This module implements a Signed Public Key and Challenge endpoint that is capable of signing and issuing certificates on behalf of a suitable client.

Based on configuration, parameters can be passed from optional form parameters, or explicit expressions, and a new certificate sign request with acceptable parameters is combined with the public key and the challenge from the SPKAC parameter and passed to suitably configured backend modules for request authorisation, certificate signing and issuing, and certificate storage.

This module can be configured to respond to SPKAC client requests as implemented by conformant implementations of HTML5.2 and earlier.

This optional hook allows you to verify the parameters included with the certificate sign request, such as the challenge password. If left unconfigured, all certificate requests will be accepted.

This hooks signs the certificate sign request and returns the issued certificate. The hook is mandatory, and the request will be rejected if left unconfigured.

This optional hook allows the newly generated certificate to be stored locally or in a database or directory. If left unconfigured, no local copy of the certificate will be stored.

The simplest case: issue a certificate to anybody who wants one.

                  
# backend configuration:
<IfModule mod_ca_simple.c>
  # sign with this certificate...
  CASimpleCertificate /etc/pki/tls/ca-cert.pem
  # ...and private key
  CASimpleKey /etc/pki/tls/ca-key.pem
  # use system clock as the time source
  CASimpleTime on
  # assign a random serial number
  CASimpleSerialRandom on
</IfModule>

# frontend configuration:
<IfModule mod_spkac.c>
  <Location /spkac>
    SetHandler spkac
    # use subject from the certificate sign request unmodified
    SpkacSubjectRequest *
  </Location>
</IfModule>

                

A more typical scenario: issue a certificate to a logged in user.

In this example it is assumed that Apache configuration exists that authenticates a user against a database, directory, a token, or a previous certificate.

                  
# backend configuration:
<IfModule mod_ca_simple.c>
  # sign with this certificate...
  CASimpleCertificate /etc/pki/tls/ca-cert.pem
  # ...and private key
  CASimpleKey /etc/pki/tls/ca-key.pem
  # use system clock as the time source
  CASimpleTime on
  # assign a random serial number
  CASimpleSerialRandom on
</IfModule>

# frontend configuration:
<IfModule mod_spkac.c>
  <Location /spkac>
    SetHandler spkac
    # standard Apache authorisation
    Require valid-user
    # set the common name to the logged in username
    SpkacSubjectSet CN %{REMOTE_USER}
    # set a fixed OU field in the subject
    SpkacSubjectSet OU "Terms and Conditions Apply"
  </Location>
</IfModule>

                

After calling the request authorization hook, the sign request hook, and the certificate storage hook, return the DER encoded certificate.

SetHandler spkac

Set the URL location of the WADL returned by the OPTIONS method.

Set to the maximum size of the SPKAC request from the client. This value cannot be smaller than 4096 bytes.

Set to the name of the form parameter containing the SPKAC request from the client.

Specify fields in the form that will be copied over to the subject alternative name of the certificate, with optional limit to the number of fields that may appear.

Fields in the form are expected to be prefixed with the string subjectAltName- which will stripped before comparing to names set by this directive.

Field names are limited to otherName, rfc822Name, dNSName, x400Address, directoryName, ediPartyName, uniformResourceIdentifier, iPAddress, or registeredID and are described in the Subjects and Subject Alternative Names section.

Specify an expression that will be included in the certificate subject alternative name.

Field names are limited to otherName, rfc822Name, dNSName, x400Address, directoryName, ediPartyName, uniformResourceIdentifier, iPAddress, or registeredID and are described in the Subjects and Subject Alternative Names section.

Specify fields in the form that will be copied over to the certificate subject, with optional limit to the number of fields that may appear.

Subject handling is covered in detail in the Subjects and Subject Alternative Names section.

Specify an expression that will be included in the certificate subject. Subject attribute name is configured first, then the expression.

Subject handling is covered in detail in the Subjects and Subject Alternative Names section.