 12:19

























            answered Sep 26 '18 at 6:20









            F WF W

            165




            165













            • LQ Reviewers: Self-answer! VTC Q instead of A, please?

              – Fabby
              Sep 26 '18 at 7:19











            • I voted to leave the question open - this is a specific solution...

              – Zanna
              Sep 26 '18 at 13:05











            • I am new here. what means "VTC Q instead of A, please?"

              – F W
              Sep 27 '18 at 12:03








            • 1





              Hi F W. VTC means vote to close. Q means question and A means answer. Someone flagged your answer as low-quality which means it got put into a queue for people to review and decide whether it should be deleted. Fabby noticed that this was your own answer and therefore correct by default, but apparently thought the answer was not interesting or useful (I disagree) and so suggested other reviewers of that queue vote to close your question (as not-reproducible) instead (you can't "close" an answer but...). Comments are usually temporary and often used for moderation. Apologies for the confusion.

              – Zanna
              Sep 27 '18 at 16:31



















            • LQ Reviewers: Self-answer! VTC Q instead of A, please?

              – Fabby
              Sep 26 '18 at 7:19











            • I voted to leave the question open - this is a specific solution...

              – Zanna
              Sep 26 '18 at 13:05











            • I am new here. what means "VTC Q instead of A, please?"

              – F W
              Sep 27 '18 at 12:03








            • 1





              Hi F W. VTC means vote to close. Q means question and A means answer. Someone flagged your answer as low-quality which means it got put into a queue for people to review and decide whether it should be deleted. Fabby noticed that this was your own answer and therefore correct by default, but apparently thought the answer was not interesting or useful (I disagree) and so suggested other reviewers of that queue vote to close your question (as not-reproducible) instead (you can't "close" an answer but...). Comments are usually temporary and often used for moderation. Apologies for the confusion.

              – Zanna
              Sep 27 '18 at 16:31

















            LQ Reviewers: Self-answer! VTC Q instead of A, please?

            – Fabby
            Sep 26 '18 at 7:19





            LQ Reviewers: Self-answer! VTC Q instead of A, please?

            – Fabby
            Sep 26 '18 at 7:19













            I voted to leave the question open - this is a specific solution...

            – Zanna
            Sep 26 '18 at 13:05





            I voted to leave the question open - this is a specific solution...

            – Zanna
            Sep 26 '18 at 13:05













            I am new here. what means "VTC Q instead of A, please?"

            – F W
            Sep 27 '18 at 12:03







            I am new here. what means "VTC Q instead of A, please?"

            – F W
            Sep 27 '18 at 12:03






            1




            1





            Hi F W. VTC means vote to close. Q means question and A means answer. Someone flagged your answer as low-quality which means it got put into a queue for people to review and decide whether it should be deleted. Fabby noticed that this was your own answer and therefore correct by default, but apparently thought the answer was not interesting or useful (I disagree) and so suggested other reviewers of that queue vote to close your question (as not-reproducible) instead (you can't "close" an answer but...). Comments are usually temporary and often used for moderation. Apologies for the confusion.

            – Zanna
            Sep 27 '18 at 16:31





            Hi F W. VTC means vote to close. Q means question and A means answer. Someone flagged your answer as low-quality which means it got put into a queue for people to review and decide whether it should be deleted. Fabby noticed that this was your own answer and therefore correct by default, but apparently thought the answer was not interesting or useful (I disagree) and so suggested other reviewers of that queue vote to close your question (as not-reproducible) instead (you can't "close" an answer but...). Comments are usually temporary and often used for moderation. Apologies for the confusion.

            – Zanna
            Sep 27 '18 at 16:31













            0














            You can now use TLSv1.3 via OpenSSL 1.1.1 via Ondrej Sury PPA for apache2 (or nginx) by adding his repository for apache2 (or nginx), then remove default apache2 (change apache2 to nginx if you use the later) and reinstall as follows:



            apache2 and openssl 1.1.1:
            add-apt-repository ppa:ondrej/apache2
            apt-get update
            apt-get -y remove apache2
            apt-get -y install apache2 openssl





            share|improve this answer






























              0














              You can now use TLSv1.3 via OpenSSL 1.1.1 via Ondrej Sury PPA for apache2 (or nginx) by adding his repository for apache2 (or nginx), then remove default apache2 (change apache2 to nginx if you use the later) and reinstall as follows:



              apache2 and openssl 1.1.1:
              add-apt-repository ppa:ondrej/apache2
              apt-get update
              apt-get -y remove apache2
              apt-get -y install apache2 openssl





              share|improve this answer




























                0












                0








                0







                You can now use TLSv1.3 via OpenSSL 1.1.1 via Ondrej Sury PPA for apache2 (or nginx) by adding his repository for apache2 (or nginx), then remove default apache2 (change apache2 to nginx if you use the later) and reinstall as follows:



                apache2 and openssl 1.1.1:
                add-apt-repository ppa:ondrej/apache2
                apt-get update
                apt-get -y remove apache2
                apt-get -y install apache2 openssl





                share|improve this answer















                You can now use TLSv1.3 via OpenSSL 1.1.1 via Ondrej Sury PPA for apache2 (or nginx) by adding his repository for apache2 (or nginx), then remove default apache2 (change apache2 to nginx if you use the later) and reinstall as follows:



                apache2 and openssl 1.1.1:
                add-apt-repository ppa:ondrej/apache2
                apt-get update
                apt-get -y remove apache2
                apt-get -y install apache2 openssl






                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited 7 mins ago

























                answered Oct 30 '18 at 12:07









                Hj Ahmad Rasyid Hj IsmailHj Ahmad Rasyid Hj Ismail

                112




                112






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Ask Ubuntu!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1078247%2fupdate-16-04-lts-18-04-lts-tls-process-client-certificatecertificate-verify%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    GameSpot

                    日野市

                    Tu-95轟炸機