Change Status Code in Apache httpd when certificate auth fails - apache

Question

I'm trying to figure out how to return a different status response code when certificate authentication fails (i.e. no certificate, invalid or revoked, etc.). If the certificate is good, I already have everything working as it should.
What I want is to return a 410 Gone code, to make it look like the domain doesn't even exist, instead of Apache's mod_ssl normal response of "handshake_error" or "revoked_certificate", etc.
I tried using mod_rewrite but since mod_ssl handles this directly, it seems that the rewrite doesn't get used.
Here's what I tried.
<VirtualHost *:443>
SSLEngine on
SSLCertificateFile /path/to/cert.pem
SSLVerifyClient require
SSLVerifyDepth 1
RewriteEngine On
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !=SUCCESS
RewriteRule .* - [R=410,L]
# ... other virtual host configuration ...
</VirtualHost>

Answer 1

My expectation is: as you configure
SSLVerifyClient require
you are mandating that there is a valid client certificate. Without it, no connection will be established, that could transport a proper http status code. As there is no connection, you can't expect mod_rewrite to do anything.
A way to achieve what you want would be to allow connections without client cert and handle behavior in application code. There might be other options.
I'd not use too much time on obfuscating the error condition though. It makes debugging harder and any attacker can see that there is a dns entry and where it points to.