Untitled

Before i start, remember this - before {SSL:SSL_CLIENT_S_DN} can be matched, the server must fetch the client cert using SSLVerifyClient.

You should not just stick SSLVerifyClient into your config/htaccess, because it will be run for every page, 
and not just the pages {SSL:SSL_CLIENT_S_DN} is concerned about.

This would practically double load times.

Furthermore, i can't stick SSLVerifyClient into a standard <container>, because all the pages on my site use queiries.
eg.
index.php?page=one_page, index.php?page=another_page, and so on.

You can't use <containers> to work with queries, so we use mod_rewrite to turn the query into a path that <Location> can use, run SSLVerifyClient, then run {SSL:SSL_CLIENT_S_DN} to see if they have a client cert or not.

If you're unfamiliar with client certs, they have almost nothing to do with SSL - they are simply certificates that you give out, and users 
have to import into there browser before it will take effect. Nothing to do with encryption - everything to do with authentication.

In this example, we want to send people going tin index.php?page=IRC, to either ?page=IRC2 if they don't have the cert, or ?page=IRC3 if they do.

####        first, change 'index.php?page=IRC' to 'index.php/IRC' so we can <Locate> it:      #####

RewriteEngine on

RewriteCond %{QUERY_STRING} page=IRC?
RewriteRule ^/forum/.* /forum/index.php/IRC? [PT]

#### The ? is used in the RewriteCond (RC) to prevent it working for IRC2 & IRC3 later on, i have no idea why i use [PT] for the RR - i just do. ####

####    Now we call the file index.php/IRC, ask the client if it can present a Certificate        ####

<Location /forum/index.php/IRC>
SSLVerifyClient optional
SSLVerifyDepth 1
</Location>

#### Note that we use optional rather than required, because we don't want people without the cert getting kicked off ####

####  Finally we check for a Client Cert and, if present, go to index.php?page=IRC3 else we go to index.php?page=IRC2 ####

RewriteCond %{SSL:SSL_CLIENT_S_DN} ^$
RewriteRule ^/forum/index.php/IRC /forum/index.php?page=IRC2 [S=1]
RewriteRule ^/forum/index.php/IRC /forum/index.php?page=IRC3

#### Notice how the RC has to match ^$ (nothing) to go to IRC2, and if it does it skips [S=1] going to IRC3. ####
####  This means the client could give any cert as no validation is required other than a cert is not blank  ####

</VirtualHost> 

#### All of the above is located at the bottom of the mod_ssl file, apache22/extras/httpd-ssl.conf ####

[Note for people who googled SSL_CLIENT_S_DN and stumbled across this as one of the 9 hits - THIS DOES NOT WORK!]