Fwd: How to allow only certain Certificates

2005-10-14 Thread Cliff Woolley
Helps if I send this from the address that is actually subscribed to the list...

resending

-- Forwarded message --
From: Cliff Woolley
Date: Oct 12, 2005 7:41 AM
Subject: Re: How to allow only certain Certificates
To: modssl-users@modssl.org


On 10/12/05, Dr. Harry Knitter [EMAIL PROTECTED] wrote:
 how can I restrict access to my Apache to owners of certain individual
 certificates?

Sounds like a good case for FakeBasicAuth combined with Require User.

http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#ssloptions

Hope this helps,
Cliff
__
Apache Interface to OpenSSL (mod_ssl)   www.modssl.org
User Support Mailing List  modssl-users@modssl.org
Automated List Manager[EMAIL PROTECTED]


Re: Fwd: How to allow only certain Certificates

2005-10-14 Thread Dr. Harry Knitter
Am Freitag, 14. Oktober 2005 13:38 schrieb Cliff Woolley:
 Helps if I send this from the address that is actually subscribed to the
 list...

 resending

 -- Forwarded message --
 From: Cliff Woolley
 Date: Oct 12, 2005 7:41 AM
 Subject: Re: How to allow only certain Certificates
 To: modssl-users@modssl.org

 On 10/12/05, Dr. Harry Knitter [EMAIL PROTECTED] wrote:
  how can I restrict access to my Apache to owners of certain individual
  certificates?

 Sounds like a good case for FakeBasicAuth combined with Require User.

 http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#ssloptions

 Hope this helps,
 Cliff


Thanks, however, I´d prefer something like the Unique Subject Identifyer or 
perhaps the Fingerprints. DNs can be faked easy.

Harry
__
Apache Interface to OpenSSL (mod_ssl)   www.modssl.org
User Support Mailing List  modssl-users@modssl.org
Automated List Manager[EMAIL PROTECTED]


Re: Fwd: How to allow only certain Certificates

2005-10-14 Thread Cliff Woolley
On 10/14/05, Dr. Harry Knitter [EMAIL PROTECTED] wrote:

 Thanks, however, I´d prefer something like the Unique Subject Identifyer or
 perhaps the Fingerprints. DNs can be faked easy.

Not if you require your own CA as the issuing authority using
SSLCACertificateFile and SSLRequire, they can't...

--Cliff
__
Apache Interface to OpenSSL (mod_ssl)   www.modssl.org
User Support Mailing List  modssl-users@modssl.org
Automated List Manager[EMAIL PROTECTED]