<tr><td><code>SSL_CLIENT_VERIFY</code></td>             <td>string</td>    <td><code>NONE</code>, <code>SUCCESS</code>, <code>GENEROUS</code> or <code>FAILED:</code><em>reason</em></td></tr>

<tr><td><code>SSL_CLIENT_VERIFY</code></td>             <td>string</td>    <td><code>NONE</code>, <code>SUCCESS</code>, <code>GENEROUS:<em>reason</em></code> or <code>FAILED:</code><em>reason</em></td></tr>

This directive sets the Certificate verification level for the Client

This directive sets the Certificate verification level for Client Certificate

authentication process used in the standard SSL handshake when a connection is

authentication process in the initial SSL handshake when a connection is

reconfigured client verification level after the HTTP request was read but

reconfigured client verification level after the HTTP request is read but

<li><strong>none</strong>:

<li><code>none</code>

     no client Certificate is required at all</li>

    <p>No client Certificate is requested.</p></li>

<li><strong>optional</strong>:

<li><code>optional_no_verify</code>

     the client <em>may</em> present a valid Certificate</li>

    <p>The client is asked to present a Certificate signed by one of the

<li><strong>require</strong>:

    acceptable CA Certificates, but will be accepted even if no Certificate is

     the client <em>has to</em> present a valid Certificate</li>

    provided, if the provided Certificate is not signed by one of the trusted

<li><strong>optional_no_ca</strong>:

    CA Certificates, or if the provided Certificate has been revoked or is

     the client may present a valid Certificate<br />

    otherwise invalid.</p></li>

     but it need not to be (successfully) verifiable.</li>

<li><code>optional_no_ca</code>

    <p>The client is asked to present a Certificate signed by one of the

    acceptable CA Certificates, and will be accepted even if no Certificate is

    provided or if the provided Certificate is not signed by one of the

    trusted CA Certificates, but will be disconnected if the provided

    Certificate has been revoked or is otherwise invalid.</p></li>

<li><code>optional</code>

    <p>The client is asked to present a Certificate signed by one of the

    acceptable CA Certificates, and will be accepted even if no Certificate is

    provided, but will be disconnected if the provided Certificate is not

    signed by one of the trusted CA Certificates, has been revoked, or is

    otherwise invalid.</p></li>

<li><code>require</code>

    <p>The client is asked to present a Certificate signed by one of the

    acceptable CA Certificates, and will be disconnected if no Certificate is

    provided, if the provided Certificate is not signed by on of the trusted CA

    Certificates, or if the provided Certificate has been revoked or is

    otherwise invalid.</p></li>

<p>In practice only levels <strong>none</strong> and

<p>In practice, most users will want either <strong>none</strong> or

<strong>require</strong> are really interesting, because level

<strong>require</strong>, as the other levels allow users to bypass the

<strong>optional</strong> doesn't work with all browsers and level

authentication mechanism.  However, the other levels may be useful for testing,

<strong>optional_no_ca</strong> is actually against the idea of

or if your web application does it's own Certificate verification.</p>

authentication (but can be used to establish SSL test pages, etc.)</p>

<p>See the <directive module="mod_ssl">SSLCADNRequestFile</directive> and

<directive module="mod_ssl">SSLCADNRequestPath</directive> directives to

configure the list of acceptable CA Certificates, and see the

<directive module="mod_ssl">SSLCACertificateFile</directive> and

<directive module="mod_ssl">SSLCACertificatePath</directive> directives to

configure the list of trusted CA Certificates.</p>

<p>Note that if SSLv2 is used with one of the <strong>optional</strong> levels

and no Certificate signed by one of the acceptable CA Certificates is available,

the browser may give up and disconnect rather than continuing without providing

a Certificate. If SSLv3 or TLS are used, the browser should always either

provide a Certificate or attempt to continue without a Certificate.</p>

<context>virtual host</context>

<context>virtual host</context></contextlist>

<context>directory</context>

<context>.htaccess</context></contextlist>

<override>AuthConfig</override>

server, this directive can be used to configure certificate

server, this directive can be used to configure verification of the

verification of the remote server.  Notice that this directive can be

remote server's SSL Certificate.</p>

used both in per-server and per-directory context. In per-server

context it applies to the remote server authentication process used in

the standard SSL handshake when a connection is established by the

proxy. In per-directory context it forces a SSL renegotation with the

reconfigured remote server verification level after the HTTP request

was read but before the HTTP response is sent.</p>

<li><strong>none</strong>:

<li><code>none</code>

     no remote server Certificate is required at all</li>

    <p>No remote server Certificate verification will be performed.</p></li>

<li><strong>optional</strong>:

<li><code>optional_no_verify</code>

     the remote server <em>may</em> present a valid Certificate</li>

    <p>If the remote server provides a Certificate, it will be verified, but

<li><strong>require</strong>:

    the result will be ignored.</p></li>

     the remote server <em>has to</em> present a valid Certificate</li>

<li><code>optional_no_ca</code>

<li><strong>optional_no_ca</strong>:

    <p>If the remote server provides a Certificate, it will be verified. The

     the remote server may present a valid Certificate<br />

    connection will be accepted even if the Certificate is not signed by one of

     but it need not to be (successfully) verifiable.</li>

    the CAs listed in

    <directive module="mod_ssl">SSLProxyCACertificateFile</directive> or

    <directive module="mod_ssl">SSLProxyCACertificatePath</directive>, but will

    be rejected if verification fails for any other reason.</p></li>

<li><code>optional</code>

    <p>If the remote server provides a Certificate, it will be verified, and the

    connection will be rejected if verification fails.</p></li>

<li><code>require</code>

    <p>The connection will be rejected unless the remote server provides a

    Certificate and that Certificate is successfully verified.</p></li>

<p>In practice only levels <strong>none</strong> and

<p>In practice, most users will want either <strong>none</strong> or

<strong>require</strong> are really interesting, because level

<strong>require</strong>, as the other levels allow a remote server to bypass

<strong>optional</strong> doesn't work with all servers and level

the authentication mechanism.  However, the other levels may be useful for

<strong>optional_no_ca</strong> is actually against the idea of

testing.</p>

authentication (but can be used to establish SSL test pages, etc.)</p>

<context>virtual host</context>

<context>virtual host</context></contextlist>

<context>directory</context>

<context>.htaccess</context></contextlist>

<override>AuthConfig</override>

remote server does not have a valid certificate. Notice that this directive can be

remote server does not have a valid certificate.</p>

used both in per-server and per-directory context. In per-server context it

applies to the client authentication process used in the standard SSL

handshake when a connection is established. In per-directory context it forces

a SSL renegotation with the reconfigured remote server verification depth after the

HTTP request was read but before the HTTP response is sent.</p>

    SSL_CVERIFY_OPTIONAL_NO_CA  = 3

    SSL_CVERIFY_OPTIONAL_NO_CA  = 3,

    SSL_CVERIFY_OPTIONAL_NO_VERIFY = 4

        (mctx->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))

        (mctx->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA) ||

        (mctx->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_VERIFY))

        if (ssl_verify_error_is_optional(verify_result) &&

        const char *error = sslconn->verify_error ?

            (sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))

            sslconn->verify_error :

            X509_verify_cert_error_string(verify_result);

        if ((ssl_verify_error_is_optional(verify_result) &&

            sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA) ||

            sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_VERIFY)

                          "SSL client authentication failed, "

                          "SSL client authentication failed, accepting "

                          "accepting certificate based on "

                          "certificate based on \"SSLVerifyClient "

                          "\"SSLVerifyClient optional_no_ca\" "

                          "optional_no_ca\" or \"SSLVerifyClient "

                          "configuration");

                          "optional_no_verify\" configuration: %s",

                          error ? error : "unknown");

    else if (vrc == X509_V_OK && vinfo != NULL && strEQ(vinfo, "GENEROUS"))

    else if (vinfo != NULL && strEQ(vinfo, "GENEROUS"))

        result = "GENEROUS";

        if (verr)

            result = apr_psprintf(p, "GENEROUS:%s", verr);

        else

            result = "GENEROUS";

     * The order is: none << optional_no_ca << optional << require

     * The order is: none << optional_no_verify << optional_no_ca << optional << require

            (sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))

            (sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA) ||

            (sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_VERIFY))

        (verify == SSL_CVERIFY_OPTIONAL_NO_CA))

        ((verify == SSL_CVERIFY_OPTIONAL_NO_CA) ||

         (verify == SSL_CVERIFY_OPTIONAL_NO_VERIFY)))

                      "Certificate Verification: Verifiable Issuer is "

                      "Certificate Verification: Error (%d) but verifiable "

                      "configured as optional, therefore we're accepting "

                      "Issuer is configured as optional, therefore we're "

                      "the certificate");

                      "accepting the certificate: %s", errnum,

                      X509_verify_cert_error_string(errnum));

        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn,

        if (verify == SSL_CVERIFY_OPTIONAL_NO_VERIFY) {

                      "Certificate Verification: Error (%d): %s",

            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, conn,

                      errnum, X509_verify_cert_error_string(errnum));

                          "Certificate Verification: Error (%d) but "

                          "verification is configured as optional, therefore "

                          "we're accepting the certificate: %s", errnum,

                          X509_verify_cert_error_string(errnum));

        if (sslconn->client_cert) {

            sslconn->verify_info = "GENEROUS";

            X509_free(sslconn->client_cert);

            if (!sslconn->verify_error) {

            sslconn->client_cert = NULL;

                sslconn->verify_error = X509_verify_cert_error_string(errnum);

            }

            ok = TRUE;

        sslconn->client_dn = NULL;

        else {

        sslconn->verify_error = X509_verify_cert_error_string(errnum);

            ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn,

                          "Certificate Verification: Error (%d): %s",

                          errnum, X509_verify_cert_error_string(errnum));

            if (sslconn->client_cert) {

                X509_free(sslconn->client_cert);

                sslconn->client_cert = NULL;

            }

            sslconn->client_dn = NULL;

            sslconn->verify_error = X509_verify_cert_error_string(errnum);

        }

        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn,

        if (verify == SSL_CVERIFY_OPTIONAL_NO_VERIFY) {

                      "Certificate Verification: Certificate Chain too long "

            ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn,

                      "(chain has %d certificates, but maximum allowed are "

                          "Certificate Verification: Certificate Chain too long "

                      "only %d)",

                          "(chain has %d certificates, but maximum allowed are "

                      errdepth, depth);

                          "only %d) but verification is configured as optional, "

                          "therefore we're accepting the certificate",

                          errdepth, depth);

        errnum = X509_V_ERR_CERT_CHAIN_TOO_LONG;

            sslconn->verify_info = "GENEROUS";

        sslconn->verify_error = X509_verify_cert_error_string(errnum);

            if (!sslconn->verify_error) {

                errnum = X509_V_ERR_CERT_CHAIN_TOO_LONG;

                sslconn->verify_error = X509_verify_cert_error_string(errnum);

            }

        }

        else {

            ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn,

                          "Certificate Verification: Certificate Chain too long "

                          "(chain has %d certificates, but maximum allowed are "

                          "only %d)",

                          errdepth, depth);

        ok = FALSE;

            errnum = X509_V_ERR_CERT_CHAIN_TOO_LONG;

            sslconn->verify_error = X509_verify_cert_error_string(errnum);

            ok = FALSE;

        }

                "('none', 'optional', 'require', 'optional_no_ca')")

                "('none', 'optional_no_verify', 'optional_no_ca', 'optional', 'require')")

               "('on' or 'off')")

               "('none', 'optional_no_verify', 'optional_no_ca', 'optional', 'require')")