#NSS_SSL_ENABLE_RENEGOTIATION 1

ProxyRequests Off

# matches for ee port
<LocationMatch "^/ca/ee/*|^/ca/renewal|^/ca/certbasedenrollment|^/ca/ocsp|^/ca/enrollment|^/ca/profileSubmit|^/ca/cgi-bin/pkiclient.exe">
    NSSVerifyClient none
    ProxyPassMatch ajp://127.0.0.1:8009/
    ProxyPassReverse ajp://127.0.0.1:8009/
</LocationMatch>

# matches for admin port 
<LocationMatch "^/ca/admin/*|^/ca/auths|^/ca/acl|^/ca/server|^/ca/caadmin|^/ca/caprofile|^/ca/jobsScheduler|^/ca/capublisher|^/ca/log|^/ca/ug">
    NSSVerifyClient none
    ProxyPassMatch ajp://127.0.0.1:8009/
    ProxyPassReverse ajp://127.0.0.1:8009/
</LocationMatch>

# matches for agent port and eeca port
<LocationMatch "^/ca/agent/*|^/ca/ca/getCertFromRequest|^/ca/ca/GetBySerial|^/ca/ca/connector|/ca/ca/displayCertFromRequest|^/ca/doRevoke|^/ca/eeca/*">
    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
    NSSVerifyClient require
    ProxyPassMatch ajp://127.0.0.1:8009/
    ProxyPassReverse ajp://127.0.0.1:8009/
</LocationMatch>

# static content
<LocationMatch "^/graphics/*">
    NSSVerifyClient none
    ProxyPassMatch ajp://127.0.0.1:8009/
    ProxyPassReverse ajp://127.0.0.1:8009/
</LocationMatch>