Which of the following configuration options makes Apache HTTPD require a client certificate for authentication?

Question

Options

• ALimit valid-x509
• BSSLRequestClientCert always
• CRequire valid-x509
• DSSLVerifyClient require
• ESSLPolicy valid-client-cert

• B
  3% (2)
• C
  2% (1)
• D
  94% (62)
• E
  2% (1)

Explanation

SSLVerifyClient require (option D) is the correct Apache HTTPD directive that forces the server to request and validate a client certificate before allowing access - without it, client certificate authentication is simply not enforced. This is a core mod_ssl directive with four levels: none, optional, require, and optional_no_ca.

Why the distractors are wrong:

• A (Limit valid-x509) - Limit is an Apache access control block for restricting HTTP methods, not an SSL directive; valid-x509 is not a valid argument for it.
• B (SSLRequestClientCert always) - This directive does not exist in Apache HTTPD; it's fabricated.
• C (Require valid-x509) - Require is a real directive used with mod_authz_core, but valid-x509 is not a valid provider for it (valid ones include user, group, ip, etc.).
• E (SSLPolicy valid-client-cert) - SSLPolicy is not a standard Apache directive; it doesn't exist in mod_ssl.

Memory tip: Think "SSL + Verify + Client = require a cert" - the directive reads almost like plain English: SSL, verify the client, and require it. If you can picture a bouncer saying "SSL? Verify the client. Require it." - you'll never forget SSLVerifyClient require.

No community discussion yet for this question.