Add instructions on configuring mod_auth_sslcert and mod_authz_afsgroup on Ubuntu.

diff --git a/doc/apache-client-certs.mdwn b/doc/apache-client-certs.mdwn
new file mode 100644 (file)
index 0000000..c550cf7
--- /dev/null
+++ b/doc/apache-client-certs.mdwn
@@ -0,0 +1,34 @@
+[[!meta title="Configuring Client-Side Certificate Authentication on Apache"]]
+
+While it's certainly possible to configure client-side certificate authentication on Apache using the built-in SSL module alone, it's much easier if you use the Apache modules developed for the [scripts.mit.edu](http://scripts.mit.edu) project.
+
+## Installing the modules
+
+If you're using Ubuntu, [Evan Broder](http://ebroder.net) has packaged the scripts.mit.edu modules for all current Ubuntu releases in a PPA: https://launchpad.net/~broder/+archive/scripts-http-mods.
+
+The PPA homepage includes instructions on how to install the PPA on your system.
+
+    # add-apt-repository ppa:broder/scripts-http-mods
+
+Once you've installed the PPA, you want to install the libapache2-mod-auth-sslcert and libapache2-mod-authz-afsgroup packages.
+
+    # aptitude install libapache2-mod-auth-sslcert libapache2-mod-authz-afsgroup
+
+You'll also need a working AFS client and the Athena client certificate CA. Both of these can be most easily configured by [installing Debathena](http://debathena.mit.edu/install). You can install any Debathena flavor you'd like, but `debathena-standard` flavor should include everything you need.
+
+## Configuring Apache
+
+In addition to the standard Apache directives needed to enable SSL, you'll need a few more before the Apache modules work as they do on scripts. Add the following directives to each vhost that will be using SSL client-side certificate authentication:
+
+    SSLVerifyClient require
+    <Location />
+        AuthSSLCertVar SSL_CLIENT_S_DN_Email
+        AuthSSLCertStripSuffix "@MIT.EDU"
+    </Location>
+
+You'll also need to enable the Apache modules.
+
+    # a2enmod auth_sslcert
+    # a2enmod authz_afsgroup
+
+Once you've done that, the instructions in the [scripts.mit.edu FAQ](http://scripts.mit.edu/faq/15) on configuring certificate access through `.htaccess` files should work.