You can do this, there is nothing within Apache Httpd for normal authentication. You will need some code within your application to handle this (i.e. perform the authentication within the PHP/CGI/Java layer): this more or less excludes plain files (HTML, JS, ...) unfortunately.
To do so,
- use
SSLVerifyClient optional_no_ca
to allow any certificate to be accepted (as far as the SSL/TLS layer of Apache Httpd is concerned);
- point
SSLCADNRequestFile
to a file with just an empty line: this will make the CertificateRequest
send an empty certificate_authorities
list, which will indicate to the client that it can potentially send anything (not that it guarantees that the server will accept it). This behaviour is explicitly allowed by TLS 1.1 (and previous versions are silent on the subject). In practice, it works with SSLv3 and TLS 1.0 with most browsers.
This will allow any certificate to get presented and accepted during the SSL/TLS handshake. Unfortunately, this also removes any for of authentication Apache Httpd would have made, so none of the directives verifying CNs or other parts of the certificate will be of any use (since you can't trust the content of the certificate).
All you know at this stage is that the client has the private key for the public key in the certificate that was presented (otherwise the CertificateVerify
TLS step would have failed). You can't even trust the subject of that cert. This certificate will be in SSL_CLIENT_CERT
. You'll have to have some code to read it and extract its public key, before comparing it to your known list of public keys. (This can also work if you pass this client certificate via mod_proxy
to a back-end Java server for example.) There are libraries in PHP, Perl, Python, Java (pick the language you prefer) to analyse the content of the certificate, but it will require some programming, and will of course only authenticate the requests that are handled by such an application.