I'm fairly new to HTTPD so I need some insight from the pro's.
The previous admins set up HTTPD on a Linux box. It is configured to read Certs by the user accessing a specific DNS (ex: https://cxg-now-test.abc). A reverse proxy is then used to send the user to a the app server ,if their cert is valid, which resides on the same box. This works great.
In my HTTPD config, I have a section like this:
<VirtualHost> ... SSLVerifyClient require SSLVerifyDepth 3 SSLOptions +ExportCertData +StdEnvVars SSLCACertificateFile <path to cert> </VirtualHost>
Whenever someone accesses https://cxg-now-test.abc, their cert is read and are sent to the app. Again this works great.
What I'd like to do is bypass the SSLVerifyClient from a particular DNS or IP Address. Ex: 10.54.12.34
I know I can set SSLVerifyClient to 'optional' but that does not seem very secure to me.
I think the ultimate solution would be this:
- All Users:
BTW, we're running Apache 2.2
Is this doable?
Any help is greatly appreciated