# but finally deny all browsers which haven't upgraded<br />
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128<br />
</Directory>
</code></p></div>
<h3><a name="strongurl" id="strongurl">How can I create an SSL server which accepts all types of ciphers
in general, but requires a strong ciphers for access to a particular
URL?</a></h3>
<p>Obviously you cannot just use a server-wide <code class="directive"><a href="../mod/mod_ssl.html#sslciphersuite">SSLCipherSuite</a></code> which restricts the
ciphers to the strong variants. But mod_ssl allows you to reconfigure
the cipher suite in per-directory context and automatically forces
a renegotiation of the SSL parameters to meet the new configuration.
<li><a href="#intranet">intranet vs. internet authentication</a></li>
</ul>
<h3><a name="allclients" id="allclients">How can I authenticate clients based on certificates when I know
all my clients?</a></h3>
<p>When you know your user community (i.e. a closed user group
situation), as it's the case for instance in an Intranet, you can
use plain certificate authentication. All you have to do is to
create client certificates signed by your own CA certificate
<code>ca.crt</code> and then verify the clients against this
certificate.</p>
<div class="example"><h3>httpd.conf</h3><p><code>
# require a client certificate which has to be directly<br />
# signed by our CA certificate in ca.crt<br />
SSLVerifyClient require<br />
SSLVerifyDepth 1<br />
SSLCACertificateFile conf/ssl.crt/ca.crt
</code></p></div>
<h3><a name="arbitraryclients" id="arbitraryclients">How can I authenticate my clients for a particular URL based on
certificates but still allow arbitrary clients to access the remaining
parts of the server?</a></h3>
<p>For this we again use the per-directory reconfiguration feature
of <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>:</p>
<div class="example"><h3>httpd.conf</h3><p><code>
SSLVerifyClient none<br />
SSLCACertificateFile conf/ssl.crt/ca.crt<br />
<br />
<Location /secure/area><br />
SSLVerifyClient require<br />
SSLVerifyDepth 1<br />
</Location><br />
</code></p></div>
<h3><a name="certauthenticate" id="certauthenticate">How can I authenticate only particular clients for a some URLs based
on certificates but still allow arbitrary clients to access the remaining
parts of the server?</a></h3>
<p>The key is to check for various ingredients of the client certificate.
Usually this means to check the whole or part of the Distinguished
Name (DN) of the Subject. For this two methods exists: The <code class="module"><a href="../mod/mod_auth.html">mod_auth</a></code> based variant and the <code class="directive"><a href="../mod/mod_ssl.html#sslrequire">SSLRequire</a></code> variant. The first method is
good when the clients are of totally different type, i.e. when their
DNs have no common fields (usually the organisation, etc.). In this
case you've to establish a password database containing <em>all</em>
clients. The second method is better when your clients are all part of
a common hierarchy which is encoded into the DN. Then you can match
and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"}
</Directory></pre></div>
<h3><a name="intranet" id="intranet">How can I require HTTPS with strong ciphers and either basic
authentication or client certificates for access to a subarea on the
Intranet website for clients coming from the Internet but still allow
plain HTTP access for clients on the Intranet?</a></h3>
<p>Let us assume the Intranet can be distinguished through the IP
network 192.160.1.0/24 and the subarea on the Intranet website has
the URL <code>/subarea</code>. Then configure the following outside
your HTTPS virtual host (so it applies to both HTTPS and HTTP):</p>
<div class="example"><h3>httpd.conf</h3><pre>
SSLCACertificateFile conf/ssl.crt/company-ca.crt
<Directory /usr/local/apache2/htdocs>
# Outside the subarea only Intranet access is granted
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
</Directory>
<Directory /usr/local/apache2/htdocs/subarea>
# Inside the subarea any Intranet access is allowed
# but from the Internet only HTTPS + Strong-Cipher + Password
# or the alternative HTTPS + Strong-Cipher + Client-Certificate
# If HTTPS is used, make sure a strong cipher is used.
# Additionally allow client certs as alternative to basic auth.
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +FakeBasicAuth +StrictRequire
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
# Force clients from the Internet to use HTTPS
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$
RewriteCond %{HTTPS} !=on
RewriteRule .* - [F]
# Allow Network Access and/or Basic Auth
Satisfy any
# Network Access Control
Order deny,allow
Deny from all
Allow 192.168.1.0/24
# HTTP Basic Authentication
AuthType basic
AuthName "Protected Intranet Area"
AuthUserFile conf/protected.passwd
Require valid-user
</Directory></pre></div>
</div></div>
<div class="bottomlang">
<p><span>Available Languages: </span><a href="../en/ssl/ssl_howto.html" title="English"> en </a></p>
</div><div id="footer">
<p class="apache">Copyright 1999-2004 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
