Crowd Apache Connector (mod_authnz_crowd) fails when using https with self signed certificates
Asked by Moodle Sysadmin:

I ran into this problem today and wasted many hours debugging \& fixing so I thought I would share with the community..  

**The issue:**   

when using self signed certificates for SSL, the apache mod_authnz_crowd module (Crowd Apache Connector) rejects the certificate regardless of configuration on the crowd server.  

**The symptoms:**   

when setting CrowdURL to a https value in apache you will receive a 500 error through the browser, looking in the apache error_log you will see: "Failed to send authentication request (CURLcode 60)" - this is returned by the CURL library that the module uses to make its connection, and error code 60 from the CURL library can be found here [http://curl.haxx.se/libcurl/c/libcurl-errors.html\<br\< a=""\> /\>
CURLE_SSL_CACERT (60) - Peer certificate cannot be authenticated with known CA certificates.
A quick look at the CURL manual (](http://curl.haxx.se/libcurl/c/libcurl-errors.html%3Cbr)<http://curl.haxx.se/libcurl/c/curl_easy_setopt.html#CURLOPTSSLVERIFYPEER>) reveals: This option determines whether curl verifies the authenticity of the peer's certificate. A value of 1 means curl verifies; 0 (zero) means it doesn't.  

**The Solution:**   

Download the source code for mod_authnz_crowd from <https://studio.plugins.atlassian.com/svn/CWDAPACHE/tags/2.0.2/> and apply the following patch  

```
--- src/crowd_client.orig    2011-07-29 15:44:46.000000000 +0800
+++ src/crowd_client.c    2011-07-29 15:33:29.000000000 +0800
@@ -517,6 +517,7 @@
 #endif
             || curl_easy_setopt(curl_easy, CURLOPT_HTTPHEADER, headers)
             || curl_easy_setopt(curl_easy, CURLOPT_TIMEOUT, config->crowd_timeout)
+            || curl_easy_setopt(curl_easy, CURLOPT_SSL_VERIFYPEER, 0)
             || (post && (curl_easy_setopt(curl_easy, CURLOPT_POST, 1)
             || curl_easy_setopt(curl_easy, CURLOPT_READFUNCTION, read_crowd_authentication_request)
             || curl_easy_setopt(curl_easy, CURLOPT_READDATA, &read_data)
```

recompile the module, install over the old one in apache and self signed certificates in crowd are no longer a problem!

**shame on you atlassian for not even documenting that we cannot use self signed certificates with this module!**


Answers:
author: Moodle Sysadmin
body: See above.

comments: author: krishnan
body: Hi Jordan,

I too agree that Atlassian hasn't documented well on Connectors for Windows. Which C compiler you used to compile the source. Can you just share this information how you went about generating a connector from the C source. This will too helpful for others who are following the compilation path to generate connectors.

Thanks and Regards,

Anantha


author: Moodle Sysadmin
body: Anantha,

I'm doubt mod_authnz_crowd will compile on Windows - it is an apache module that depends on unix/linux development libraries.

I use GCC - the default linux compiler package and related development packages (autoconf etc..)

I actually compiled the package directly to an RPM using the spec file provided by atlassian at <https://studio.plugins.atlassian.com/svn/CWDAPACHE/tags/2.0.2/packages/mod_authnz_crowd.spec> but the package does include its own Makefile so you could run it through autoconf/make/gcc yourself.


author: Ratsamy Sourinhong
body: Since the underlying mechanism to authenticate of the peer's certificate is CURL, you can get around the issue by updating the certificate bundle that CURL uses with your self-signed certificate. You do not need to apply any patches by doing this.

In RedHat Linux, the file and location is: /etc/pki/tls/certs/ca-bundle.crt

(Note: You will need root privileges to update the file as it is owned by root.)

Steps to import your self-signed certificate into the certificate bundle.

1. Export your certificate into a file and store it as Base-64 X.509.

2. On the linux host, use the following command to import the certificate.

$ openssl x509 -in ./your_certificate -text \>\> /etc/pki/tls/certs/ca-bundle.crt


Tags: apache

certificate

https

mod_authnz_crowd

ssl