Ssl – Wildcard SSL, one subdomain requires client certificate

apache-2.2certificatesslsubdomainwildcard

This configuration works ok, but it asks for certificate on all subdomains.

<VirtualHost IP:443>
ServerName *.domain.tld
ServerAlias www.*.domain.tld
VirtualDocumentRoot /home/domaintld/subdomains/%1
ServerAdmin webmaster@*.domain.tld

UseCanonicalName off
UserDir public_html

SSLEngine on
SSLVerifyClient require
SSLVerifyDepth 1
SSLCertificateFile /path/to/cert.crt
SSLCACertificateFile /path/to/CAcert.crt
SSLCertificateKeyFile /path/to/key.key

<Directory "/home/domaintld/subdomains/%1">
  SSLRequire %{SSL_CLIENT_S_DN_O} eq "Company" 
and %{SSL_CLIENT_S_DN_OU} in {"Department"} 
# this one is not splitted, only here to avoid horiz. scroll
</Directory>

CustomLog /usr/local/apache/domlogs/domain.tld-ssl_log combined
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

</VirtualHost>

But I want to make it to ask for only on subdomain, supposedly "theone.domain.tld"

I tried:

#...
SSLEngine on
SSLCertificateFile /path/to/cert.crt
SSLCACertificateFile /path/to/CAcert.crt
SSLCertificateKeyFile /path/to/key.key

<Directory "/home/domaintld/subdomains/theone">
  SSLVerifyClient require
  SSLVerifyDepth 1
  SSLRequire %{SSL_CLIENT_S_DN_O} eq "Company" 
and %{SSL_CLIENT_S_DN_OU} in {"Department"} 
# this one is not splitted, only here to avoid horiz. scroll
</Directory>
#...

Also with the <Directory ..> outside <VirtualHost ..>

Even added SSLCACertificateFile within <Directory ..>

I get the other subdomains working through HTTPS but "theone" gives an Error 107 (net::ERR_SSL_PROTOCOL_ERROR)

I have to mention that the whole VirtualHost and Directory are/were within <IfDefine SSL></IfDefine>

Any suggestions?

Thanks.

Best Answer

SSL negotiation is completed before the the HTTP header that includes the criteria to select the proper virtual host is transmitted. This means you cannot use any unique SSL options per virtual host. The only option I am aware of would be to get another IP address and setup an IP based virtual host for the the sites you require certificate authentication on.

http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts