How do I do SSL client certification in Apache?

Question

Just recently I found out a server can use a certification to check if a client is who they say they are. I know how to sign and enable server certifications but how do i have the server check if the client certification is valid on apache?

Answer 1

I hate just linking an article, but is this what your looking for? http://it.toolbox.com/blogs/securitymonkey/howto-securing-a-website-with-client-ssl-certificates-11500

Answer 2

These are the main configuration entries that you are looking for:

SSLCACertificateFile <path to valid CA certs>
SSLVerifyClient reqiure
SSLVerifyDepth 5

You need to specify what root CAs you trust by setting the appropriate CA certs. If you are using it in-house, you can become your own root CA and use that to issue client certs to your browsers. Otherwise, you will need to use a valid CA root cert (they're typically bundled or you can download them).

Once that is done, you will have an extra environment variable when a verified client connects called SSL_CLIENT_S_DN and several others.