Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to use SSLRequire to ensure that only certificates with an email from a specific domain are accepted. This is my SSLRequire statement, inside a .htaccess file:

SSLRequire %{SSL_CLIENT_S_DN_Email} =~ m/^.+@example\.com$/

However, with this line, Apache complains:

SSLRequire: syntax error

What am I doing wrong?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

I offshored the whole .htaccess to the main server config (inside a <Directory> block) and the problem vanished, so either I missed something or that's a bug.

share|improve this answer
add comment

http://wiki.cacert.org/ApacheServerClientCertificateAuthentication

Sometime you want to say - yes accept any certificate from CAcert that has an email of @example.com and not worry about maintaining long lists. This is possible as follows:

SSLRequire %{SSL_CLIENT_S_DN_Email} =~ m/^[^@]*@example\.com$/

A full list is here http://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslrequire. Sometime certificates can contain more that one email so:

SSLRequire %{SSL_CLIENT_S_DN_Email} =~ m/^[^@]*@example\.com$/
          or %{SSL_CLIENT_S_DN_Email_0} =~ m/^[^@]*@example\.com$/
          or %{SSL_CLIENT_S_DN_Email_1} =~ m/^[^@]*@example\.com$/
          or %{SSL_CLIENT_S_DN_Email_2} =~ m/^[^@]*@example\.com$/
          or %{SSL_CLIENT_S_DN_Email_3} =~ m/^[^@]*@example\.com$/

You should change your error message (above) to say that certificates for @example.com are required also.

share|improve this answer
    
I don't see the fundamental difference between your SSLRequire line and mine. Why would my SSLRequire cause a syntax error but not yours? This is especially intriguing to me, especially since moving the directive to the main server config "solved" the problem. –  zneak Jan 17 '13 at 17:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.