# but finally deny all browsers which haven't upgraded<br />
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128<br />
</Directory>
</code></p></div>
<h3><a name="strongurl" id="strongurl">How can I create an SSL server which accepts all types of ciphers
in general, but requires a strong ciphers for access to a particular
URL?</a></h3>
<p>Obviously you cannot just use a server-wide <code class="directive"><a href="../mod/mod_ssl.html#sslciphersuite">SSLCipherSuite</a></code> which restricts the
ciphers to the strong variants. But mod_ssl allows you to reconfigure
the cipher suite in per-directory context and automatically forces
a renegotiation of the SSL parameters to meet the new configuration.
<li><a href="#intranet">intranet vs. internet authentication</a></li>
</ul>
<h3><a name="allclients" id="allclients">How can I authenticate clients based on certificates when I know
all my clients?</a></h3>
<p>When you know your user community (i.e. a closed user group
situation), as it's the case for instance in an Intranet, you can
use plain certificate authentication. All you have to do is to
create client certificates signed by your own CA certificate
<code>ca.crt</code> and then verify the clients against this
certificate.</p>
<div class="example"><h3>httpd.conf</h3><p><code>
# require a client certificate which has to be directly<br />
# signed by our CA certificate in ca.crt<br />
SSLVerifyClient require<br />
SSLVerifyDepth 1<br />
SSLCACertificateFile conf/ssl.crt/ca.crt
</code></p></div>
<h3><a name="arbitraryclients" id="arbitraryclients">How can I authenticate my clients for a particular URL based on
certificates but still allow arbitrary clients to access the remaining
parts of the server?</a></h3>
<p>For this we again use the per-directory reconfiguration feature
of <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>:</p>
<div class="example"><h3>httpd.conf</h3><p><code>
SSLVerifyClient none<br />
SSLCACertificateFile conf/ssl.crt/ca.crt<br />
<br />
<Location /secure/area><br />
SSLVerifyClient require<br />
SSLVerifyDepth 1<br />
</Location><br />
</code></p></div>
<h3><a name="certauthenticate" id="certauthenticate">How can I authenticate only particular clients for a some URLs based
on certificates but still allow arbitrary clients to access the remaining
parts of the server?</a></h3>
<p>The key is to check for various ingredients of the client certificate.
Usually this means to check the whole or part of the Distinguished
Name (DN) of the Subject. For this two methods exists: The <code class="module"><a href="../mod/mod_auth.html">mod_auth</a></code> based variant and the <code class="directive"><a href="../mod/mod_ssl.html#sslrequire">SSLRequire</a></code> variant. The first method is
good when the clients are of totally different type, i.e. when their
DNs have no common fields (usually the organisation, etc.). In this
case you've to establish a password database containing <em>all</em>
clients. The second method is better when your clients are all part of
a common hierarchy which is encoded into the DN. Then you can match
