httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Joe Orton <>
Subject Re: [users@httpd] Bug or Feature : global SSLVerifyClient in <VirtualHost> overrides the same in <Location>?
Date Wed, 31 Aug 2005 10:47:25 GMT
On Tue, Aug 30, 2005 at 10:23:16AM +0200, Yefym Dmukh wrote:
> >SSLVerifyClient is documented as working in directory context, so it 
> should also work in <Location> context. The manual page for mod_ssl does 
> >explicitly say that a SSL renegotiation is triggered if a request for the 
> location is received.
> Then this is a bug, because it doesn't work for <Location> 
> Simple test scenario is :
> 1. access document root location - "SSLVerifyClient optional" ,  cance 
> certificate choice window.
> 2. access location <Location "/auth"> with  "SSLVerifyClient require" - no 
> triggered SSL negotiation - access without certificate granted.

The patch for this which has been proposed for the next 2.0.x release 

Thanks a lot for reporting this.

(The issue appears to also affect Ralf Engelschall's mod_ssl for 1.3)



The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message