Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Apache HTTP Server with SSL enabled and requesting a Client Certificate.

How do I set up Apache to only request the certificate when a user hits a certain part of the website?

Example:
/myapp/ should not request the cert
/myapp2/ should request the cert

Note: These applications are being served using the mod-jk

share|improve this question

3 Answers 3

up vote 1 down vote accepted
+100

The trick here is that you need to do this in tomcat. Since that is what is actually proccessing the request.

Since client auth is on a per connector basis you'll need to create 2 new connectors. One for the base SSL w/ auth, and one for the mod_jk connector (chosen ports arbitrarily chosen as cur+1).

 <!-- Client Auth Connector on port 8444 -->
    <!--
    <Connector port="8444"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" debug="0" scheme="https" secure="true"
               clientAuth="true" sslProtocol="TLS" />
    -->

    <!-- Client auth ajp connector on port 8010 -->
    <Connector port="8010"
               enableLookups="false" redirectPort="8444" debug="0"
               protocol="AJP/1.3" />

Then just setup a secondary mod_jk worker to connect to the client auth SSL in apache for /myapp2

share|improve this answer

Someting like this should do the magic:

<Directory /myapp2>
  SSLVerifyClient require
</Directory>

<Directory /myapp>
  SSLVerifyClient none
</Directory>

More info about SSLVerifyClient directive here.

share|improve this answer
    
This doesn't appear to do anything for the app that is running through mod-jk. –  Joshua May 21 '10 at 15:50

This might work: http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html#arbitraryclients

How can I authenticate my clients for a particular URL based on certificates but still allow arbitrary clients to access the remaining parts of the server?

For this we again use the per-directory reconfiguration feature of mod_ssl: httpd.conf

SSLVerifyClient none
SSLCACertificateFile conf/ssl.crt/ca.crt

<Location /secure/area>
SSLVerifyClient require
SSLVerifyDepth 1
</Location>
share|improve this answer
2  
Depending on the setup, depth of 1 might actually break otherwise working scenario. Some CAs issue certificates with chain length greater than 1. –  Nasko May 18 '10 at 20:19
    
This just causes the secure area through the mod-jk to not work any more. –  Joshua May 21 '10 at 15:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.