SSLVerifyClient optional redirect or be graceful upon revoked certificate

When using "SSLVerifyClient optional" is there a way (or are there plans =
for this) to redirect when mod_ssl detects a revoked certificate? What ab=
out setting $_SERVER["SSL_CLIENT_VERIFY"] =3D=3D "FAIL" just as it is whe=
n no certificate is installed? In other words, why should the action be a=
ny different for no-certificate and revoked-certificate?

BTW, my application is a wrapper app to self manage private SSL certifica=
tes. The login pre-test is intended for all cases (without cert, with cer=
t, and revoked cert) and detects by testing $_SERVER["SSL_CLIENT_VERIFY"]=
 =3D=3D "SUCCESS" (This is in a dedicated directory <Directory "..."> car=
efully designed to eliminate risk from MitM attacks). This works for the =
two cases no-cert & valid-cert, but for revoke-cert we get an ugly hard-s=
top. For example from Firefox: "SSL peer rejected your certificate as rev=
oked".

If this isn't appropriate for modssl-users, is rather an apache issue, th=
en advice for an alternate forum is appreciated. Has it already been disc=
ussed/requested? (searched a lot but didn't find anything)

I would like to build a mod_ssl with both the option to redirect on FAIL =
(separate options for no-cert and revoked-cert), and limit initiate-reneg=
otiation only by server, not by client. Any help is greatly appreciated.

Thanks.=20




______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]