RE: [users@httpd] Bug or Feature : global SSLVerifyClient in <VirtualHost> overrides the same in <Location>?

Yefym Dmukh <Yefym.Dmukh@xxxxxxxxxxxxxx> · Tue, 30 Aug 2005 10:23:16 +0200

SSLVerifyClient
is documented as working in directory context, so it should also work in
<Location> context. The manual page for mod_ssl does >explicitly
say that a SSL renegotiation is triggered if a request for the location
is received.

Then this is a bug, because it doesn't work for <Location>

Simple test scenario is :
1. access document root location - "SSLVerifyClient
optional" ,  cance certificate choice window.
2. access location <Location "/auth">
with  "SSLVerifyClient require" - no triggered SSL negotiation
- access without certificate granted.
So the answer to the question : 
Bug or Feature : global SSLVerifyClient in <VirtualHost>
overrides the same in  <Location>? 
it is a bug : )
SSLVerifyClient is documented as working in directory
context, so it should also work in <Location> context. The manual
page for mod_ssl does explicitly say that a SSL renegotiation is triggered
if a request for the location is received.

http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslverifyclient

-ascs

________________________________

From: Yefym Dmukh [mailto:Yefym.Dmukh@xxxxxxxxxxxxxx] 

Sent: Monday, August 29, 2005 3:54 PM

To: users@xxxxxxxxxxxxxxxx

Subject: [users@httpd] Bug or Feature : global SSLVerifyClient in <VirtualHost>
overrides the same in <Location>?

Hi guys , 

please point me if it possible to the docu, cannot find anything related
to the topic. 

here is an example: 

<VirtualHost> 

SSLVerifyClient optional 

Alias /auth   /htdocs/authorisation 

<Location "/auth"> 

SSLVerifyClient require 

SSLOptions +ExportCertData +StdEnvVars 

SSLVerifyDepth 5 

Options None 

</Location> 

</VirtualHost> 

Best Regards , 

Yefym

---------------------------------------------------------------------

The official User-To-User support forum of the Apache HTTP Server Project.

See <URL:http://httpd.apache.org/userslist.html> for more info.

To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx

   "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx

For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx