The apache config as it ships in unfold.conf defines a port (currently 443) where SSL client-auth is enforced The idea being to have the browser prompting our user for a certificate - instead of leaving that optional, which we believe is something nobody will ever use if it's optional. A few notes and caveats must be outlined though below; see also unfold-init-ssl.sh about that * as of this writing quite a lot of what is below would be taken care of by the packaging stuff once/if it works; the notes below are intended to help in this respect. * all the local material for this deployment gets into /etc/unfold/ * I could not find a way to have client-auth without server auth; this is totally weird, and stupid, but just so so there is a need to install a (probably self-signed) cert and related key in /etc/unfold/myslice.cert /etc/unfold/myslice.key see init-ssl.sh for how to create these * Now the trusted roots - that we do need in our case - are expected in /etc/unfold/trusted_roots this of course is a user choice, e.g.: /etc/unfold/trusted_roots/plc.gid /etc/unfold/trusted_roots/ple.gid