Re: asking mod_ssl for client certificates from another module

[Daniel Risacher]

I (Daniel Risacher) wrote:

>I've been trying to figure out if there is a way to ask mod_ssl to
>require client certificates from another module before the response
>phase.  (I think the answer is 'no'.)
>
>In more detail, I'm prototyping an access handler that would allow
>requests from certain client IP addresses, and require client
>certificates from all others.  It seems like mod_ssl API does not
>have
>a hook for requesting a renegotiation; and that this can only be done
>on a per directory basis at configure time.
>
>Can someone who understands mod_ssl comment on how to dynamically
>force client authentication?  Would it be feasible to make such an
>extension to the mod_ssl API?
>
>Dan

Just to close the loop, I think I did figure out how to do this.

Here's the mod_perl2 code I used (during the access phase handler).
>From looking at the mod_ssl source, I think it's important that this
happen *before* the mod_ssl access phase handler.  Since I'm not sure
how to ensure that a mod_perl access handler is called before the
mod_ssl handler, this should probably be done as a HeaderParserHandler
instead. 

sub access_handler {
    my ($r) = @_;
    ...
    if (&hostname_ok($r)) {
        $r->add_config(['SSLVerifyClient require',
                        'SSLVerifyDepth 3',
                        ]);
    ...
    }
}