在 ReverseProxy 上下文中切换 SSLVerifyClient
这是 Apache 虚拟主机配置的一部分，匹配的传入请求将转发到 Apache Tomcat 服务器。所有客户端都必须发送客户端证书以进行 App1 的身份验证，但对于 App2，它应该是可选的。
SSLVerifyClient require
SSLVerifyDepth 2
SSLOptions +ExportCertData +StdEnvVars
ProxyRequests Off
ProxyPass /app1/services/App01 ajp://localhost:8307/app1/services/App01
ProxyPass /app1/services/App02 ajp://localhost:8307/app2/services/App02
<Location /app1/services/App01>
ProxyPassReverse ajp://localhost:8307/app2/services/App02
</Location>
<Location /app2/services/App02>
ProxyPassReverse ajp://localhost:8307/app2/services/App02
</Location>
那么是否有可能将 app2 的 SSLVerifyClient 指令从必需切换为可选？
This is a part of an Apache virtualhost configuration, the incoming request, which matches, are forwarded to the Apache Tomcat server. All clients must send a client certificate for authentication for App1, but for App2 it should be optional.
SSLVerifyClient require
SSLVerifyDepth 2
SSLOptions +ExportCertData +StdEnvVars
ProxyRequests Off
ProxyPass /app1/services/App01 ajp://localhost:8307/app1/services/App01
ProxyPass /app1/services/App02 ajp://localhost:8307/app2/services/App02
<Location /app1/services/App01>
ProxyPassReverse ajp://localhost:8307/app2/services/App02
</Location>
<Location /app2/services/App02>
ProxyPassReverse ajp://localhost:8307/app2/services/App02
</Location>
So is there a posibility to switch for app2 the SSLVerifyClient directive from required to optional?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在阅读了大量文档并尝试不同的方法后，我找到了解决方案！
将所有代理指令放入位置上下文中，将这些主机或虚拟主机的 SSLVerifyClient 指令设置为 可选，并将 SSLVerifyClient require 放入位置指令中，其中这是需要的。
After reading a lot of documentation and trying out different approaches I found the solution!
Bring all proxy directives into the Location context, set the SSLVerifyClient directive for these host or virtualhost to optional and put SSLVerifyClient require into the Location directive where it's needed.