Apache ignores SSLRequire directive

I have an Apache setup to serve Subversion data. The configuration looks like this:

<Location /svn>
 DAV svn
 SVNPath /path/to/svn
 AuthType Basic
 AuthName "My Project"
 AuthUserFile /etc/httpd/dav_svn.passwd
 Require valid-user
 SSLRequireSSL
 <LimitExcept GET PROPFIND OPTIONS REPORT>
   Require valid-user
 </LimitExcept>
</Location>

      

This works as expected.

However, I want to relax the SSL requirement so that connections from localhost do not require it. I replaced the SSLRequireSSL directive with the SSLRequire directive.

But Apache seems to be completely ignoring the SSLRequire directive.

AND,

SSLRequire true

      

and

SSLRequire false

      

lead to the same behavior! They both allow connections without SSL.

What am I missing?

(Apache version: 2.2.11)

+1


a source to share


1 answer


I think you need: SSLOptions +StrictRequire



+3


a source







All Articles