Re: SSL Client Auth with Virtual Hosts

I'm not a guru but I would suspect that your NameVirtualHost
directives need to differ. You probably need to configure the
virtual hosts using their domain names, like this:
------------------------------------------------------------

NameVirtualHost abc1-no-client-auth.com:443
<VirtualHost abc1-no-client-auth.com:443>
    ...
</VirtualHost>

NameVirtualHost abc1-ssl-client-auth.com:443
<VirtualHost abc1-ssl-client-auth.com:443>
    ...
</VirtualHost>

------------------------------------------------------------
Otherwise I think one will just overwrite the other.
Also for MSIE compatibility it is recommended that you add
the following to the virtual host configuration:
------------------------------------------------------------

SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

------------------------------------------------------------
Hope this was helpful.

/Daniel

----- Original Message ----- 
From: "Hoda Nadeem" <[email protected]>
To: <[email protected]>
Sent: Thursday, June 02, 2005 3:26 PM
Subject: RE: SSL Client Auth with Virtual Hosts


Are there any parameters that I am missing, or am I doing something
incorrect?

On my setup, client authentication is either on or off globally. I can't
seem to isolate it at the virtual host level.

Thanks. 

Nadeem

Example again:

NameVirtualHost 111.111.111.111:443

<Virtualhost 111.111.111.111:443>
    ServerAdmin [email protected]
    DocumentRoot /var/www
    ServerName abc1-no-client-auth.com

    SSLEngine on
    SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
    SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
</VirtualHost>

<Virtualhost 111.111.111.111:443>
    ServerAdmin [email protected]
    DocumentRoot /var/www
    ServerName abc1-ssl-client-auth.com

    SSLEngine on
    SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
    SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
    SSLVerifyClient require
    SSLVerifyDepth 2
    SSLCACertificateFile /etc/httpd/conf/ssl.crt/server-calist.crt
    SSLOptions +StdEnvVars +ExportCertData
</VirtualHost>

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]