Доброе утро.
Пытаюсь создать SSL канал, и авторизацию при помощи SSL сертификатов.

Создаю сертификаты, как описанно здесь : http://www.vanemery.com/Linux/Apache/apache-SSL.html

CA:
openssl genrsa -des3 -out my-ca.key 2048
openssl req -new -x509 -days 3650 -key my-ca.key -out my-ca.crt

Для сервера
openssl genrsa -des3 -out mars-server.key 1024
openssl req -new -key mars-server.key -out mars-server.csr
openssl x509 -req -in mars-server.csr -out mars-server.crt -sha1 -CA my-ca.crt -CAkey my-ca.key -CAcreateserial -days 3650

для клиента :
openssl genrsa -des3 -out van-c.key 1024
openssl req -new -key van-c.key -out van-c.csr
openssl x509 -req -in van-c.csr -out van-c.crt -sha1 -CA my-ca.crt -CAkey my-ca.key -CAcreateserial -days 3650
openssl pkcs12 -export -in van-c.crt -inkey van-c.key -name "Van Emery Cert" -out van-c.p12
openssl pkcs12 -in van-c.p12 -clcerts -nokeys -info

Импортирую в IE 7 van-c.p12. Все ок, но Пишет что "Невозможно обнаружить поставщика этого сертификата." на вкладке "путь сертификации".
Это значит, как я понимаю, в сертификат не включена инфа о поставщике (CA)????
пробовал параметр указывать -CAfile при подписи van-c : не получилось указать, не понятно как и где....
в логе ssl -
[error] Re-negotiation handshake failed: Not accepted by client!?
[trace] OpenSSL: Write: SSLv3 read client certificate B
[trace] OpenSSL: Exit: error in SSLv3 read client certificate B
[error] SSL error on writing data (OpenSSL library error follows)
[error] OpenSSL: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate [Hint: No CAs known to server for verification?]

если указать SSLVerifyClient none, то соеденение SSL работает нормально.
Совсем запутался.

В http.conf сначало такая секция:
<VirtualHost _default_:443>

#  General setup for the virtual host
DocumentRoot "/usr/local/www/data"
ServerName mars
ServerAdmin admin@mars
ErrorLog /var/log/httpd-error.log
TransferLog /var/log/httpd-access.log
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

#   Server Certificate:
SSLCertificateFile /usr/local/etc/apache/ssl.crt/mars-server.crt

#   Server Private Key:
SSLCertificateKeyFile /usr/local/etc/apache/ssl.key/mars-server.key

#   Server Certificate Chain:
#SSLCertificateChainFile /usr/local/etc/apache/ssl.crt/ca.crt

#   Certificate Authority (CA):
#SSLCACertificatePath /usr/local/etc/apache/ssl.crt

#by Crx
SSLCACertificateFile  /usr/local/etc/apache/ssl.crt/my-ca.crt

<Directory /home/mars/data/www/mars/test/restructed/>
#    SSLRequireSSL
#    SSLVerifyClient require
#    SSLVerifyClient 2
#    SSLVerifyClient none
#    SSLVerifyDepth 1
</Directory>

#   Certificate Revocation Lists (CRL):
#SSLCARevocationPath /usr/local/etc/apache/ssl.crl
#SSLCARevocationFile /usr/local/etc/apache/ssl.crl/ca-bundle.crl

#   Client Authentication (Type):
# by crx
#SSLVerifyClient require
#SSLVerifyDepth  10

#   SSL Engine Options:
#SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/usr/local/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

#   SSL Protocol Adjustments:
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
#   Per-Server Logging:
CustomLog /var/log/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

далее такая. не очень разобрался, но надо прописывать параметры в обоих почемуто....

<VirtualHost ip:443>
    ServerName mars
    DocumentRoot /home/mars/data/www/mars
    Group mars
    User mars
    CustomLog /home/mars/logs/mars.access.log combined
    ErrorLog /home/mars/logs/mars.error.log
    ServerAlias www.mars
    ServerAdmin admin@mars
    AddDefaultCharset windows-1251
    php_admin_value open_basedir "/home/mars/data:."
    php_admin_value sendmail_path "/usr/sbin/sendmail -t -i -f admin@mars"
    php_admin_value upload_tmp_dir "/home/mars/data/tmp"
    php_admin_value session.save_path "/home/mars/data/tmp"
    AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
    AddType application/x-httpd-php-source .phps
    SSLEngine on
    SSLCertificateFile /usr/local/etc/apache/ssl.crt/mars-server.crt
    SSLCertificateKeyFile /usr/local/etc/apache/ssl.key/mars-server.key
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
    <Directory /home/mars/data/www/mars/test/restructed/>
        SSLVerifyClient 2
#             SSLVerifyClient none
#             SSLVerifyClient reque
        SSLVerifyDepth 1
    </Directory>
</VirtualHost>