Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OK I have spent all day on this--

I'm using apache with mod_ssl I'm trying to take an existing environment header, "%{SSL_CLIENT_S_DN_CN}s" which looks like "Lastname Firstname Mi username" and set a new header called USERNAME and set that equal to just username (the characters between the last space and the end of the string)

I would then reverse proxy that header to a backend host which would use it to identify the user.

I have tried a lot of different things. I don't know if the problem is that I don't understand perl regex or if I don't understand the syntax or I'm not putting it in the right place, or all three.

Here is an example of one thing I tried:

SetEnvIf SSL_CLIENT_S_DN_CN (.*\ )(.*) newhostname=$2
RequestHeader set HOSTNAME "%{newhostname}e"

All I really want is a new header Hostname to equal the last non-whitespace characters in the DN_CN environment variable.

share|improve this question
up vote 2 down vote accepted

Ok -- I figured it out middle of the week but still wanted to give someone a chance to earn the bounty.

Surprisingly, this isn't very well documented anywhere, but as I used mod_headers to do this you can find that documentation here.

What you want to do it set the header, whether you grab it from ssl or the environment. Then you can edit the header in place using regex and capture groups.

Some examples:

  RequestHeader set REMOTE_USER        "%{SSL_CLIENT_S_DN_CN}s"
  RequestHeader edit REMOTE_USER (.*\s)(.*) $2
  RequestHeader set AUTHENTICATE_CN    "%{SSL_CLIENT_S_DN_CN}s"
  RequestHeader edit AUTHENTICATE_CN (.*\s)(.*) $1
  RequestHeader edit AUTHENTICATE_MAIL (.*\s)(.*) $ 

share|improve this answer
O_O you bet it's not "well documented", i spend 1h reading the page before getting here, to finally find the %{XX}s syntax !!! – 131 Jul 17 '14 at 16:55
Yeah it was pretty tough to sort this one out. I tried probably a dozen things first. I think though that as mutual auth becomes more prolific, mutating the headers may become more commonplace. Thanks for the upvote! – MattPark Jul 17 '14 at 20:38

I'd use the AuthBasicFake directive which will set the header and then you can do the ProxyPass in the same Location block. It would look something like this:
<Location "/blah">
AuthBasicFake %{SSL_CLIENT_S_DN_CN}

If you have some other x509 attributes in the subject like the username on its own you could use SSL_CLIENT_S_DN_uid or SSL_CLIENT_S_DN_email.

share|improve this answer
I'm specifically trying to pare down to the uid which is part of the dn_cn. It's not its own x509 attribute otherwise this would be easy. The username is always the last word in the cn. – MattPark Aug 13 '13 at 13:24
I've had a look and I'm not sure it's possible without an addon module with either AuthBasicFake or <If>/SetEnvIf. Both of these directives use the syntax of the Apache expr language where you want the form variable ::= "%{" varname "}" | "%{" funcname ":" funcargs "}" but there are no functions which are applicable. The only thing that might work is mod_rewrite. – Richard Salts Aug 19 '13 at 0:35

Never done this with SSL (and I don't really understand it here), but mod_security could be an answer. It can rewrite/add/replace/patch anything inside of decrypted content.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.