Thanks! This works great but I want to use this for a folder that is shared by every vhost. It’s actually my awstats directory. If I access awstats via any of my websites (e.g, /awstats), I get the stats for that paticular website. The server was preconfigured so I guess there is a rewrite rule somewhere in one of the many config files.

Line SSLRequire %{HTTP_HOST} eq "google.com" only lists one host name (google.com). Is there a way to set this up so SSL is required no matter the host name?

DocumentRoot "/var/apache2/htdocs"
ServerName sun1111.abc.com:443
ServerAdmin Ab@abc.com
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
ErrorLog logs/myprodcheck_error_log
TransferLog logs/myprodcheck_access_log
 
AddType text/html .asp
 
#   SSL Engine Switch:
SSLEngine on
 
#   SSL Cipher Suite:
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
 
#   Server Certificate:
SSLCertificateFile /var/apache2/conf/ssl.crt/abc.crt
 
#   Server Private Key:
SSLCertificateKeyFile /var/apache2/conf/ssl.key/abc.key
 
#   Server Certificate Chain:
#SSLCertificateChainFile /var/apache2/conf/ssl.crt/ca.crt
 
#   Certificate Authority (CA):
SSLCACertificateFile /var/apache2/conf/ssl.crt/ca-bundle.crt
 
#   Client Authentication (Type):
SSLVerifyClient optional
SSLVerifyDepth  3
 
#   Access Control:
#
#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} = 8 and %{TIME_HOUR} <= 20       ) \
#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#
SSLOptions +StdEnvVars
 
#   SSL Engine Options:
#SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
SSLOptions +StdEnvVars

And it’s working fine and it’s showing the server certification when we’ll access our site with HTTPS.
But issue is that now we need the values from client certificate from client machine. So how we can read these variable from request with java api.

Thanks in advanced,
Ajay

I just have a quick question.. you know when a request is made to a secure area, and for that directory there is a SSLRequire directive. If the user has the digital certificate installed it’s all fine. However, if they don’t have the certificate installed you get a big Apache error:

(Error code: ssl_error_handshake_failure_alert)

Is it possible to do a rewrite so that if they don’t have the certificate installed it redirects them to a page informing them of this?

/John

A fairly strict authentication setup for one or two administrators

<Directory [absolute path to directory for service, in quotes]>
SSLOptions  +StdEnvVars +ExportCertData +FakeBasicAuth +OptRenegotiate +CompatEnvVars
SSLVerifyClient   require
SSLVerifyDepth    5
SSLRequireSSL
SSLRequire %{SSL_CLIENT_I_DN_CN} eq "the CN of the Issuer DN of client's certificate in quotes"
and %{SSL_CLIENT_S_DN_O} eq "the O of the Subject DN in client's certificate in quotes"
and %{SSL_CLIENT_S_DN_CN} in {"the CN of one or more", "comma delimited Subject DNs in quotes"}
</Directory>

An authentication setup for many users with certs from a given CA

<Directory [path to directory where the application lives, in quotes]>
SSLOptions  +StdEnvVars +ExportCertData +OptRenegotiate +FakeBasicAuth
SSLVerifyClient   require
SSLVerifyDepth    5
SSLRequireSSL
SSLRequire %{SSL_CLIENT_I_DN_CN} eq "the CN of Issuer DN of client's certificate in quotes"
and %{SSL_CLIENT_S_DN_O} eq "the O of Subject DN in client's certificate in quotes"
and %{SSL_CLIENT_S_DN_OU} eq ""the OU of Subject DN in client's certificate in quotes"
</Directory>

From: HordeSSLAuthHowTo

The good link:
https://pepr-com.ssl.eatserver.nl/

The alternative way that does not compute to the SSL environment:
http://buydirect.pepr.com

The browsing method that does nto compute to the SSL environment:
http://www.pepr.com/buydirect

How do I combine the standard recommendation with the SEO version of it?

SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "google.com"
ErrorDocument 403 https://google.com
and
RewriteRule ^/normal/secure(/.*) https://%{HTTP_HOST}$1 [R=301,L]

I am a bit lost in this area and would ask the proper htaccess content to fix it. The complexity also sits in the fact that SSL is on a different link.

I wanted set up a temp server just to host a “we are down for the moment” web page. It’s pretty easy to set it up so it responds to all http requests with a single page. But I can’t figure out how to set it up to answer all HTTPS requests with the same page without actually setting up SSL with a valid cert on my temporary server, which I don’t want to do.

Any suggestions? A wiser way of going about this?

So where you list:
SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/
and %{SSL_CLIENT_S_DN_O} eq “Snake Oil, Ltd.”
and %{SSL_CLIENT_S_DN_OU} in {“Staff”, “CA”, “Dev”}
and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5
and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 )
or %{REMOTE_ADDR} =~ m/^192.76.162.[0-9]+$/

It would have to be written as:

SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ && \
%{SSL_CLIENT_S_DN_O} eq “Snake Oil, Ltd.” && \
%{SSL_CLIENT_S_DN_OU} in {“Staff”, “CA”, “Dev”} && \
%{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 && \
%{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20) || \
%{REMOTE_ADDR} =~ m/^192.76.162.[0-9]+$/