apache as a x509 proxy

gistfile1.txt

<VirtualHost>
        ServerName apache.example.com

[...]

        ProxyPass /gitblit ajp://infra.example.com:8009/gitblit
        # ProxyPassReverse is not required, because the apache context /gitblit is the same as the tomcat one

        <Location /gitblit>
                SSLVerifyClient require
                SSLVerifyDepth 1
                SSLRequireSSL

                # only our own certificates are accepted
                SSLRequire      %{SSL_CLIENT_S_DN_O}  eq "The verbose name of the issuer of your certificates"

                SSLOptions +StdEnvVars +OptRenegotiate

                # what attribute from the certificate shall be used as the "remote username"
                # for possible values, see http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslrequire
                SSLUserName SSL_CLIENT_S_DN_Email
        </Location>
</VirtualHost>