Hope someone can point me in the right direction.

I have created a simple Apache srv on 2.4.25

The srv has a cert from letsencrypt and enforces access to https only. I have a "secret" folder (test). It has been protected by basic auth (user/PW). This means that if you access https://www.example.org/test, you'll be prompted for authentication; works fine.

Now the question: I would like to enforce that access to this folder is only allowed from clients (in this case some phones). The phones has a device certificate, and I would like to use this cert for authentication. However the cert is not from a trusted CA like letsencrypt or Digicert. They are signed by the company that manufactors the phone (self-signed)

My thought is to import the CA, and then look up if the request to access the folder is from a phone(allowed) or not. I tried to add :

SSLVerifyClient require

SSLVerifyDepth 1

SSLCACertificatePath /path/to/ssl/

to the folder, but this causes the srv to start as: "Your SSL library does not have support for per-directory CA"

Seems that this takes bit more to get working, so any hints and advises will be greatly appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.