☰

Apache SSLVerifyClient-排除一个 URL

tag-icon • tag-icon apache-2.2 ssl-certificate reverse-proxy
Apache SSLVerifyClient-排除一个 URL

我正在将 Apache 2.2 设置为反向代理。我的需求是，除了一个 (https://mailserver.com/Microsoft-Server-ActiveSync) 用于与智能手机同步邮件。

以下是我配置 Apache 代理部分的方法：

ProxyRequests Off
SSLProxyEngine On
ProxyPass    /     https://internalserver/
ProxyPassReverse    /     https://internalserver/

<Proxy https://internalserver/Microsoft-Server-ActiveSync>
SSLVerifyClient none
</Proxy>


SSLVerifyClient require
SSLVerifyDepth 10

但是，使用此配置，Apache 也会请求 Microsoft-Server-ActiveSync 的证书...有没有办法将该 URL 从证书请求中排除？

答案1

我按照从互联网上找到的指南进行操作：http://doc.nuxeo.com/display/ADMINDOC58/Configuring+a+Reverse+Proxy+to+Work+with+Live+Edit+and+Client+Certificate+Authentication

我不得不使用 ProxyMatch 指令，并且对正则表达式做了一些努力：

ProxyRequests Off
SSLProxyEngine On
ProxyPass / https://internalserver/
ProxyPassReverse / https://internalserver/
SSLCACertificateFile /etc/pki/tls/certs/localhost.crt
SSLOptions +stdEnvVars

#Certificate access for all URLs except ActiveSync
<ProxyMatch ^(https\:\/\/internalserver\/(?!(Microsoft-Server-ActiveSync)))>
  SSLRequireSSL
  SSLVerifyClient require
  SSLVerifyDepth 10
</ProxyMatch>

相关内容