Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to create a static page instead of the default "ssl_error_handshake_failure_alert" page when an error occurs, for example when the client do not send any certificate.

how can i do this? any idea?


share|improve this question

Sorry for digging up this one year later. You can solve your issue without scripting by combining "SSLVerifyClient optional" and "SSLRequire ". In this case, the SSL handshake succeeds, since the cert is only optional, however, it turns out to be mandatory though, by the SSLRequire statement a little bit later down the process ...


<Location /somewhere>
SSLVerifyClient optional
SSLVerifyDepth 10
ErrorDocument 403 "!FORBIDDEN!"
share|improve this answer

HTTPS is HTTP inside a SSL tunnel, so if the SSL negociation fail, HTTP conversation between the server and the client has not even started.

As a matter of fact, in this case, the error page is generated by the client's browser then you can't change this page on the server side.

share|improve this answer

Set your location to be sslverifyclient optional (apache). An example

<Location /resources/protected/>
    SSLOptions +StdEnvVars
    SSLVerifyClient optional

Now a scipt in that location will have it's env set with env vars such as these. If apache was able to client authenticate, then you can do a test similar to

if ( $ENV{SSL_CLIENT_S_DN_CN}  &&  SSL_CLIENT_I_DN == "Blah issuer")
 echo" we are good"
 echo "You need to enrol for a cert.. Please contact admin @ blah"

So an authenticated person will see the "we are good" line while everyone else will see the enrollment message.

I hope this helps!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.