Plesk Implement client SSL certificates for authentication - apache

Question

I need to configure Plesk Apache
Where users will authenticate with a .pfx digital certificate
find text within files
Server Error
403
Forbidden
You do not have permission to access this document.
I use Plesk
I just want the /login/ folder
Request client certificate
https://site.plesk.page/login/
I couldn't get it to work.
Configuration file:
/var/www/vhosts/system/site.plesk.page/conf/httpd.conf
<IfModule mod_ssl.c>
<VirtualHost 177.234.155.186:7081 >
ServerName "site.plesk.page"
ServerAlias "www.site.plesk.page"
ServerAlias "ipv4.site.plesk.page"
UseCanonicalName Off
CustomLog /var/www/vhosts/system/site.plesk.page/logs/access_ssl_log plesklog
ErrorLog "/var/www/vhosts/system/site.plesk.page/logs/error_log"
DocumentRoot "/var/www/vhosts/site.plesk.page/httpdocs"
<IfModule mod_suexec.c>
SuexecUserGroup "cert_a1a3" "psacln"
</IfModule>
<IfModule mod_userdir.c>
UserDir "/var/www/vhosts/site.plesk.page/web_users/*"
</IfModule>
<IfModule mod_sysenv.c>
SetSysEnv PP_VHOST_ID "446fa1b6-1832-4b2b-ae5d-aab42b94bd29"
</IfModule>
Alias "/plesk-stat" "/var/www/vhosts/system/site.plesk.page/statistics"
<Location /plesk-stat/>
Options +Indexes
</Location>
<Location /plesk-stat/logs/>
Require valid-user
</Location>
Alias /webstat /var/www/vhosts/system/site.plesk.page/statistics/webstat
Alias /webstat-ssl /var/www/vhosts/system/site.plesk.page/statistics/webstat-ssl
Alias /ftpstat /var/www/vhosts/system/site.plesk.page/statistics/ftpstat
Alias /anon_ftpstat /var/www/vhosts/system/site.plesk.page/statistics/anon_ftpstat
Alias /awstats-icon /usr/share/awstats/wwwroot/icon
SSLEngine on
SSLProtocol -all +TLSv1.2
SSLHonorCipherOrder On
SSLVerifyClient none
SSLCertificateFile /usr/local/psa/var/certificates/scf6sEW8u
SSLCACertificateFile /usr/local/psa/var/certificates/ca-bundle.crt
SSLCACertificatePath /usr/local/psa/var/certificates/
SSLSessionCacheTimeout 1
<Directory /var/www/vhosts/site.plesk.page/httpdocs>
<IfModule mod_fcgid.c>
<Files ~ (\.fcgi$)>
SetHandler fcgid-script
Options +ExecCGI
</Files>
</IfModule>
<IfModule mod_proxy_fcgi.c>
<Files ~ (\.php$)>
SetHandler proxy:unix:/var/www/vhosts/system/site.plesk.page/php-fpm.sock|fcgi://127.0.0.1:9000
</Files>
</IfModule>
SSLRequireSSL
Options -Includes -ExecCGI
</Directory>
<Location /login/>
SSLRequireSSL
ServerSignature On
SSLUserName SSL_CLIENT_S_DN_CN
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
SSLOptions +StdEnvVars +ExportCertData
SSLVerifyClient require
SSLVerifyDepth 1
Options +ExecCGI -Indexes -MultiViews
AddHandler cgi-script .cgi .pl .php
SetHandler login
AllowOverride All
Order allow,deny
Allow from all
</Location>
<Directory "/var/www/vhosts/system/site.plesk.page/statistics">
AuthType Basic
AuthName "Domain statistics"
AuthUserFile "/var/www/vhosts/system/site.plesk.page/pd/d..httpdocs#plesk-stat"
require valid-user
</Directory>
Alias /error_docs /var/www/vhosts/site.plesk.page/error_docs
ErrorDocument 400 /error_docs/bad_request.html
ErrorDocument 401 /error_docs/unauthorized.html
ErrorDocument 403 /error_docs/forbidden.html
ErrorDocument 404 /error_docs/not_found.html
ErrorDocument 500 /error_docs/internal_server_error.html
ErrorDocument 405 /error_docs/method_not_allowed.html
ErrorDocument 406 /error_docs/not_acceptable.html
ErrorDocument 407 /error_docs/proxy_authentication_required.html
ErrorDocument 412 /error_docs/precondition_failed.html
ErrorDocument 414 /error_docs/request_uri_too_long.html
ErrorDocument 415 /error_docs/unsupported_media_type.html
ErrorDocument 501 /error_docs/not_implemented.html
ErrorDocument 502 /error_docs/bad_gateway.html
ErrorDocument 503 /error_docs/maintenance.html
DirectoryIndex "index.html" "index.cgi" "index.pl" "index.php" "index.xhtml" "index.htm" "index.shtml"
Include "/var/www/vhosts/system/site.plesk.page/conf/vhost_ssl.conf"
<Directory /var/www/vhosts/site.plesk.page>
Options -FollowSymLinks
AllowOverride AuthConfig FileInfo Indexes Limit Options=Indexes,SymLinksIfOwnerMatch,MultiViews,ExecCGI,Includes,IncludesNOEXEC
</Directory>
#extension sslit begin
#extension sslit end
#extension letsencrypt begin
Alias /.well-known/acme-challenge "/var/www/vhosts/default/htdocs/.well-known/acme-challenge"
<Location /.well-known/acme-challenge/>
# Require all granted
Order Deny,Allow
Allow from all
Satisfy any
</Location>
<LocationMatch "^/.well-known/acme-challenge/(.*/|)\.">
# Require all denied
Order Allow,Deny
Deny from all
</LocationMatch>
#extension letsencrypt end
</VirtualHost>