Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several clients certificates that my Apache httpd server requires clients to have (made using the instructions at http://www.garex.net/apache/). I would like to have an authentication that also authenticates and allows only a client certificate to match a username/password combination.

For example, if I have two client certificates with CN user1 and user2 and .htpasswd file

user1:passwordA
user2:passwordB

I would like something like

SSLUserName %{SSL_CLIENT_S_DN_CN}
AuthName "Please enter your username and password"
AuthType Basic
AuthUserFile /path/.htpasswd
require valid-user

However, trying this results in 500 errors. What can I do?

share|improve this question

1 Answer 1

The error 500 is due to wrongSSLUserName syntax — it should be written without %{...}:

SSLUserName SSL_CLIENT_S_DN_CN

But actually if you want to require basic auth and certificate name to match, you should remove SSLUserName (so that mod_ssl would not touch REMOTE_USER) and use:

SSLRequire %{SSL_CLIENT_S_DN_CN} eq %{REMOTE_USER}

Another option which might work better when used in the config file directly (not in .htaccess):

RewriteEngine on
RewriteCond %{SSL:SSL_CLIENT_S_DN_CN} !=%{LA-U:REMOTE_USER}
RewriteRule ^ - [F]
share|improve this answer
    
I have <VirtualHost default:443> <Location /> AuthName "Please enter your username and password" AuthType Basic AuthUserFile /path/.htpasswd require valid-user SSLRequire %{SSL_CLIENT_S_DN_CN} eq %{REMOTE_USER} </Location> </VirtualHost> but this gives a 403 error, and the authentication dialog never appears to the client. If I move the four lines about auth outside of the Location tag, then Apache says AuthName not allowed here. –  cm007 Nov 29 '11 at 6:22
    
Is SSLVerifyClient require also specified? You may also try a mod_rewrite variant added to the answer. –  Sergey Vlasov Nov 29 '11 at 11:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.