LabVIEW

cancel
Showing results for 
Search instead for 
Did you mean: 

Two way SSL / Mutual Authentication with webservices in RT Linux

Is there a way to configure the webservices to verify the client certificate and also to provide the path to the client CA?

I'm trying to do two way SSL / Mutual authentication.

 

Configuring the HTTP client to authenticate/verify the server is straight forward, On the webservices side we don't have the option to enable the client verification.

 

niembeddedws.conf file has options to configure the server certs but no options to enable client verification/Client CA to configure.

 

What I have tried to do so far, 

Since LabVIEW uses apache HTTP server, referred how it is done originally and tried to add the same configuration to niembeddedws.conf
https://www.xolphin.com/support/Apache_FAQ/Apache_-_Create_and_validate_client_certificates

https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html#allclients

SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile "conf/ssl.crt/ca.crt"

Where the  SSLCACertificateFile path edited and pointed to the CA that was used for issuing client certificate, I also tried adding the CA to /etc/ssl/certs/ca-certificates.crt.

 

If I enable webservices error log by adding ErrorLog errors.log, level=2 under # Global Directives in niembeddedws.conf, I get the below error

 

appweb: Error: OpenSSL: Must define CA certificates if using client verification

 

PFA, the edited niembeddedws.conf, Also please note the default self-signed server certs I have replaced with the ones I have created with my own CA, the same CA I'm sharing with the other platform HTTP client and it is able to authenticate the server.

Now only gripe is I'm not able to configure the client CA on the server side and authenticate the client and thereby fulfilling the two way SSL requirement.

 

Any help in this regard is greatly appreciated,

 

P.S Also from the error it looks like the webservices has taken the verifyclient config what I added but it not able to configure the CA correctly which I'm not able to figure out why?

 

Thanks,

Temin

0 Kudos
Message 1 of 1
(628 Views)