Home / server / Questions / 141164
Accepted
Joshua
Asked: 2010-05-13 08:05:31 +0800 CST

Partial Client Certificate request for Apache HTTP

  • 772

I have an Apache HTTP Server with SSL enabled and requesting a Client Certificate.

How do I set up Apache to only request the certificate when a user hits a certain part of the website?

Example:
/myapp/ should not request the cert
/myapp2/ should request the cert

Note: These applications are being served using the mod-jk

apache-2.2 ssl ssl-certificate

3 Answers

  1. Someting like this should do the magic:

    <Directory /myapp2>
  SSLVerifyClient require
</Directory>

<Directory /myapp>
  SSLVerifyClient none
</Directory>

    More info about SSLVerifyClient directive here.

    • 1
  2. Best Answer

    The trick here is that you need to do this in tomcat. Since that is what is actually proccessing the request.

    Since client auth is on a per connector basis you'll need to create 2 new connectors. One for the base SSL w/ auth, and one for the mod_jk connector (chosen ports arbitrarily chosen as cur+1). 

     <!-- Client Auth Connector on port 8444 -->
    <!--
    <Connector port="8444"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" debug="0" scheme="https" secure="true"
               clientAuth="true" sslProtocol="TLS" />
    -->

    <!-- Client auth ajp connector on port 8010 -->
    <Connector port="8010"
               enableLookups="false" redirectPort="8444" debug="0"
               protocol="AJP/1.3" />

    Then just setup a secondary mod_jk worker to connect to the client auth SSL in apache for /myapp2

    • 1

  3. This might work: http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html#arbitraryclients

    How can I authenticate my clients for a particular URL based on certificates but still allow arbitrary clients to access the remaining parts of the server?

    For this we again use the per-directory reconfiguration feature of mod_ssl: httpd.conf

    SSLVerifyClient none
SSLCACertificateFile conf/ssl.crt/ca.crt

<Location /secure/area>
SSLVerifyClient require
SSLVerifyDepth 1
</Location>
    • 0