I'm currently requesting client certificates from people that hit my httpd servers set up as reverse proxies. One of the things I pull from the certificate is their email:

RequestHeader set SSL_CLIENT_SAN_Email_0 "%{SSL_CLIENT_SAN_Email_0}s"

The new header is sent on to my application (another Apache httpd server). This works for 99% of cases, but some users have multiple email addresses on the same certificate. I need all their email addresses to be part of the header.

I'm wondering if there is a way to loop through SSL_CLIENT_SAN_Email_n or just send all the headers through? It looks like ExportCertData would help if I was going to a Tomcat server over AJP. Right now it looks like I have to pick a number and put in that many RequestHeader lines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.