In my virtual host I have something like that:

    SSLEngine on
    SSLCertificateKeyFile /etc/apache2/ssl/svn.XXXXX.me.key
    SSLCertificateFile /etc/apache2/ssl/svn.XXXXX.me.crt
    SSLProtocol all
    SSLCipherSuite HIGH:MEDIUM
    SSLVerifyClient require
    SSLCACertificateFile /etc/ssl/certs/ICA-Standart.0

So far, I can use any certificate issued by CA "ICA-Standart.0" to log in, but I would like to specify kind of white list and only some certificates will be allowed to log in, is that possible?
If so, which directive should I look?

Also please note the CA is a public certification authority.

1 Answer 1


You need to use the SSL_CLIENT_S_* directives:

    Require              ssl
    Require              ssl-verify-client
    SSLOptions           +FakeBasicAuth +StrictRequire
    SSLRequire           %{SSL_CIPHER_USEKEYSIZE} >= 256
    SSLRequire           %{SSL_CLIENT_S_DN_O} eq "Company, LTD." \
                         and %{SSL_CLIENT_S_DN_OU} eq "Development" \
                         and %{SSL_CLIENT_S_DN_CN} in {"John Doe", "Jane Doe", "Other One"}
    SSLRenegBufferSize   131072
Further reference can be found in the Apache documentation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.