Apache Pocket Ref

Generalized Access Control Directives

mod_ssl, Stronghold, and the IBM HTTP Server provide gener-

alized access control directives that allow arbitrary conditions

to be specified, based on attributes of the components of the

client certificate, or in the case of mod_ssl, based on any CGI

or SSL variable. The syntax of the expressions varies among

the four directives (

SSLRequire, SSL_Require, SSL_Group, and

SSLClientAuthRequire). Space precludes describing each syn-

tax; refer to the appropriate server documentation for details.

Logging

SSL requests are logged to the configured transfer log, as for

normal HTTP requests. However, Apache-SSL and mod_ssl

add a

%{var}x specifier to add the value of the named CGI/SSI

variable to the log format. There is also a

%{function}c speci-

fier to log an SSL function.

Function iption

version SSL protocol version

cipher SSL cipher

subjectdn Client certificate subject DN

issuerdn Client certificate issuer DN

errcode Certificate verification numeric error code

errstr Certificate verification error string

Descr

The following additional logging directives are mainly for

debugging, as error conditions will normally be logged to

Apache’s error log file.

SSLLog

SSLLog filename

Contexts: GV Compatibility: mod_ssl

Specifies the log file for the SSL engine. If the filename begins with a

vertical bar (|) it is taken as the path of an executable program.

Secure V