Return-Path: 
 <users-return-106165-apmail-httpd-users-archive=httpd.apache.org@httpd.apache.org>
X-Original-To: apmail-httpd-users-archive@www.apache.org
Delivered-To: apmail-httpd-users-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id ED8FAE984
	for <apmail-httpd-users-archive@www.apache.org>;
 Sun,  3 Mar 2013 20:33:33 +0000 (UTC)
Received: (qmail 97731 invoked by uid 500); 3 Mar 2013 20:33:31 -0000
Delivered-To: apmail-httpd-users-archive@httpd.apache.org
Received: (qmail 97702 invoked by uid 500); 3 Mar 2013 20:33:31 -0000
Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
list-help: <mailto:users-help@httpd.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@httpd.apache.org>
List-Post: <mailto:users@httpd.apache.org>
List-Id: <users.httpd.apache.org>
Delivered-To: mailing list users@httpd.apache.org
Received: (qmail 97693 invoked by uid 99); 3 Mar 2013 20:33:31 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 03 Mar 2013 20:33:30 +0000
X-ASF-Spam-Status: No, hits=1.5 required=5.0
	tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (nike.apache.org: domain of michele.mase@gmail.com
 designates 74.125.82.42 as permitted sender)
Received: from [74.125.82.42] (HELO mail-wg0-f42.google.com) (74.125.82.42)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 03 Mar 2013 20:33:24 +0000
Received: by mail-wg0-f42.google.com with SMTP id 12so1093077wgh.1
        for <users@httpd.apache.org>; Sun, 03 Mar 2013 12:33:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:x-received:in-reply-to:references:date:message-id
         :subject:from:to:content-type;
        bh=UsZYMUjIvdIPIzReKqAoIvmdGkcFmg9BvObWqrG4NuI=;
        b=IioQqUiSBhz2PGvglcS6NFHfdrhDnnqcnhWl5Yu5epq7yjxD65sdEKh7aoeW3Mt1sv
         YvANGnu76pS4BmwIx87KxqSeGQbdhkAsD2sTiFTmq3sbSRuQpYU18bb1Bvcay676q26z
         7NVjSxrKUwVBeJJCOg/scWfNa2IaXnhMkdlEPMtWnqFHqLK8hUPgtC+Wjm3W0OGvSv0c
         OwDpSWcICn9feohkmxJkHzxB73sNsjYIZeFhPti12w2BmwHE9UT2uT64NHgpzLpZPlrf
         23gYkAyvljPZJ5lsEpBGjcgq5fjyz+4KSXT6e0u+NcF4eF6T9yNABmdXs4b1S/7CA9Ks
         SgLw==
MIME-Version: 1.0
X-Received: by 10.194.178.9 with SMTP id cu9mr7367621wjc.39.1362342784275;
 Sun, 03 Mar 2013 12:33:04 -0800 (PST)
Received: by 10.216.103.68 with HTTP; Sun, 3 Mar 2013 12:33:04 -0800 (PST)
In-Reply-To: 
 <CAC=Hunt643C5+=7LVSkySFk=kDtw1DEoU0U4kTg7xhZEWZx9bg@mail.gmail.com>
References: 
 <CAC=Hunt643C5+=7LVSkySFk=kDtw1DEoU0U4kTg7xhZEWZx9bg@mail.gmail.com>
Date: Sun, 3 Mar 2013 21:33:04 +0100
Message-ID: 
 <CAC=HunviO1kBLtsr9m4VObzwWYtNT6Xpwb7gzqNKLhUwOyBC7g@mail.gmail.com>
From: "Michele Mase'" <michele.mase@gmail.com>
To: Httpd Users List <users@httpd.apache.org>
Content-Type: multipart/alternative; boundary=089e013d1f28b81ac504d70b255d
X-Virus-Checked: Checked by ClamAV on apache.org
Subject: [users@httpd] Re: mod_ssl help

--089e013d1f28b81ac504d70b255d
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Anyone?


On Fri, Mar 1, 2013 at 7:39 PM, Michele Mase' <michele.mase@gmail.com>wrote=
:

> I'm testing a client authentication using:
>
> SSLCACertificateFile /path/to/pemfile.pem
> <LocationMatch "/test">
>         SSLVerifyClient require
>         SSLVerifyDepth 2
>         SSLOptions +StdEnvVars +ExportCertData
>         SSLRequire  %{SSL_CLIENT_I_DN} eq "/C=3DUS/O=3Dacme/OU=3Dacme/CN=
=3Dacme"
> /LocationMatch>
>
>
> I should use two different CA with the same DN (file /path/to/pemfile.pem=
)
> When i try to use this configuration I receive:
> Access totest denied for 10.10.10.10 (requirement expression not fulfille=
d)
> Failed expression: %{SSL_CLIENT_I_DN} eq ...
>
> The only way it works is without the SSLRequire directive.
> or
> Using only one CA in the file (file /path/to/pemfile.pem)
>
> Some suggestions?
>
> Regards
> Michele Mas=E8
>

--089e013d1f28b81ac504d70b255d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Anyone?<br></div><div class=3D"gmail_extra"><br><br><div c=
lass=3D"gmail_quote">On Fri, Mar 1, 2013 at 7:39 PM, Michele Mase&#39; <spa=
n dir=3D"ltr">&lt;<a href=3D"mailto:michele.mase@gmail.com" target=3D"_blan=
k">michele.mase@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div><div><div><div><div><d=
iv><div><div>I&#39;m testing a client authentication using:<br><span style=
=3D"font-family:courier new,monospace"><br>
SSLCACertificateFile /path/to/pemfile.pem</span><br><span style=3D"font-fam=
ily:courier new,monospace">&lt;LocationMatch &quot;/test&quot;&gt;<br>
=A0=A0=A0=A0=A0=A0=A0 SSLVerifyClient require<br>=A0=A0=A0=A0=A0=A0=A0 SSLV=
erifyDepth 2<br>=A0=A0=A0=A0=A0=A0=A0 SSLOptions +StdEnvVars +ExportCertDat=
a<br>=A0=A0=A0=A0=A0=A0=A0 SSLRequire=A0 %{SSL_CLIENT_I_DN} eq &quot;/C=3DU=
S/O=3Dacme/OU=3Dacme/CN=3Dacme&quot;<br>/LocationMatch&gt;<br>

</span><br><br></div>I should use two different CA with the same DN (<span =
style=3D"font-family:courier new,monospace">file /path/to/pemfile.pem)</spa=
n></div>When i try to use this configuration I receive:<br>Access totest de=
nied for 10.10.10.10 (requirement expression not fulfilled)<br>

Failed expression: %{SSL_CLIENT_I_DN} eq ...<br><br></div>The only way it w=
orks is without the SSLRequire directive.<br></div>or<br></div>Using only o=
ne CA in the file (<span style=3D"font-family:courier new,monospace">file /=
path/to/pemfile.pem)</span><br>

<br></div>Some suggestions?<br><br></div>Regards<br></div>Michele Mas=E8<br=
></div>
</blockquote></div><br></div>

--089e013d1f28b81ac504d70b255d--