Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a site that requires authentication in order to access certain directories, but not others. (The "directories" are really just rewrite rules that all pass through /index.php)

In order to authenticate, the user can either login with a standard username/password, or submit a client-side x509 certificate.

So, Apache's vhost conf looks something like this:

SSLCACertificateFile /etc/pki/CA/certs/redacted-ca.crt
SSLOptions +ExportCertData +StdEnvVars
SSLVerifyClient none
SSLVerifyDepth 1

<LocationMatch "/(foo-one|foo-two|foo-three)">
        SSLVerifyClient optional
</LocationMatch>

That works fine, but then large file uploads fail because of the behavior documented in bug 12355.

The workaround for that is to set SSLVerifyClient require (or optional) as the default, so now the conf looks like this

SSLCACertificateFile /etc/pki/CA/certs/redacted-ca.crt
SSLOptions +ExportCertData +StdEnvVars
SSLVerifyClient optional
SSLVerifyDepth 1

<LocationMatch "/(bar-one|bar-two|bar-three)">
        SSLVerifyClient none
</LocationMatch>

That fixes the upload problem, but the SSLVerifyClient none doesn't work for bar-one, bar-two, etc. Those directories are still prompted to present a certificate.

Additionally, I also need the root URL to accessible without the user being prompted for a certificate. I'm afraid that will cancel out the workaround, though.

share|improve this question
    
Can you verify that the <LocationMatch "/(bar-one|bar-two|bar-three)"> is applying correctly by putting some test config in there, like Order Allow,Deny Deny from all and verifying that it stops the request? –  Shane Madden Nov 23 '12 at 22:18
1  
The different directories aren't related to each other, so I decided it'd be easier to just move the ones that use certs to their own vhost. That way the configs won't conflict with each other. –  Ian Dunn Nov 28 '12 at 15:29
1  
Also, increasing SSLRenegBufferSize can work around the error, although it does make you more vulnerable to DoS attacks. –  Ian Dunn Nov 28 '12 at 20:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.