Certificat Client & certificat Serveur à partir d'un certificat Ca

@Artemus24

We have been discussing this offline and the short answer is that it is not a good idea to use Let's Encrypt certs for Apache client authentication (SSLVerifyClient)

Why? That Apache feature checks that the client sent a cert that it can successfully chain to the root you configured. Everyone with an LE cert will chain to the same root so anyone would be authenticated. This provides too little security to be useful.

Normally this Apache verify client is used with your own "root" certs. You could, for example, create self-signed certs for this purpose. You configure the client and Apache accordingly (like using the SSLCACertificateFile). There are many guides on the internet for setting up such a configuration.

Apache also has a "require" option to restrict client certs even further. But, this is advanced Apache config well beyond the scope of this forum.

5 Likes