Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Apache HTTP Server with SSL enabled and requesting a Client Certificate.

How do I set up Apache to only request the certificate when a user hits a certain part of the website?

/myapp/ should not request the cert
/myapp2/ should request the cert

Note: These applications are being served using the mod-jk

share|improve this question
up vote 1 down vote accepted

The trick here is that you need to do this in tomcat. Since that is what is actually proccessing the request.

Since client auth is on a per connector basis you'll need to create 2 new connectors. One for the base SSL w/ auth, and one for the mod_jk connector (chosen ports arbitrarily chosen as cur+1).

 <!-- Client Auth Connector on port 8444 -->
    <Connector port="8444"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" debug="0" scheme="https" secure="true"
               clientAuth="true" sslProtocol="TLS" />

    <!-- Client auth ajp connector on port 8010 -->
    <Connector port="8010"
               enableLookups="false" redirectPort="8444" debug="0"
               protocol="AJP/1.3" />

Then just setup a secondary mod_jk worker to connect to the client auth SSL in apache for /myapp2

share|improve this answer

Someting like this should do the magic:

<Directory /myapp2>
  SSLVerifyClient require

<Directory /myapp>
  SSLVerifyClient none

More info about SSLVerifyClient directive here.

share|improve this answer
This doesn't appear to do anything for the app that is running through mod-jk. – Joshua May 21 '10 at 15:50

This might work:

How can I authenticate my clients for a particular URL based on certificates but still allow arbitrary clients to access the remaining parts of the server?

For this we again use the per-directory reconfiguration feature of mod_ssl: httpd.conf

SSLVerifyClient none
SSLCACertificateFile conf/ssl.crt/ca.crt

<Location /secure/area>
SSLVerifyClient require
SSLVerifyDepth 1
share|improve this answer
Depending on the setup, depth of 1 might actually break otherwise working scenario. Some CAs issue certificates with chain length greater than 1. – Nasko May 18 '10 at 20:19
This just causes the secure area through the mod-jk to not work any more. – Joshua May 21 '10 at 15:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.