从 SSLVerifyClient 要求中排除路径

Question

我有Apache 2.4.18(Ubuntu(作为反向代理运行。为了保护我的个人环境，我添加了一个SSLVerifyClient require，到目前为止没有问题。

但是，Jira 希望访问自身以加载某些语言字符串。根据 Jira 的日志记录，https://{DOMAIN_URL}/rest/gadgets/1.0/g/messagebundle/nl_NL/gadget.common%2Cgadget.projectgadget.common%2Cgadget.project可以不同的地方，具体取决于它需要一些翻译字符串的模块。

好的，好的。因此，为了解决此解决方案，我想使此URL可用于Jira，从而仅针对此特定URL跳过SSLVerifyClient。

我目前的配置：

<VirtualHost *:80>
ServerName {DOMAIN}
Redirect permanent / https://{DOMAIN}
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerAdmin info@{DOMAIN}
ServerName {DOMAIN}
<Location / >
Options FollowSymLinks
AllowOverride None
</Location>
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
SSLEngine       on
SSLCompression      Off
SSLProtocol         ALL -SSLv2 -SSLv3
SSLHonorCipherOrder     On
SSLCipherSuite      EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLCertificateFile  {SSL}/fullchain.pem
SSLCertificateKeyFile   {SSL}/privkey.pem
SSLCACertificateFile    {PATH}/ca.crt
SSLVerifyClient     require
SSLStrictSNIVHostCheck  on
SSLVerifyDepth      1
ProxyPreserveHost On
ProxyRequests off
ProxyPass / http://localhost/
ProxyPassReverse / http://localhost/
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
</IfModule>

我试图在SSLVerifyDepth 1之后添加以下两个片段

<Directory "/rest/gadgets">
SSLVerifyClient      none
</Directory>

和

<Location /rest/gadgets>
SSLVerifyClient none
</Location>

但是，我确实检查了 https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html(客户端身份验证和访问控制(，但是两者都不起作用。我不太确定，但我可能Location和Directory中指定的路径不是正确的路径。我想让它通用，只检查 URL 的第一部分是否包含/rest/gadgets.

我希望我的问题有点清楚。

Answer 1

这似乎是我问题的答案：

<VirtualHost *:80>
ServerName {DOMAIN}
Redirect permanent / https://{DOMAIN}
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerAdmin info@{DOMAIN}
ServerName {DOMAIN}
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
SSLEngine       on
SSLCompression      Off
SSLProtocol         ALL -SSLv2 -SSLv3
SSLHonorCipherOrder     On
SSLCipherSuite      EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLCertificateFile  {SSL}/fullchain.pem
SSLCertificateKeyFile   {SSL}/privkey.pem
SSLCACertificateFile    {PATH}/ca.crt
SSLStrictSNIVHostCheck  on
<Location / >
SSLVerifyClient     require 
SSLVerifyDepth      1
Options FollowSymLinks
AllowOverride None
</Location>     
<Location /rest/gadgets>
SSLVerifyClient none
</Location>
ProxyPreserveHost On
ProxyRequests off
ProxyPass / http://localhost/
ProxyPassReverse / http://localhost/
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
</IfModule>

诀窍是扩展当前Location并移动SSLVerifyClient。然后添加一个额外的Location-指令，其中包含排除的路径，在本例中rest/gadgets。