title: SSL Client Authentication Using Smartcards
body: <p>I have configured Apache to require a client certificate to access
  resources via SSL on port 443 using:</p>
  
  <pre><code>&lt;VirtualHost _default_:443&gt;
  
    [other stuff]
  
      SSLEngine on
  
      SSLProtocol all -SSLv2
      SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
  
      SSLCertificateFile /PATH_TO_CERTS/server.crt
      SSLCertificateKeyFile /PATH_TO_PRIVATE/server.key
      SSLCACertificateFile /PATH_TO_CERTS/ca.cer
  
      SSLVerifyClient require
      SSLVerifyDepth  10
      SSLOptions +StdEnvVars +ExportCertData
  
    [other stuff]
  
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>When I establish a self signed CA and use it to issue a client cert
  to a client I have no problems, SSL client authentication is achieved.</p>
  
  <p>What I really want to do, however, is require client certs that are
  issued by a third party trusted CA which issues said certs in the
  form of smartcards. So, what I did is change SSLCACertificateFile
  to /PATH_TO_CERTS/ca-bundle.crt, which contains a bundle of CA certs
  including intermediate smartcard issuing CA and its root CA. The
  subject and issuer values of these CA's are:</p>
  
  <pre><code>  Root CA:
      subject= /C=US/O=U.S. Government/OU=EXAMPLE DEPARTMENT/OU=Certification Authorities/OU=EXAMPLE DEPARTMENT Root CA
      issuer= /C=US/O=U.S. Government/OU=EXAMPLE DEPARTMENT/OU=Certification Authorities/OU=EXAMPLE DEPARTMENT Root CA
  
    Intermediate CA issuing cert:
      subject= /C=US/O=U.S. Government/OU=EXAMPLE AGENCY/OU=Certification Authorities/OU=EXAMPLE AGENCY Operational CA
      issuer= /C=US/O=U.S. Government/OU=EXAMPLE DEPARTMENT/OU=Certification Authorities/OU=EXAMPLE DEPARTMENT Root CA
  </code></pre>
  
  <p>I expect Apache to accept a valid smartcard cert from the client,
  however instead I get the following error: "Certificate Verification:
  Error (20): unable to get local issuer certificate".</p>
  
  <p>I'm not sure what to make of this. Is it likely I am I doing something
  wrong or does "SSLVerifyClient require" only work with client certs
  issued by a locally established CA?</p>
  
  <p>Any insight into this matter would be greatly appreciated.</p>
  
  <p>I'm running Apache 2.2 on RHEL6.</p>