+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div>
+<div class="directive-section"><h2 id="ssltrustrequesturi"><span id="SSLTrustRequestURI">SSLTrustRequestURI</span> Directive <a title="Permanent link" href="#ssltrustrequesturi" class="permalink">¶</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>certificate store of CA Certificates for defining
+acceptable CA names</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLTrustRequestURI <var>uri</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr>
+</table>
+<p>When a client certificate is requested by mod_ssl, a list of
+<em>acceptable Certificate Authority names</em> is sent to the client
+in the SSL handshake. These CA names can be used by the client to
+select an appropriate client certificate out of those it has
+available.</p>
+
+<p>If none of the directives <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code>, <code class="directive"><a href="#sslcadnrequestpath">SSLCADNRequestPath</a></code>, or <code class="directive">SSLTrustRequestURI</code> are given, then the
+set of acceptable CA names sent to the client is the names of all the
+CA certificates given by the <code class="directive"><a href="#sslcacertificatefile">SSLCACertificateFile</a></code>, <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code>, and <code class="directive"><a href="#ssltrusturi">SSLTrustURI</a></code> directives; in other
+words, the names of the CAs which will actually be used to verify the
+client certificate.</p>
+
+<p>In some circumstances, it is useful to be able to send a set of
+acceptable CA names which differs from the actual CAs used to verify
+the client certificate - for example, if the client certificates are
+signed by intermediate CAs. In such cases, <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code>, <code class="directive"><a href="#sslcadnrequestpath">SSLCADNRequestPath</a></code>, and/or <code class="directive">SSLTrustRequestURI</code> can be used; the
+acceptable CA names are then taken from the complete set of
+certificates in the directory and/or file specified by this pair of
+directives.</p>
+
+<p><code class="directive">SSLTrustRequestURI</code> must
+specify an <em>all-in-one</em> certificate store uri containing a
+set of CA certificates.</p>
+
+<div class="example"><h3>Example</h3><pre class="prettyprint lang-config">SSLTrustRequestURI "file:///usr/local/apache2/conf/ca-names.crt"</pre>
+</div>
+
+<p>A <var>file:</var> URI pointing at a file of PEM encoded certificates
+can be used instead of <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code>, and a <var>file:</var>
+URI pointing at a directory of PEM encoded certificates can be used
+instead of <code class="directive"><a href="#sslcadnrequestpath">SSLCADNRequestPath</a></code>.
+</p>
+
+<p>This store is read at server startup, while the server is still running
+as <code>root</code> (before privilege dropping), so it may be owned by
+and readable only by <code>root</code>. The uri is not re-read during
+normal operation; a server restart is required for changes to take
+effect.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div>
+<div class="directive-section"><h2 id="ssltrusturi"><span id="SSLTrustURI">SSLTrustURI</span> Directive <a title="Permanent link" href="#ssltrusturi" class="permalink">¶</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Server CA certificate store for Client Authentication</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLTrustURI <var>uri</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
+<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr>
+<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.5.1 and later, when linked with
+OpenSSL v3 or later.</td></tr>
+</table>
+<p>
+This directive sets URIs where you can assemble the Certificates of Certification
+Authorities (CA) whose <em>clients</em> you deal with. These are used for Client
+Authentication. This can be used alternatively and/or additionally to
+<code class="directive"><a href="#sslcacertificatefile">SSLCACertificateFile</a></code>
+or <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code>.</p>
+<div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># trust certs in a PEM encoded certificate bundle
+SSLTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt"
+# trust all certs in a typical Linux machine
+SSLTrustURI "pkcs11:token=System%20Trust"
+# trust all certs in the Windows trust store
+SSLTrustURI "org.openssl.winstore:"</pre>
+</div>
+
+<p>
+This directive will also read in Certificate Revocation Lists (CRL) of
+Certification Authorities (CAs) whose clients you deal with. These are used
+to revoke the client certificate on Client Authentication.</p>
+
+<p>This URI is read at server startup, while the server is still running
+as <code>root</code> (before privilege dropping), so it may be owned by
+and readable only by <code>root</code>. The URI is not re-read during
+normal operation; a server restart is required for changes to take
+effect.</p>
+
projects / thirdparty / apache / httpd.git / commitdiff
