httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jeff Blaine <>
Subject [users@httpd] SSLRequire "SUCCESS" but actually failure (2 possible bugs)
Date Mon, 01 Nov 2010 20:42:41 GMT
Hi folks,

I'm using Apache 2.2.3 with mod_ssl on a RHELv5.5 box.  I have
been stumped for 3 weeks now by a problem with SSLRequire
and certificates.

FWIW, I also built the latest Apache with SSL from source,
ran it on a separate port, and got equally odd results.

I have posed this same question/situation on the mod_ssl mailing
list, but did not get anywhere.

[root@rtdev1 conf.d]# rpm -qa | grep httpd
[root@rtdev1 conf.d]# rpm -qa | grep mod_ssl
[root@rtdev1 conf.d]#

Section from ssl.conf:

     SSLRequire %{SSL_CLIENT_S_DN} in { \
     "/ Charles J.", \
     "/ Marc W.", \
     "/ Mary B", \
     "/ Barbara A." \

The 403 error as it manifests itself in the ssl_error.log:

     [Mon Nov 01 14:50:14 2010] [info] Access to 
/apps/rtsrv1dev/share/html/ denied for xxx.xx.160.29 (requirement 
expression not fulfilled)

     [Mon Nov 01 14:50:14 2010] [info] Failed expression: 
%{SSL_CLIENT_S_DN} in { "/ 
Charles J.", "/ Mark W.", 
"/ Mary B", 
"/ Barbara A." }

     [Mon Nov 01 14:50:14 2010] [error] [client xxx.xx.160.29] access to 
/apps/rtsrv1dev/share/html/ failed, reason: SSL requirement expression 
not fulfilled (see SSL logfile for more details)

However, note the "SUCCESS" (bogus?) via CustomLog of

     [01/Nov/2010:14:50:14 -0400] xxx.xx.160.29 on TLSv1 RC4-MD5 
/ Barbara J. SUCCESS

And here's another failure from Barbara, with IE8 instead of

     [01/Nov/2010:14:49:07 -0400] xxx.xx.160.29 on TLSv1 AES256-SHA 
/ Barbara J. SUCCESS

Note, however, this was a session that worked (SUCCESS actually
meant success...).  IE8 on my machine:

     [01/Nov/2010:15:02:46 -0400] xxx.xx.0.150 on TLSv1 AES128-SHA 
/ Charles J. SUCCESS

Here's what *DOES WORK* for all parties with certificates, but
is not really what we want, and as I understand the docs, the
other (full DN) should work.

     SSLRequire %{SSL_CLIENT_S_DN_CN} in { \
         "Blaine Charles J.",
         "Laveless Marc W.",
         "Simpson Mary B",
         "Cietta Barbara A." }

The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message