title: client certificate authentication not working with chrome and apache2 server
body: <p>I am attempting to use client certificates to limit secure access to an apache2 web server.  However after installation google chrome returns a ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED error. </p>
  
  <p>First I set up the CA for the Web Server by creating a CA key and an X509 PEM file:</p>
  
  <pre><code>openssl genrsa -out CA.key 2048
  openssl req -x509 -new -nodes -key CA.key -days 7300 -out CA.pem
  </code></pre>
  
  <p>I already have an existing certificate for the web site set in apache2 for https communication allocated by a trusted third party.  The following is the apache2 conf setting for this website where I have included SSLCACertificateFile for the certificate generated above, the SSLOptions, SSLVerifyClient and SSLVerfiyDepth directives:</p>
  
  <pre><code>&lt;IfModule mod_ssl.c&gt;
          &lt;VirtualHost *:443&gt;
                  ServerName site.aname.com
                  ServerAdmin webmaster@localhost
                  DocumentRoot /var/www/html/site
                  &lt;Directory /var/www/html/site&gt;
                          Options FollowSymLinks
                          AllowOverride All
                          Require all granted
                          SSLOptions +StdEnvVars
                          SSLVerifyClient require
                          SSLVerifyDepth 1
                  &lt;/Directory&gt;
                  LogLevel debug
                  ErrorLog ${APACHE_LOG_DIR}/error.log
                  CustomLog ${APACHE_LOG_DIR}/access.log combined
                  SSLCACertificateFile /etc/apache2/ssl/site/CA.pem
                  SSLCertificateFile /etc/apache2/ssl/site/fullchain.pem
                  SSLCertificateKeyFile /etc/apache2/ssl/site/privkey.pem
                  Include /etc/apache2/ssl/site/options-ssl-apache.conf
          &lt;/VirtualHost&gt;
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>This completes the web server configuration and test without a client certificate and get the expected error.</p>
  
  <p>I then generate a client certificate and sign with the CA and then package in pkcs12 with private key with the following:</p>
  
  <p>GENERATE:</p>
  
  <pre><code>openssl genrsa -out user.key 2028
  openssl req -new -key user.key -out user.csr
  </code></pre>
  
  <p>SIGN WITH:</p>
  
  <pre><code>openssl x509 -sha256 -req -in user.csr -out user.crt -CA CA.pem -CAkey CA.key -CAcreateserial -days 1095
  </code></pre>
  
  <p>CREATE PKCS12:</p>
  
  <pre><code>openssl pkcs12 -export -out user.pfx -inkey user.key -in user.crt
  </code></pre>
  
  <p>The resultant user.pfx is then installed on the user machines running chrome.</p>
  
  <p>When attempting to connect, chrome asks for the key which is selected with the result being the error ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED.</p>
  
  <p>Version of Chrome running under Windows 10 is: Version 74.0.3729.169 (Official Build) (64-bit)</p>
  
  <p>Update:
  I can connect successfully with curl from another linux server using:</p>
  
  <pre><code>curl --cert user.crt --key user.key --pass password https://site.aname.com/
  </code></pre>
  
  <p>however, the same from windows 10 command line results in:
  curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x80090027) - The parameter is incorrect</p>