Apache :: 2-way SSL with 1-way SSL mix

tenly · Joined: 10 Apr 2014 Posts: 3 Location: Canada, Toronto

Hi all, I'm very new to Apache and am trying to modify the configuration of an existing application server. The server used to run on an intranet with no requirement for SSL. The new requirement is to provide access over the internet and so enabling SSL is mandatory.

I would like to know if the following type of configuration is possible - and if so - perhaps someone could point me to some documentation that explains how to do it.

The majority of the functionality the web-server provides will be consumed by other programs, however there is also a a password protected "control panel" which a user would sign into using a web-browser.

The only port we want to open up to the internet is 443. The server is running on an Amazon EC2 instance with an Elastic (Public) IP address. We have created 2 different public DNS aliases that both resolve to this server.

We would like the "default configuration" for this web server to be that 2-way SSL (mutual authentication) is required. The programs/apps that consume services from the web server will be configured with a certificate which allows them to communicate with the server. We have successfully configured the server this way. It's the next requirement that we are unable to make work.

We would like to allow any connections that come in requesting /console/* to NOT require mutual authentication. We only want to require 1-way SSL for users connecting to our console with a web-browser.

It seems pretty easy to say and I don't think this is would be an unreasonable request - but we have searched unsuccessfully for months for a configuration that allows this. At times we have had "Apache knowledgeable people tell us that it's both "easy to configure" and "impossible to configure/unsupported".

Thank you in advance to any of you that take the time to respond!

Tenly

tenly · Joined: 10 Apr 2014 Posts: 3 Location: Canada, Toronto

Did I not provide enough information in my question? Or did I post it in the wrong forum?

In 3 weeks, my question is the only one that has received 0 replies! Is this something that should be so simple to accomplish that nobody wants to take 5 minutes to point me to the answer? Or is it something that is completely impossible to accomplish?

I'm still searching for an answer to this question. If you can help - please do!

Thanks in advance,
Tenly

admin · Site Admin Joined: 15 Oct 2005 Posts: 692

Maybe some pointers for you at http://linuxconfig.org/apache-web-server-ssl-authentication

ps.
When nobody responds is mostly that no one has a solution. Also your post is a lot of text, maybe for ppl it is hard to understand your issues. Missing in your post is the info at point 0 in the forum rules.

James Blond

it is not possible to exclude a single path from that.