Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using client certificates with multiple OU fields. For example:

OU1= ZZZ(unique value) OU2= XYZ(dynamic value) OU3= ABC(dynamic value)

I need to write a rule only if the OU3 matches with the client certs that would allow the client to access the server. Since OU1 and OU2 is dynamic,I cannot use those values directly into this expression %SSL_CLIENT_S_DN_OU in {("ZZZ","XYZ","ABC")}

I also found out in some of the forum to specify the different OU value(%SSL_CLIENT_S_DN_OU_0) and I've tried this by editing the ssl_engine_kernel.c but it didn't work.

I've searched and tried many different SSLRequire constructions but none of them was successful. Hope someone can shed some light on this.

Thanks in advance.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.