It turns out that "require group" does work with FakeBasicAuth after all. You just need to enclose the client cert's "one-line" username in quotes. I guess it is kind of finicky when it is parsing the username. Leon Poon PS: Thanks for pointing out the other security tips