title: Apache 2.2 SSLCADNRequestFile Option
body: <p>I'm configuring my Apache server on RHEL5 with httpd 2.2.3. Users authenticate using a smartcard with several certificates, but we want to limit the choices to browser displays to a specific one. We've figured out how to do this by using SSLCADNRequestFile set to a .pem containing the intermediate chain of that specific type of certificate.</p>
  
  <p>The problem is that we have multiple name-based virtualhosts defined on a single IP. It appears the Apache sends the response to the browser on which certificates it accepts based on the first vhost on that IP, even if the servername does not match. So unless I define SSLCADNRequestFile in the first vhost or at the server level, I cannot limit the certificate choices. Additionally, every other vhost is impacted by this setting.</p>
  
  <p>Is there a way to use a name-based vhost and define the SSLCADNRequestFile per vhost? My configuration is a little different, so there could be other issues at play, below is roughly my config. </p>
  
  <pre><code>NameVirtualHost *:443
  &lt;VirtualHost *:443&gt;
      SSLEngine on
      SSLProtocol all -SSLv2
      SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
      SSLCertificateFile /etc/pki/tls/certs/certificate.crt
      SSLCertificateKeyFile /etc/pki/tls/private/private.key
      SSLCACertificateFile /etc/pki/tls/certs/root-certs.pem
      SSLCADNRequestFile conf.d/certs-email-only.pem
      SSLVerifyClient none
      SSLVerifyDepth 2
      SSLOptions +ExportCertData
  
      DocumentRoot /var/www/mysite
      ServerName www.mysite.com
      DirectoryIndex main.html
  
      ProxyPass /api/login ajp://localhost:8009/backend/login
      ProxyPassReverse /api/login ajp://localhost:8009/backend/login
  
      Alias /login /var/www/login
      &lt;Directory /var/www/login&gt;
          DirectoryIndex login.html
      &lt;/Directory&gt;
  
      ProxyPass /logout ajp://localhost:8009/backend/logout
      ProxyPassReverse /logout ajp://localhost:8009/backend/logout
  
      &lt;Location /api&gt;
           SSLVerifyClient require
           ProxyPass ajp://localhost:8009/backend
           ProxyPassReverse ajp://localhost:8009/backend
           ProxyPassReverseCookiePath /backend /api
           ProxyPassReverseCookieDomain localhost www.mysite.com
      &lt;/Location&gt;
  &lt;/VirtualHost&gt;
  &lt;VirtualHost *:443&gt;
       # VirtualHost impacted by the SSLCADNRequestFile in the above vhost
  &lt;/VirtualHost&gt;
  </code></pre>