(no commit message)

[wiki.git] / doc / apache-client-certs.mdwn

diff --git a/doc/apache-client-certs.mdwn b/doc/apache-client-certs.mdwn
index d4a064279ef4e8e55802900b0c675cebe6abd59c..fd77e8d94ba12bac0b01a3808fa2401b8839d82c 100644 (file)
--- a/doc/apache-client-certs.mdwn
+++ b/doc/apache-client-certs.mdwn
@@ -8,7 +8,7 @@ If you're using Ubuntu, Evan Broder has packaged the scripts.mit.edu modules for
 
 The [PPA homepage](https://launchpad.net/~broder/+archive/scripts-http-mods) includes instructions on how to install the PPA on your system, but if you're on Ubuntu Karmic or later, you can just run:
 
 
 The [PPA homepage](https://launchpad.net/~broder/+archive/scripts-http-mods) includes instructions on how to install the PPA on your system, but if you're on Ubuntu Karmic or later, you can just run:
 

-    # add-apt-repository ppa:broder/scripts-http-mods
+    # add-apt-repository ppa:broder/scripts-http-mods ; apt-get update

 
 Once you've installed the PPA, you want to install the libapache2-mod-auth-sslcert and libapache2-mod-authz-afsgroup packages.
 
 
 Once you've installed the PPA, you want to install the libapache2-mod-auth-sslcert and libapache2-mod-authz-afsgroup packages.
 


@@ -26,7 +26,7 @@ In addition to the standard Apache directives needed to enable SSL, you'll need
         AuthSSLCertStripSuffix "@MIT.EDU"
     </Location>
 
         AuthSSLCertStripSuffix "@MIT.EDU"
     </Location>
 

-You also need to require certificate authentication. You can either use `SSLVerifyClient required` or `SSLVerifyClient optional`. `SSLVerifyClient required` has the downside that, if visitors don't have client-side certificates, they'll get an obscure OpenSSL error. However, Safari will not present certificates to a site with `SSLVerifyClient optional` set unless the user sets up an Identity Preference. For reference, scripts.mit.edu sets `SSLVerifyClient optional`.
+You also need to require certificate authentication. You can either use `SSLVerifyClient require` or `SSLVerifyClient optional`. `SSLVerifyClient require` has the downside that, if visitors don't have client-side certificates, they'll get an obscure OpenSSL error. However, Safari will not present certificates to a site with `SSLVerifyClient optional` set unless the user sets up an Identity Preference. For reference, scripts.mit.edu sets `SSLVerifyClient optional`.

 
 You'll also need to enable the Apache modules.
 
 
 You'll also need to enable the Apache modules.