Client: client01.goweekend.ca
Request Server Certificate for apache01.goweekend.ca, apache01.pem
apache01.key.encrypted, apache01.key
Request Client or Server-Client Certificate for client01.goweekend.ca, client01.pem
client01.key.encrypted, client01.key
Download Root or Sub Certificates
ca.pem
sub.pem
cat sub.pem > server-full-chain.pem
cat ca.pem >> server-full-chain.pem
cat client01.pem > client01-full-chain.pem
cat sub.pem >> client01-full-chain.pem
cat ca.pem >> client01-full-chain.pem
LISTEN 8443
LogLevel debug
<VirtualHost *:8443>
DocumentRoot "/usr/share/helloworld"
ServerName apache01.goweekend.ca:3443
ServerAdmin fei@goweekend.ca
SSLEngine on
SSLCertificateFile /etc/httpd/certs/apache01.crt
SSLCertificateKeyFile /etc/httpd/certs/apache01.key
SSLVerifyClient require
SSLVerifyDepth 10
SSLCACertificateFile /etc/httpd/certs/cot-full-chain.pem
<location />
Order allow,deny
allow from all
##SSLRequire (%{SSL_CLIENT_S_DN_OU} eq "risk")
SSLRequire (%{SSL_CLIENT_S_DN_OU} eq "risk" or %{SSL_CLIENT_S_DN_CN} in {"mjackson", "jsina"})
</location>
CustomLog /var/log/httpd/goweekend_ssl.log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b \"%{SSL_CLIENT_S_DN_CN}x\""
#ProxyPass / http://127.0.0.1/
#ProxyPassReverse / http://127.0.0.1/
</VirtualHost>
###################################################
SSLRequire Sample
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#</Location>
# curl -vv --cert /root/certs/client01.pem --cacert /root/certs/client01-full-chain.pem --key /root/certs/dynamics.key https://github.csd.toronto.ca:3443
Notes:
1. make sure the merged certificates separated lines on different line2
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
2. remove special character in the Certificates and CA Certifactes, especially the file is created in windows, then transfer to unix/linux
