Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Date: Tue, 2 Mar 2004 11:15:59 +0000
From: Joe Orton <jorton@redhat.com>
To: users@httpd.apache.org
Message-ID: <20040302111558.GB28934@redhat.com>
Mail-Followup-To: users@httpd.apache.org
References: 
 <F71DE20E4813974B87772D7DDACE8E510F7AB5@EMEXM1107.dir.svc.accenture.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
 <F71DE20E4813974B87772D7DDACE8E510F7AB5@EMEXM1107.dir.svc.accenture.com>
User-Agent: Mutt/1.4.1i
Subject: Re: =?iso-8859-1?B?UkWgOiBbdXNlcnNAaHR0?=
	=?iso-8859-1?Q?pd=5D_RE_=3A_=5Busers=40httpd=5D_Forwarding_client_Certfic?=
	=?iso-8859-1?Q?ates?= from mod_ssl to a distant mod_jk through HTTPHeaders.

Thanks for testing the patch, Nicolas.

On Tue, Mar 02, 2004 at 12:05:12PM +0100, nicolas.villoutreix@accenture.com wrote:
> I have just a small probleme remaining, i do get the client certificate as an environment variable from the RequestHeader:  
> HTTP_SSL_CLIENT_CERT="-----BEGIN CERTIFICATE----- MIICqTCCAhICAQIwDQYJKoZIhvcNAQEEBQAwgbAxCzAJBgNVBAYTAkZSMQwwCgYD VQQ
>  
> But mod_jk expects an environment variable named SSL_CLIENT_CERT,
> is there an easy way to rename or create this new variable using the content of the first variable,

Google says you can configure mod_jk to pick up the client cert from a
different variable, have you tried that: i.e.

  JkCERTSIndicator HTTP_SSL_CLIENT_CERT

> I saw you post an other fix : http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/metadata/mod_headers.c?r1=1.49&r2=1.50
> In what way is it better than the first one? Is it because you do not have to tell mod_ssl to export variables?

Yes: there is a lot of overhead when using: "SSLOptions +ExportCertData
+StdEnvVars" - with the fix I committed, on your proxy you don't need to 
enable those settings, just use %{...}s in the RequestHeader directives 
to pass on the few specific SSL variables from mod_ssl.

Regards,

joe

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org