Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Haven't been able to figure out how to easily manage access to my SSL website.

I'm trying to allow access to a specific location based on client IP.

If client IP = 192.168.x.x => bypass client certificate authentication If client IP !=192.168.x.x => request client certificate authentication.

I tried several method (URL rewriting, Vhost, Allow,deny,satisfay.... without success..)

My SSL client verification works OK, I'm just stuck with this basic "if" request. I'm running Apache 2.12.

I already tried to implement (section How can I require HTTPS with strong ciphers and either basic authentication or client certificates for access to a subarea on the Intranet website for clients coming from the Internet but still allow plain HTTP access for clients on the Intranet?) but it's not working ..

Quite frustrating because this is exactly what i'm looking for ;) (except for the authtype basic)


<Location /folder>
SSLVerifyClient      require
SSLOptions           +StrictRequire
SSLRequire           %{SSL_CIPHER_USEKEYSIZE} >= 128
Satisfy Any
Order deny,allow
Deny from all
Allow from 192.168.x.x
share|improve this question
up vote 0 down vote accepted

Ok so looks like is not possible to do that on Apache < 2.3

I've updated to Apache 2.4 and just added the "if" directive:

<If "%{REMOTE_ADDR} == 'xx.xx.xx.xx">
SSLVerifyClient      require
            SSLOptions           +StrictRequire
            SSLRequire           %{SSL_CIPHER_USEKEYSIZE} >= 128
share|improve this answer

And if you want to force a network, just use regex like this :

<If "%{REMOTE_ADDR} !~ /^regex$ SSLVerifyClient require SSLVerifyDepth 2 </If>

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.