Subject: Rewrite and SSLRequire

From: "Bray, Mike" <[email-masked]>
Date: Thu, 14 Mar 2002 13:40:03 -0000

I am trying to force 128 bit encryption and send back a friendly page if the
test fails.  I have implemented the use of SSLRequire testing the key size.
This works fine if you reference an html file.  Putting
https://localhost/index.html from an export level browser forces a 403
error.  I have an ErrorDocument 403 specified.  The problem comes with .jsp
files.  We are using the Oracle OC4J (Orion) Java containers and have a
Rewrite rule for .jsp and servlets, i.e:

RewriteRule       (^/servlet/.*$)	http://localhost:8888$1 [P]
RewriteRule	(^.*jsp.*$)	http://localhost:8888$1 [P]
RewriteRule	(^.*jsp[?\/].*$)	http://localhost:8888$1 [P] 

If you reference https://localhost/index.jsp from a export level Netscape
Navigator the 403 error page is displayed.  If you do the same from an
export level Microsoft IE the .jsp page is displayed without the images.  

On further investigation I have found that the Rewrite rule is being used
before the SSLRequire and therefore sends the request to OC4J.  I have tried
to put the RewriteRule in the same <Directory statement as the SSLRequire
and added Options FollowSymLinks as specified but the RewriteRule is
ignored.

Does anyone know of a way around this?

Any help appreciated.

Regards
mike Bray
Siemens Business Services
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]