# Directive only for certain alias

**URL:** <https://www.ruby-forum.com/t/directive-only-for-certain-alias/211274>\
**Category:** NGINX\
**Created:** [August 31, 2011, 2:44pm UTC](https://www.ruby-forum.com/t/directive-only-for-certain-alias/211274 "2011-08-31T14:44:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [August 31, 2011, 2:44pm UTC](https://www.ruby-forum.com/t/directive-only-for-certain-alias/211274/1 "2011-08-31T14:44:17Z")

</div>

Hi guys!  
I’ve been using nginx for a while and I’m very pleased with it’s  
performance. However, I didn’t manage to setup one thing, maybe someone  
has an idea…

Before using nginx, I used apache and I had a configuration similar to  
the next one for certain alias, which I want to force client SSL  
requirement and for other areas of the site I didn’t need that. I’ve  
posted the example of apache configuration below. Is there anything  
similar for this in nginx? I need to have “ssl\_verify\_client optional;”  
in certain aliases and “ssl\_verify\_client on;” in 2 of my aliases.

Thank you for any hint you may provide!

Alias /myalias /var/www/server/alias  
\<Directory /var/www/server/alias\>  
SSLCipherSuite HIGH:MEDIUM  
SSLCACertificatePath /etc/CA/  
SSLCACertificateFile /etc/CA/cacert.pem

```
SSLVerifyClient require
SSLVerifyDepth 1

SSLOptions +StdEnvVars

AllowOverride All
Allow from All

```

Posted at Nginx Forum:

> **[Directive only for certain alias](https://forum.nginx.org/read.php?2,214566,214566#msg-214566)**
>
> Hi guys! I've been using nginx for a while and I'm very pleased with it's performance. However, I didn't manage to setup one thing, maybe someone has an idea... Before using nginx, I used apache and I had a configuration similar to the next one for...

---

<div class="post-metadata">

**Author:** ![cicovy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/49beb7/32.png) [@cicovy](https://www.ruby-forum.com/u/cicovy)\
**Post date:** [August 31, 2011, 3:04pm UTC](https://www.ruby-forum.com/t/directive-only-for-certain-alias/211274/2 "2011-08-31T15:04:05Z")

</div>

Hello!

On Wed, Aug 31, 2011 at 08:43:53AM -0400, cicovy wrote:

> in certain aliases and “ssl\_verify\_client on;” in 2 of my aliases.  
> No way, ssl\_verify\_client may only be configured at server{} level  
> in nginx (as nginx neither use nor allow renegotiation of SSL/TLS  
> connections).

Please also note that such setups (regardless of the specific  
server software used) do require renegotiation. Secure one is  
only available in products less than 2 years old, see [1].

[1] [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555)

Maxim D.

---

<div class="post-metadata">

**Author:** ![cicovy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/49beb7/32.png) [@cicovy](https://www.ruby-forum.com/u/cicovy)\
**Post date:** [August 31, 2011, 3:59pm UTC](https://www.ruby-forum.com/t/directive-only-for-certain-alias/211274/3 "2011-08-31T15:59:04Z")

</div>

I just found out that it’s not possible to add ssl\_verify\_client  
directive in a “location”. I received a suggestion from @kolbyjack on  
the nginx IRC channel which helped me with this problem. The solution  
was to deal with the $ssl\_verify\_client returning value.

if ($ssl\_client\_verify != SUCCESS) {  
return 401;  
break;  
}

Posted at Nginx Forum:

> **[Re: Directive only for certain alias](https://forum.nginx.org/read.php?2,214566,214584#msg-214584)**
>
> Hi guys! I've been using nginx for a while and I'm very pleased with it's performance. However, I didn't manage to setup one thing, maybe someone has an idea... Before using nginx, I used apache and I had a configuration similar to the next one for...

---

<div class="post-metadata">

**Author:** ![cicovy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/49beb7/32.png) [@cicovy](https://www.ruby-forum.com/u/cicovy)\
**Post date:** [August 31, 2011, 4:47pm UTC](https://www.ruby-forum.com/t/directive-only-for-certain-alias/211274/4 "2011-08-31T16:47:49Z")

</div>

Thank you so much for the confirmation wonderful nginx community!!!

Posted at Nginx Forum:

> **[Re: Directive only for certain alias](https://forum.nginx.org/read.php?2,214566,214587#msg-214587)**
>
> Hi guys! I've been using nginx for a while and I'm very pleased with it's performance. However, I didn't manage to setup one thing, maybe someone has an idea... Before using nginx, I used apache and I had a configuration similar to the next one for...

---

<div class="post-metadata">

**Author:** ![cicovy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/49beb7/32.png) [@cicovy](https://www.ruby-forum.com/u/cicovy)\
**Post date:** [August 31, 2011, 4:04pm UTC](https://www.ruby-forum.com/t/directive-only-for-certain-alias/211274/5 "2011-08-31T16:04:01Z")

</div>

On Wed, Aug 31, 2011 at 09:58:40AM -0400, cicovy wrote:

> I just found out that it’s not possible to add ssl\_verify\_client  
> directive in a “location”. I received a suggestion from @kolbyjack on  
> the nginx IRC channel which helped me with this problem. The solution  
> was to deal with the $ssl\_verify\_client returning value.
> 
> if ($ssl\_client\_verify != SUCCESS) {  
> return 401;  
> break;  
> }

Yes, you can set “ssl\_verify\_client optional” on server level and then  
test $ssl\_client\_verify inside location.  
The “break” directive is useless here.

–  
Igor S.