SSLRequire file expression - apache

Question

I have an issue with SSLRequire file expression in Apache 2.4 in that it doesn't seem to be finding or be able to access the file in question.
Here's the code excerpt:
<Location />
SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire (%{SSL_CLIENT_CERT} eq file("<full_path_to_PEM_file>"))
</Location>
And when I try to access the site, I get this error in logs:
[Tue Jun 27 13:20:02.358478 2017] [ssl:error] [pid 18661:tid 47040594310912] [client 82.69.3.205:58275] Evaluation of expression from 20-mod_ssl.conf:240 failed: Cannot open file <full_path_to_PEM_file>, referer: https://example.com/
The permissions are correct and the file definitely exists, so I am not sure what else to do here.
The PEM file is a valid public certificate with "BEGIN CERTIFICATE" and "END CERTIFICATE" lines at start and end...
Any ideas?

Answer 1

Your VHost should look like:
<VirtualHost *:443>
ServerAdmin webmaster#example.com
DocumentRoot /var/www/html/example
ServerName example.com
SSLEngine on
SSLCertificateFile /etc/ssl/CA/example_com.crt
SSLCertificateKeyFile /etc/ssl/CA/example.key
# https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=1203&nav=0,96,1,95
SSLCertificateChainFile /etc/ssl/CA/chain_example_with_Positive.pem
SSLHonorCipherOrder On
SSLProtocol -all +TLSv1 +SSLv3
SSLCipherSuite RC4-SHA:HIGH:!MD5:!aNULL:!EDH:!ADH
SSLInsecureRenegotiation off
<Directory /example/>
Options Indexes SymLinksIfOwnerMatch
AllowOverride All
Require all granted
</Directory>
<Directory /var/www/html/example/>
Options Indexes SymLinksIfOwnerMatch
AllowOverride All
Order allow,deny
allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
</VirtualHost>