Apache Ignores SSLRequire Directive

Question

I have setup Apache to serve Subversion data. The configuration looks like this,

<Location /svn>
 DAV svn
 SVNPath /path/to/svn
 AuthType Basic
 AuthName "My Project"
 AuthUserFile /etc/httpd/dav_svn.passwd
 Require valid-user
 SSLRequireSSL
 <LimitExcept GET PROPFIND OPTIONS REPORT>
   Require valid-user
 </LimitExcept>
</Location>

This works as expected.

However, I want to relax the SSL requirement,so that connections from localhost don't require it. I replaced the SSLRequireSSL directive with a SSLRequire directive.

But Apache seems to be completely ignoring the SSLRequire directive.

Both,

SSLRequire true

and

SSLRequire false

result in the same behaviour! They both allow non-SSL connections.

What am I missing?

(Apache version : 2.2.11)

Answer 1

I think you need: SSLOptions +StrictRequire