# Add a separate virtual host to work around SSL re-negotiation
# issues in Apache 2, for certificate authentication.
Listen 9443
<VirtualHost _default_:9443>
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile /usr/local/apache2/conf/ssl.crt/idp.mit.edu-cert.pem
    SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/idp.mit.edu-key.pem
    SSLCertificateChainFile /usr/local/apache2/conf/ssl.crt/mitCA.pem
    SSLCACertificateFile /usr/local/apache2/conf/ssl.crt/mitCAclient.pem
    ScriptAlias /login-cert "webkdc/login.fcgi"
    Alias /images "webkdc/images/"
    Alias /styles "webkdc/styles/"
    Alias /help.html "webkdc/help.html"
    Alias /spnego-help.html "webkdc/spnego-help.html"
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLUserName SSL_CLIENT_S_DN_Email
    ScriptAlias /login-simple "webkdc/login.fcgi"
    ErrorDocument 401 /login-simple
    <Location "/login-simple">
        SSLVerifyClient none
    </Location>

    ScriptAlias /auth-options "webkdc/auth-options.fcgi"
    ScriptAlias /test-failed "webkdc/auth-options.fcgi"
    ScriptAlias /test-cert "webkdc/auth-options.fcgi"
    <Location "/test-cert">
        ErrorDocument 401 /test-failed
    </Location>
</VirtualHost>
