| <html> |
| <head> |
| <title>mod_ssl: HowTo</title> |
| |
| <!-- |
| Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved. |
| |
| Redistribution and use in source and binary forms, with or without |
| modification, are permitted provided that the following conditions |
| are met: |
| |
| 1. Redistributions of source code must retain the above |
| copyright notice, this list of conditions and the following |
| disclaimer. |
| |
| 2. Redistributions in binary form must reproduce the above |
| copyright notice, this list of conditions and the following |
| disclaimer in the documentation and/or other materials |
| provided with the distribution. |
| |
| 3. All advertising materials mentioning features or use of this |
| software must display the following acknowledgment: |
| "This product includes software developed by |
| Ralf S. Engelschall <rse@engelschall.com> for use in the |
| mod_ssl project (http://www.modssl.org/)." |
| |
| 4. The name "mod_ssl" must not be used to endorse or promote |
| products derived from this software without prior written |
| permission. |
| |
| 5. Redistributions of any form whatsoever must retain the |
| following acknowledgment: |
| "This product includes software developed by |
| Ralf S. Engelschall <rse@engelschall.com> for use in the |
| mod_ssl project (http://www.modssl.org/)." |
| |
| THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY |
| EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S. ENGELSCHALL OR |
| HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| OF THE POSSIBILITY OF SUCH DAMAGE. |
| --> |
| <style type="text/css"><!-- |
| A:link { |
| text-decoration: none; |
| color: #6666cc; |
| } |
| A:active { |
| text-decoration: none; |
| color: #6666cc; |
| } |
| A:visited { |
| text-decoration: none; |
| color: #6666cc; |
| } |
| #sf { |
| font-family: arial,helvetica; |
| font-variant: normal; |
| font-style: normal; |
| } |
| H1 { |
| font-weight: bold; |
| font-size: 24pt; |
| line-height: 24pt; |
| font-family: arial,helvetica; |
| font-variant: normal; |
| font-style: normal; |
| } |
| H2 { |
| font-weight: bold; |
| font-size: 18pt; |
| line-height: 18pt; |
| font-family: arial,helvetica; |
| font-variant: normal; |
| font-style: normal; |
| } |
| H3 { |
| font-weight: bold; |
| font-size: 14pt; |
| line-height: 14pt; |
| font-family: arial,helvetica; |
| font-variant: normal; |
| font-style: normal; |
| } |
| H4 { |
| font-weight: bold; |
| font-size: 12pt; |
| line-height: 12pt; |
| font-family: arial,helvetica; |
| font-variant: normal; |
| font-style: normal; |
| } |
| #H { |
| } |
| #D { |
| background-color: #f0f0f0; |
| } |
| #faq { |
| font-weight: bold; |
| font-size: 16pt; |
| line-height: 16pt; |
| font-family: arial,helvetica; |
| font-variant: normal; |
| font-style: normal; |
| } |
| #howto { |
| font-weight: bold; |
| font-size: 16pt; |
| line-height: 16pt; |
| font-family: arial,helvetica; |
| font-variant: normal; |
| font-style: normal; |
| } |
| #term { |
| font-weight: bold; |
| font-size: 16pt; |
| line-height: 16pt; |
| font-family: arial,helvetica; |
| font-variant: normal; |
| font-style: normal; |
| } |
| --></style> |
| <script type="text/javascript" language="JavaScript"> |
| <!-- Hiding the code |
| function ro_imgNormal(imgName) { |
| if (document.images) { |
| document[imgName].src = eval(imgName + '_n.src'); |
| self.status = ''; |
| } |
| } |
| function ro_imgOver(imgName, descript) { |
| if (document.images) { |
| document[imgName].src = eval(imgName + '_o.src'); |
| self.status = descript; |
| } |
| } |
| // done hiding --> |
| </script> |
| <script type="text/javascript" language="JavaScript"> |
| <!-- Hiding the code |
| if (document.images) { |
| ro_img_prev_top_n = new Image(); |
| ro_img_prev_top_n.src = 'ssl_template.navbut-prev-n.gif'; |
| ro_img_prev_top_o = new Image(); |
| ro_img_prev_top_o.src = 'ssl_template.navbut-prev-s.gif'; |
| } |
| // done hiding --> |
| </script> |
| <script type="text/javascript" language="JavaScript"> |
| <!-- Hiding the code |
| if (document.images) { |
| ro_img_prev_bot_n = new Image(); |
| ro_img_prev_bot_n.src = 'ssl_template.navbut-prev-n.gif'; |
| ro_img_prev_bot_o = new Image(); |
| ro_img_prev_bot_o.src = 'ssl_template.navbut-prev-s.gif'; |
| } |
| // done hiding --> |
| </script> |
| <script type="text/javascript" language="JavaScript"> |
| <!-- Hiding the code |
| if (document.images) { |
| ro_img_next_top_n = new Image(); |
| ro_img_next_top_n.src = 'ssl_template.navbut-next-n.gif'; |
| ro_img_next_top_o = new Image(); |
| ro_img_next_top_o.src = 'ssl_template.navbut-next-s.gif'; |
| } |
| // done hiding --> |
| </script> |
| <script type="text/javascript" language="JavaScript"> |
| <!-- Hiding the code |
| if (document.images) { |
| ro_img_next_bot_n = new Image(); |
| ro_img_next_bot_n.src = 'ssl_template.navbut-next-n.gif'; |
| ro_img_next_bot_o = new Image(); |
| ro_img_next_bot_o.src = 'ssl_template.navbut-next-s.gif'; |
| } |
| // done hiding --> |
| </script> |
| </head> |
| <body bgcolor="#ffffff" text="#000000" link="#333399" alink="#9999ff" vlink="#000066"> |
| <div align="center"> |
| <table width="600" cellspacing="0" cellpadding="0" border="0" summary=""> |
| <tr> |
| <td> |
| <img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="600" height="1" align="bottom" border="0"><br> |
| <table width="600" cellspacing="0" cellpadding="0" summary=""> |
| <tr> |
| <td> |
| <table width="600" summary=""> |
| <tr> |
| <td align="left" valign="bottom"> |
| <font face="Arial,Helvetica" size="+2"><b>mod_ssl</b></font> |
| </td> |
| <td align="right"> |
| <img src="ssl_template.head-chapter.gif" alt="Chapter" width="175" height="94"> <img src="ssl_template.head-num-5.gif" alt="5" width="74" height="89"> |
| </td> |
| </tr> |
| </table> |
| </td> |
| </tr> |
| <tr> |
| <td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td> |
| <table width="600" border="0" summary=""> |
| <tr> |
| <td valign="top" align="left" width="250"> |
| <a href="ssl_compat.html" onmouseover="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_top'); return true" onfocus="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_top'); return true"><img name="ro_img_prev_top" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Compatibility</font> |
| </td> |
| <td valign="top" align="right" width="250"> |
| <a href="ssl_faq.html" onmouseover="ro_imgOver('ro_img_next_top', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_top'); return true" onfocus="ro_imgOver('ro_img_next_top', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_top'); return true"><img name="ro_img_next_top" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">F.A.Q. List</font> |
| </td> |
| </tr> |
| </table> |
| </td> |
| </tr> |
| <tr> |
| <td> |
| <br> |
| <img src="ssl_template.title-howto.gif" alt="HowTo" width="456" height="60"> |
| </td> |
| </tr> |
| </table> |
| <div align="right"> |
| <table cellspacing="0" cellpadding="0" width="200" summary=""> |
| <tr> |
| <td> |
| <em> |
| ``The solution of this problem is trivial |
| and is left as an exercise for the reader.'' |
| </em> |
| </td> |
| </tr> |
| <tr> |
| <td align="right"> |
| <font size="-1"> |
| Standard textbook cookie |
| </font> |
| </td> |
| </tr> |
| </table> |
| </div> |
| <p> |
| <table cellspacing="0" cellpadding="0" border="0" summary=""> |
| <tr valign="bottom"> |
| <td> |
| <img src="ssl_howto.gfont000.gif" alt="H" width="40" height="34" border="0" align="left"> |
| ow to solve particular security constraints for an SSL-aware webserver |
| is not always obvious because of the coherences between SSL, HTTP and Apache's |
| way of processing requests. This chapter gives instructions on how to solve |
| such typical situations. Treat is as a first step to find out the final |
| solution, but always try to understand the stuff before you use it. Nothing is |
| worse than using a security solution without knowing it's restrictions and |
| coherences. |
| </td> |
| <td> |
| |
| </td> |
| <td> |
| <div align="right"> |
| <table cellspacing="0" cellpadding="5" border="0" bgcolor="#ccccff" width="300" summary=""> |
| <tr> |
| <td bgcolor="#333399"> |
| <font face="Arial,Helvetica" color="#ccccff"> |
| <b>Table Of Contents</b> |
| </font> |
| </td> |
| </tr> |
| <tr> |
| <td> |
| <font face="Arial,Helvetica" size="-1"> |
| <a href="#ToC1"><strong>Cipher Suites and Enforced Strong Security</strong></a><br> |
| <a href="#ToC2"><strong>SSLv2 only server</strong></a><br> |
| <a href="#ToC3"><strong>strong encryption only server</strong></a><br> |
| <a href="#ToC4"><strong>server gated cryptography</strong></a><br> |
| <a href="#ToC5"><strong>stronger per-directory requirements</strong></a><br> |
| <a href="#ToC6"><strong>Client Authentication and Access Control</strong></a><br> |
| <a href="#ToC7"><strong>simple certificate-based client authentication</strong></a><br> |
| <a href="#ToC8"><strong>selective certificate-based client authentication</strong></a><br> |
| <a href="#ToC9"><strong>particular certificate-based client authentication</strong></a><br> |
| <a href="#ToC10"><strong>intranet vs. internet authentication</strong></a><br> |
| </font> |
| </td> |
| </tr> |
| </table> |
| </div> |
| </td> |
| </tr> |
| </table> |
| <h2><a name="ToC1">Cipher Suites and Enforced Strong Security</a></h2> |
| <ul> |
| <p> |
| <li><a name="ToC2"></a> |
| <a name="cipher-sslv2"></a> |
| <strong id="howto"> |
| How can I create a real SSLv2-only server? |
| </strong> |
| [<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#cipher-sslv2"><b>L</b></a>] |
| <p> |
| The following creates an SSL server which speaks only the SSLv2 protocol and |
| its ciphers. |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| SSLProtocol -all +SSLv2 |
| SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| <p> |
| <li><a name="ToC3"></a> |
| <a name="cipher-strong"></a> |
| <strong id="howto"> |
| How can I create an SSL server which accepts strong encryption only? |
| </strong> |
| [<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#cipher-strong"><b>L</b></a>] |
| <p> |
| The following enables only the seven strongest ciphers: |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| SSLProtocol all |
| SSLCipherSuite HIGH:MEDIUM |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| <p> |
| <li><a name="ToC4"></a> |
| <a name="cipher-sgc"></a> |
| <strong id="howto"> |
| How can I create an SSL server which accepts strong encryption only, |
| but allows export browsers to upgrade to stronger encryption? |
| </strong> |
| [<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#cipher-sgc"><b>L</b></a>] |
| <p> |
| This facility is called Server Gated Cryptography (SGC) and details you can |
| find in the <code>README.GlobalID</code> document in the mod_ssl distribution. |
| In short: The server has a Global ID server certificate, signed by a special |
| CA certificate from Verisign which enables strong encryption in export |
| browsers. This works as following: The browser connects with an export cipher, |
| the server sends it's Global ID certificate, the browser verifies it and |
| subsequently upgrades the cipher suite before any HTTP communication takes |
| place. The question now is: How can we allow this upgrade, but enforce strong |
| encryption. Or in other words: Browser either have to initially connect with |
| strong encryption or have to upgrade to strong encryption, but are not allowed |
| to keep the export ciphers. The following does the trick: |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| # allow all ciphers for the inital handshake, |
| # so export browsers can upgrade via SGC facility |
| SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL |
| <Directory /usr/local/apache/htdocs> |
| # but finally deny all browsers which haven't upgraded |
| SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128 |
| </Directory> |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| <p> |
| <li><a name="ToC5"></a> |
| <a name="cipher-perdir"></a> |
| <strong id="howto"> |
| How can I create an SSL server which accepts all types of ciphers in general, |
| but requires a strong ciphers for access to a particular URL? |
| </strong> |
| [<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#cipher-perdir"><b>L</b></a>] |
| <p> |
| Obviously you cannot just use a server-wide <code>SSLCipherSuite</code> which |
| restricts the ciphers to the strong variants. But mod_ssl allows you to |
| reconfigure the cipher suite in per-directory context and automatically forces |
| a renegotiation of the SSL parameters to meet the new configuration. So, the |
| solution is: |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| # be liberal in general |
| SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL |
| <Location /strong/area> |
| # but https://hostname/strong/area/ and below requires strong ciphers |
| SSLCipherSuite HIGH:MEDIUM |
| </Location> |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| </ul> |
| <h2><a name="ToC6">Client Authentication and Access Control</a></h2> |
| <ul> |
| <p> |
| <li><a name="ToC7"></a> |
| <a name="auth-simple"></a> |
| <strong id="howto"> |
| How can I authenticate clients based on certificates when I know all my |
| clients? |
| </strong> |
| [<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#auth-simple"><b>L</b></a>] |
| <p> |
| When you know your user community (i.e. a closed user group situation), as |
| it's the case for instance in an Intranet, you can use plain certificate |
| authentication. All you have to do is to create client certificates signed by |
| your own CA certificate <code>ca.crt</code> and then verifiy the clients |
| against this certificate. |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| # require a client certificate which has to be directly |
| # signed by our CA certificate in ca.crt |
| SSLVerifyClient require |
| SSLVerifyDepth 1 |
| SSLCACertificateFile conf/ssl.crt/ca.crt |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| <p> |
| <li><a name="ToC8"></a> |
| <a name="auth-selective"></a> |
| <strong id="howto"> |
| How can I authenticate my clients for a particular URL based on certificates |
| but still allow arbitrary clients to access the remaining parts of the server? |
| </strong> |
| [<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#auth-selective"><b>L</b></a>] |
| <p> |
| For this we again use the per-directory reconfiguration feature of mod_ssl: |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| SSLVerifyClient none |
| SSLCACertificateFile conf/ssl.crt/ca.crt |
| <Location /secure/area> |
| SSLVerifyClient require |
| SSLVerifyDepth 1 |
| </Location> |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| <p> |
| <li><a name="ToC9"></a> |
| <a name="auth-particular"></a> |
| <strong id="howto"> |
| How can I authenticate only particular clients for a some URLs based |
| on certificates but still allow arbitrary clients to access the remaining |
| parts of the server? |
| </strong> |
| [<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#auth-particular"><b>L</b></a>] |
| <p> |
| The key is to check for various ingredients of the client certficate. Usually |
| this means to check the whole or part of the Distinguished Name (DN) of the |
| Subject. For this two methods exists: The <code>mod_auth</code> based variant |
| and the <code>SSLRequire</code> variant. The first method is good when the |
| clients are of totally different type, i.e. when their DNs have no common |
| fields (usually the organisation, etc.). In this case you've to establish a |
| password database containing <em>all</em> clients. The second method is better |
| when your clients are all part of a common hierarchy which is encoded into the |
| DN. Then you can match them more easily. |
| <p> |
| The first method: |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">/usr/local/apache/conf/httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| SSLVerifyClient none |
| <Directory /usr/local/apache/htdocs/secure/area> |
| SSLVerifyClient require |
| SSLVerifyDepth 5 |
| SSLCACertificateFile conf/ssl.crt/ca.crt |
| SSLCACertificatePath conf/ssl.crt |
| SSLOptions +FakeBasicAuth |
| SSLRequireSSL |
| AuthName "Snake Oil Authentication" |
| AuthType Basic |
| AuthUserFile /usr/local/apache/conf/httpd.passwd |
| require valid-user |
| </Directory> |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">/usr/local/apache/conf/httpd.passwd</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| /C=DE/L=Munich/O=Snake Oil, Ltd./OU=Staff/CN=Foo:xxj31ZMTZzkVA |
| /C=US/L=S.F./O=Snake Oil, Ltd./OU=CA/CN=Bar:xxj31ZMTZzkVA |
| /C=US/L=L.A./O=Snake Oil, Ltd./OU=Dev/CN=Quux:xxj31ZMTZzkVA |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| <p> |
| The second method: |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| SSLVerifyClient none |
| <Directory /usr/local/apache/htdocs/secure/area> |
| SSLVerifyClient require |
| SSLVerifyDepth 5 |
| SSLCACertificateFile conf/ssl.crt/ca.crt |
| SSLCACertificatePath conf/ssl.crt |
| SSLOptions +FakeBasicAuth |
| SSLRequireSSL |
| SSLRequire %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." and \ |
| %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} |
| </Directory> |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| <p> |
| <li><a name="ToC10"></a> |
| <a name="auth-intranet"></a> |
| <strong id="howto"> How can |
| I require HTTPS with strong ciphers and either basic authentication or client |
| certificates for access to a subarea on the Intranet website for clients |
| coming from the Internet but still allow plain HTTP access for clients on the |
| Intranet? |
| </strong> |
| [<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#auth-intranet"><b>L</b></a>] |
| <p> |
| Let us assume the Intranet can be distinguished through the IP network |
| 192.160.1.0/24 and the subarea on the Intranet website has the URL |
| <tt>/subarea</tt>. Then configure the following outside your HTTPS virtual |
| host (so it applies to both HTTPS and HTTP): |
| <p> |
| <table border="0" cellpadding="0" cellspacing="0" summary=""> |
| <tr> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td> |
| <td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td> |
| <td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| <td colspan="3" bgcolor="#ffffff"> |
| <table border="0" cellspacing="4" summary=""> |
| <tr> |
| <td> |
| <pre> |
| |
| SSLCACertificateFile conf/ssl.crt/company-ca.crt |
| |
| <Directory /usr/local/apache/htdocs> |
| # Outside the subarea only Intranet access is granted |
| Order deny,allow |
| Deny from all |
| Allow from 192.168.1.0/24 |
| </Directory> |
| |
| <Directory /usr/local/apache/htdocs/subarea> |
| # Inside the subarea any Intranet access is allowed |
| # but from the Internet only HTTPS + Strong-Cipher + Password |
| # or the alternative HTTPS + Strong-Cipher + Client-Certificate |
| |
| # If HTTPS is used, make sure a strong cipher is used. |
| # Additionally allow client certs as alternative to basic auth. |
| SSLVerifyClient optional |
| SSLVerifyDepth 1 |
| SSLOptions +FakeBasicAuth +StrictRequire |
| SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128 |
| |
| # Force clients from the Internet to use HTTPS |
| RewriteEngine on |
| RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$ |
| RewriteCond %{HTTPS} !=on |
| RewriteRule .* - [F] |
| |
| # Allow Network Access and/or Basic Auth |
| Satisfy any |
| |
| # Network Access Control |
| Order deny,allow |
| Deny from all |
| Allow 192.168.1.0/24 |
| |
| # HTTP Basic Authentication |
| AuthType basic |
| AuthName "Protected Intranet Area" |
| AuthUserFile conf/protected.passwd |
| Require valid-user |
| </Directory> |
| |
| </pre> |
| </td> |
| </tr> |
| </table> |
| </td> |
| <td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td> |
| </tr> |
| </table> |
| </ul> |
| <p> |
| <br> |
| <table summary=""> |
| <tr> |
| <td> |
| <table width="600" border="0" summary=""> |
| <tr> |
| <td valign="top" align="left" width="250"> |
| <a href="ssl_compat.html" onmouseover="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_bot'); return true" onfocus="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_bot'); return true"><img name="ro_img_prev_bot" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Compatibility</font> |
| </td> |
| <td valign="top" align="right" width="250"> |
| <a href="ssl_faq.html" onmouseover="ro_imgOver('ro_img_next_bot', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_bot'); return true" onfocus="ro_imgOver('ro_img_next_bot', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_bot'); return true"><img name="ro_img_next_bot" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">F.A.Q. List</font> |
| </td> |
| </tr> |
| </table> |
| </td> |
| </tr> |
| <tr> |
| <td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td> |
| </tr> |
| <tr> |
| <td><table width="598" summary=""> |
| <tr> |
| <td align="left"><font face="Arial,Helvetica"> |
| <a href="http://www.modssl.org/">mod_ssl</a> 2.8, User Manual<br> |
| The Apache Interface to OpenSSL |
| </font> |
| </td> |
| <td align="right"><font face="Arial,Helvetica"> |
| Copyright © 1998-2001 |
| <a href="http://www.engelschall.com/">Ralf S. Engelschall</a><br> |
| All Rights Reserved<br> |
| </font> |
| </td> |
| </tr> |
| </table> |
| </td> |
| </tr> |
| </table> |
| </td> |
| </tr> |
| </table> |
| </div> |
| </body> |
| </html> |
