Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several clients certificates that my Apache httpd server requires clients to have (made using the instructions at I would like to have an authentication that also authenticates and allows only a client certificate to match a username/password combination.

For example, if I have two client certificates with CN user1 and user2 and .htpasswd file


I would like something like

AuthName "Please enter your username and password"
AuthType Basic
AuthUserFile /path/.htpasswd
require valid-user

However, trying this results in 500 errors. What can I do?

share|improve this question
hi @cm007 did you manage to find a solution to this? – krisdigitx Mar 10 '15 at 16:10

The error 500 is due to wrongSSLUserName syntax — it should be written without %{...}:


But actually if you want to require basic auth and certificate name to match, you should remove SSLUserName (so that mod_ssl would not touch REMOTE_USER) and use:


Another option which might work better when used in the config file directly (not in .htaccess):

RewriteEngine on
RewriteRule ^ - [F]
share|improve this answer
I have <VirtualHost default:443> <Location /> AuthName "Please enter your username and password" AuthType Basic AuthUserFile /path/.htpasswd require valid-user SSLRequire %{SSL_CLIENT_S_DN_CN} eq %{REMOTE_USER} </Location> </VirtualHost> but this gives a 403 error, and the authentication dialog never appears to the client. If I move the four lines about auth outside of the Location tag, then Apache says AuthName not allowed here. – cm007 Nov 29 '11 at 6:22
Is SSLVerifyClient require also specified? You may also try a mod_rewrite variant added to the answer. – Sergey Vlasov Nov 29 '11 at 11:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.