Our site is running on apache and is secured using client certificates. So far there was only one certificate that would provide access to the whole site. Now, we have a requirement to expose jira to a new group of users who should not be able to access anything else but jira. I created a separate certificate for that group and planning to distinguish them by using SSLRequire and Location/LocationMatch combination.

So the criteria is:

  1. Users with old certificate can access complete site
  2. Users with new certificate can only access /jira URL pattern

I tried few combination but not able to get the negation for LocationMatch work. Any help would be appreciated.

The httpd.conf file, looks like this:

SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile /etc/apache2/ssl/myca.crt

<Location /jira> 
   SSLRequire   %{SSL_CLIENT_S_DN_CN} in {"AllUsers", "JiraUsers"}
</Location> 

<LocationMatch /!(jira)> 
   SSLRequire   %{SSL_CLIENT_S_DN_CN} eq "AllUsers"
</LocationMatch>
apache2
Edit
Report