Re: [users@httpd] SSL authentication by clients certificates or by IP

2013-03-14 Thread Jean-Francois Maeyhieux
On Thu, 2013-03-14 at 14:33 +0100, Jan Vávra wrote: > Hello, > for a) I'd use directives Order, Allow, Deny for Directory > for b) I'd use > SSLVerifyClient require > This options allows only such clients with client certificate iisued > in the list defined by SSLCACertificateFile > I just n

Re: [users@httpd] SSL authentication by clients certificates or by IP

2013-03-14 Thread Jan Vávra
Hello, for a) I'd use directives Order, Allow, Deny for Directory for b) I'd use SSLVerifyClient require This options allows only such clients with client certificate iisued in the list defined by SSLCACertificateFile For more filtering by the specific field of cert eg. Common Name set |SSL

Re: [users@httpd] SSL authentication by clients certificates or by IP

2013-03-14 Thread Jean-Francois Maeyhieux
My problem is accurately Here. How could I use the 'Satisfy Any' directive to check that client certificate is valid and have some specific field. Is 'Satisfy Any' compatible with 'SSLVerifyClient/SSLVerifyDepth/SSLRequire' directive ? All my try to mix both brings me to an "Internal Server Erro

Re: [users@httpd] SSL authentication by clients certificates or by IP

2013-03-14 Thread Yehuda Katz
I am not near my computer, so I can't test this, but I believe what you are looking for is the "Satisfy Any" directive. http://httpd.apache.org/docs/2.2/mod/core.html#satisfy - Y On Thursday, March 14, 2013, Jean-Francois Maeyhieux wrote: > Hello everyone ! > > >My purpose is simple: > > I w

[users@httpd] SSL authentication by clients certificates or by IP

2013-03-14 Thread Jean-Francois Maeyhieux
Hello everyone ! My purpose is simple: I want a unique SSL vhost that permit two way to access the website: a) People from specific IP could access the content b) People with a valid client certificate could access the content I know how to achieve each access way but not both in the same t