Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to use SSLRequire to ensure that only certificates with an email from a specific domain are accepted. This is my SSLRequire statement, inside a .htaccess file:

SSLRequire %{SSL_CLIENT_S_DN_Email} =~ m/^.+@example\.com$/

However, with this line, Apache complains:

SSLRequire: syntax error

What am I doing wrong?

share|improve this question
up vote 0 down vote accepted

I offshored the whole .htaccess to the main server config (inside a <Directory> block) and the problem vanished, so either I missed something or that's a bug.

share|improve this answer

Sometime you want to say - yes accept any certificate from CAcert that has an email of and not worry about maintaining long lists. This is possible as follows:

SSLRequire %{SSL_CLIENT_S_DN_Email} =~ m/^[^@]*@example\.com$/

A full list is here Sometime certificates can contain more that one email so:

SSLRequire %{SSL_CLIENT_S_DN_Email} =~ m/^[^@]*@example\.com$/
          or %{SSL_CLIENT_S_DN_Email_0} =~ m/^[^@]*@example\.com$/
          or %{SSL_CLIENT_S_DN_Email_1} =~ m/^[^@]*@example\.com$/
          or %{SSL_CLIENT_S_DN_Email_2} =~ m/^[^@]*@example\.com$/
          or %{SSL_CLIENT_S_DN_Email_3} =~ m/^[^@]*@example\.com$/

You should change your error message (above) to say that certificates for are required also.

share|improve this answer
I don't see the fundamental difference between your SSLRequire line and mine. Why would my SSLRequire cause a syntax error but not yours? This is especially intriguing to me, especially since moving the directive to the main server config "solved" the problem. – zneak Jan 17 '13 at 17:20

According to this link, SSLRequire has since been deprecated.

share|improve this answer
Not in apache 2.2 which this 5 year old question pertains to ... – HBruijn Jun 21 at 4:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.