Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following configuration (beside a ReverseProxy entry) to force clients to deliver a client certificate:

<Location /SSLTest/>
        SSLVerifyClient require
        SSLVerifyDepth 2
        SSLOptions +OptRenegotiate
        SSLCipherSuite HIGH
        SSLRequire %{SSL_CLIENT_S_DN_OU} eq "MyClientX"

How can i disable this requirement to several IPs. I tried different variants with SetEnvIf like

SetEnvIf Remote_addr is_internal

and added a <IfDefine !is_internal>

around the Location, but this seems to be parsed on apache startup only. Is there a way around rewrite rules?

I'm using Apache 2.2 on Linux.

Thx in advance

share|improve this question
up vote 1 down vote accepted

Sorry, can't be done. No hooks for it.

The nearest thing would be having /SSLTest/Internal and /SSLTest/External, and rewriting /SSLTest to one or the other based on client IP.

share|improve this answer
Ok, thanks for the answer. Those are good ideas, but kind of like only workarounds. I think i have to go with different virtualhosts for internal/external. – zero_r Jun 4 '09 at 13:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.