1

I'm fairly new to HTTPD so I need some insight from the pro's.

The previous admins set up HTTPD on a Linux box. It is configured to read Certs by the user accessing a specific DNS (ex: https://cxg-now-test.abc). A reverse proxy is then used to send the user to a the app server ,if their cert is valid, which resides on the same box. This works great.

In my HTTPD config, I have a section like this:

<VirtualHost>
...
SSLVerifyClient require
SSLVerifyDepth 3
SSLOptions +ExportCertData +StdEnvVars
SSLCACertificateFile <path to cert>
</VirtualHost>

Whenever someone accesses https://cxg-now-test.abc, their cert is read and are sent to the app. Again this works great.

What I'd like to do is bypass the SSLVerifyClient from a particular DNS or IP Address. Ex: 10.54.12.34

I know I can set SSLVerifyClient to 'optional' but that does not seem very secure to me.

I think the ultimate solution would be this:

  • All Users: SSLVerifyClient require
  • 10.54.12.34: SSLVerifyClient optional

BTW, we're running Apache 2.2

Is this doable?

Any help is greatly appreciated

  • It is possible in apache-2.4 by using <If "-R '10.54.12.34/32'"> directive, in case someone is wondering. – Ruslan Kabalin Jun 19 '18 at 14:35
0

It seems the answer is no. SSLVerifyClient doesn't include any options for choosing its setting by environment variables, for example.

However, you can set SSLVerifyClient in a virtual host or directory context. So if you configure Apache to serve content to 10.54.12.34 from a different virtual host or directory, you can set a different value of SSLVerifyClient there. For example, using mod_rewrite in a VirtualHost:

SSLVerifyClient require

RewriteEngine on
RewriteCond %{REMOTE_ADDR} ^10\.54\.12\.34$
RewriteRule ^(.*)$ /path/to/host-specific-dir/$1 [QSA]

<Directory /path/to/host-specific-dir>
  SSLVerifyClient optional
</Directory
  • Sounds doable Andrew, thank you. Not sure how to go about doing this though... – MCM Jan 31 '18 at 16:08
  • I added an example using mod_rewrite. – Andrew Schulman Jan 31 '18 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.