Standard textbook cookie ow to solve particular security constraints for an SSL-aware webserver is not always obvious because of the coherences between SSL, HTTP and Apache's way of processing requests. This chapter gives instructions on how to solve such typical situations. Treat is as a first step to find out the final solution, but always try to understand the stuff before you use it.
Nothing is worse than using a security solution without knowing it's restrictions and coherences.
The browser connects with an export cipher, the server sends it's Global ID certificate, the browser verifies it and subsequently upgrades the cipher suite before any HTTP communication takes place. Obviously you cannot just use a server-wide SSLCipherSuite which restricts the ciphers to the strong variants. All you have to do is to create client certificates signed by your own CA certificate ca.crt and then verifiy the clients against this certificate. The key is to check for various ingredients of the client certficate. In this case you've to establish a password database containing all clients.