apache - SSLRequire 文件表达式

Question

我在 Apache 2.4 中遇到 SSLRequire 文件表达式的问题，因为它似乎无法找到或无法访问有问题的文件。

这是代码摘录:

<Location />    
                SSLOptions +StrictRequire
                SSLRequireSSL
                SSLRequire (%{SSL_CLIENT_CERT} eq file("<full_path_to_PEM_file>"))
</Location>

当我尝试访问该站点时，我在日志中收到此错误:

[Tue Jun 27 13:20:02.358478 2017] [ssl:error] [pid 18661:tid 47040594310912] [client 82.69.3.205:58275] Evaluation of expression from 20-mod_ssl.conf:240 failed: Cannot open file <full_path_to_PEM_file>, referer: https://example.com/

权限是正确的，文件确实存在，所以我不确定在这里还能做什么。

PEM 文件是一个有效的公共(public)证书，在开始和结束时有“BEGIN CERTIFICATE”和“END CERTIFICATE”行...

有什么想法吗？

Answer 1

您的 VHost 应如下所示:

<VirtualHost *:443>
    ServerAdmin webmaster@example.com
    DocumentRoot /var/www/html/example

    ServerName example.com

    SSLEngine on

    SSLCertificateFile /etc/ssl/CA/example_com.crt
    SSLCertificateKeyFile /etc/ssl/CA/example.key

    # https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=1203&nav=0,96,1,95
    SSLCertificateChainFile /etc/ssl/CA/chain_example_with_Positive.pem

    SSLHonorCipherOrder On
    SSLProtocol -all +TLSv1 +SSLv3
    SSLCipherSuite RC4-SHA:HIGH:!MD5:!aNULL:!EDH:!ADH
    SSLInsecureRenegotiation off

    <Directory /example/>
            Options Indexes SymLinksIfOwnerMatch
            AllowOverride All
            Require all granted
    </Directory>
    <Directory /var/www/html/example/>
            Options Indexes SymLinksIfOwnerMatch
            AllowOverride All
            Order allow,deny
            allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown    
</VirtualHost>