# Apache mTLS Reverse Proxy Configuration for bahn.services & bahn.business
# Consolidated Configuration - Separate VirtualHosts per TLD
# Generated: 2025-11-07
# Purpose: Client Certificate Authentication + Proxy to Cloudflare Workers

# Global Settings
ServerTokens Prod
ServerSignature Off
ServerAdmin cert@bahn.business

# Hostname for X-CC-Server Header
PassEnv HOSTNAME

# Enhanced Log Format with VirtualHost and mTLS Client Certificate Info
# Format: vhost:port actual_host client_ip client_cn client_serial verify_status - user time "request" status bytes "referer" "user-agent" ssl_protocol ssl_cipher
LogFormat "%v:%p %{Host}i %h %{SSL_CLIENT_S_DN_CN}x %{SSL_CLIENT_M_SERIAL}x %{SSL_CLIENT_VERIFY}x %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %{SSL_PROTOCOL}x %{SSL_CIPHER}x" mtls_vhost

# ============================================================================
# PRD (Production) Stage - .bahn.services
# ============================================================================

# ============================================================================
# PRD Stage - .bahn.services - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.bahn.services
    
    ServerAlias cert.prd.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-prd.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-prd.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/prd-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/prd-error.log
    CustomLog ${APACHE_LOG_DIR}/prd-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PRD Stage - .bahn.services - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.prd.bahn.services
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs.bahn.services
    ServerAlias cs-b.prd.bahn.services
    ServerAlias cs-bw.prd.bahn.services
    ServerAlias ccc.bahn.services
    ServerAlias ccc.prd.bahn.services
    ServerAlias ccc-b.prd.bahn.services
    ServerAlias ccc-bw.prd.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-prd.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-prd.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/prd-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/prd-error.log
    CustomLog ${APACHE_LOG_DIR}/prd-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PRD Stage - .bahn.business - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.bahn.business
    
    ServerAlias cert.prd.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to business backend
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cs-fixip.prd.bahn.business/
    ProxyPassReverse / https://cs-fixip.prd.bahn.business/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/prd-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    RequestHeader set CF-Access-Client-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set CF-Access-Client-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # mTLS Client Certificate Headers (OLD SCHEMA for cs-fixip compatibility)
    RequestHeader set X-CC "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-SDN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-IDN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-VS "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-VE "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-VR "%{SSL_CLIENT_V_REMAIN}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/prd-error.log
    CustomLog ${APACHE_LOG_DIR}/prd-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PRD Stage - .bahn.business - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.prd.bahn.business
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs.bahn.business
    ServerAlias cs-b.prd.bahn.business
    ServerAlias cs-bw.prd.bahn.business
    ServerAlias ccc.bahn.business
    ServerAlias ccc.prd.bahn.business
    ServerAlias ccc-b.prd.bahn.business
    ServerAlias ccc-bw.prd.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to business backend
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cs-fixip.prd.bahn.business/
    ProxyPassReverse / https://cs-fixip.prd.bahn.business/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/prd-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    RequestHeader set CF-Access-Client-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set CF-Access-Client-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # mTLS Client Certificate Headers (OLD SCHEMA for cs-fixip compatibility)
    RequestHeader set X-CC "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-SDN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-IDN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-VS "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-VE "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-VR "%{SSL_CLIENT_V_REMAIN}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/prd-error.log
    CustomLog ${APACHE_LOG_DIR}/prd-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# ABN Stage - .bahn.services - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.abn.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-abn.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-abn.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/abn-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/abn-error.log
    CustomLog ${APACHE_LOG_DIR}/abn-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# ABN Stage - .bahn.services - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.abn.bahn.services
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.abn.bahn.services
    ServerAlias cs-bw.abn.bahn.services
    ServerAlias ccc.abn.bahn.services
    ServerAlias ccc-b.abn.bahn.services
    ServerAlias ccc-bw.abn.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-abn.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-abn.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/abn-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/abn-error.log
    CustomLog ${APACHE_LOG_DIR}/abn-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# ABN Stage - .bahn.business - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.abn.bahn.business
    

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cs-fixip.abn.bahn.business/
    ProxyPassReverse / https://cs-fixip.abn.bahn.business/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/abn-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    RequestHeader set CF-Access-Client-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set CF-Access-Client-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # mTLS Client Certificate Headers (OLD SCHEMA for cs-fixip compatibility)
    RequestHeader set X-CC "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-SDN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-IDN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-VS "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-VE "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-VR "%{SSL_CLIENT_V_REMAIN}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/abn-error.log
    CustomLog ${APACHE_LOG_DIR}/abn-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# ABN Stage - .bahn.business - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.abn.bahn.business
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.abn.bahn.business
    ServerAlias cs-bw.abn.bahn.business
    ServerAlias ccc.abn.bahn.business
    ServerAlias ccc-b.abn.bahn.business
    ServerAlias ccc-bw.abn.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cs-fixip.abn.bahn.business/
    ProxyPassReverse / https://cs-fixip.abn.bahn.business/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/abn-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    RequestHeader set CF-Access-Client-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set CF-Access-Client-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # mTLS Client Certificate Headers (OLD SCHEMA for cs-fixip compatibility)
    RequestHeader set X-CC "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-SDN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-IDN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-VS "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-VE "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-VR "%{SSL_CLIENT_V_REMAIN}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/abn-error.log
    CustomLog ${APACHE_LOG_DIR}/abn-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# TST Stage - .bahn.services - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.tst.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-tst.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-tst.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/tst-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/tst-error.log
    CustomLog ${APACHE_LOG_DIR}/tst-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# TST Stage - .bahn.services - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.tst.bahn.services
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.tst.bahn.services
    ServerAlias cs-bw.tst.bahn.services
    ServerAlias ccc.tst.bahn.services
    ServerAlias ccc-b.tst.bahn.services
    ServerAlias ccc-bw.tst.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-tst.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-tst.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/tst-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/tst-error.log
    CustomLog ${APACHE_LOG_DIR}/tst-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# TST Stage - .bahn.business - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.tst.bahn.business
    

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cs-fixip.tst.bahn.business/
    ProxyPassReverse / https://cs-fixip.tst.bahn.business/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/tst-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    RequestHeader set CF-Access-Client-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set CF-Access-Client-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # mTLS Client Certificate Headers (OLD SCHEMA for cs-fixip compatibility)
    RequestHeader set X-CC "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-SDN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-IDN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-VS "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-VE "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-VR "%{SSL_CLIENT_V_REMAIN}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/tst-error.log
    CustomLog ${APACHE_LOG_DIR}/tst-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# TST Stage - .bahn.business - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.tst.bahn.business
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.tst.bahn.business
    ServerAlias cs-bw.tst.bahn.business
    ServerAlias ccc.tst.bahn.business
    ServerAlias ccc-b.tst.bahn.business
    ServerAlias ccc-bw.tst.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cs-fixip.tst.bahn.business/
    ProxyPassReverse / https://cs-fixip.tst.bahn.business/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/tst-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    RequestHeader set CF-Access-Client-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set CF-Access-Client-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # mTLS Client Certificate Headers (OLD SCHEMA for cs-fixip compatibility)
    RequestHeader set X-CC "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-SDN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-IDN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-VS "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-VE "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-VR "%{SSL_CLIENT_V_REMAIN}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/tst-error.log
    CustomLog ${APACHE_LOG_DIR}/tst-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# INT Stage - .bahn.services - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.int.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-int.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-int.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/int-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/int-error.log
    CustomLog ${APACHE_LOG_DIR}/int-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# INT Stage - .bahn.services - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.int.bahn.services
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.int.bahn.services
    ServerAlias cs-bw.int.bahn.services
    ServerAlias ccc.int.bahn.services
    ServerAlias ccc-b.int.bahn.services
    ServerAlias ccc-bw.int.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-int.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-int.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/int-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/int-error.log
    CustomLog ${APACHE_LOG_DIR}/int-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# INT Stage - .bahn.business - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.int.bahn.business
    

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cs-fixip.int.bahn.business/
    ProxyPassReverse / https://cs-fixip.int.bahn.business/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/int-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    RequestHeader set CF-Access-Client-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set CF-Access-Client-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # mTLS Client Certificate Headers (OLD SCHEMA for cs-fixip compatibility)
    RequestHeader set X-CC "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-SDN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-IDN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-VS "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-VE "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-VR "%{SSL_CLIENT_V_REMAIN}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/int-error.log
    CustomLog ${APACHE_LOG_DIR}/int-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# INT Stage - .bahn.business - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.int.bahn.business
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.int.bahn.business
    ServerAlias cs-bw.int.bahn.business
    ServerAlias ccc.int.bahn.business
    ServerAlias ccc-b.int.bahn.business
    ServerAlias ccc-bw.int.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cs-fixip.int.bahn.business/
    ProxyPassReverse / https://cs-fixip.int.bahn.business/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/int-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    RequestHeader set CF-Access-Client-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set CF-Access-Client-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # mTLS Client Certificate Headers (OLD SCHEMA for cs-fixip compatibility)
    RequestHeader set X-CC "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-SDN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-IDN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-VS "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-VE "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-VR "%{SSL_CLIENT_V_REMAIN}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/int-error.log
    CustomLog ${APACHE_LOG_DIR}/int-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# LUP Stage - .bahn.services - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.lup.bahn.services
    

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-lup.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-lup.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/lup-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/lup-error.log
    CustomLog ${APACHE_LOG_DIR}/lup-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# LUP Stage - .bahn.services - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.lup.bahn.services
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.lup.bahn.services
    ServerAlias cs-bw.lup.bahn.services
    ServerAlias ccc.lup.bahn.services
    ServerAlias ccc-b.lup.bahn.services
    ServerAlias ccc-bw.lup.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-lup.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-lup.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/lup-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/lup-error.log
    CustomLog ${APACHE_LOG_DIR}/lup-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# LUP Stage - .bahn.business - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.lup.bahn.business


    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-lup.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-lup.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/lup-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/lup-error.log
    CustomLog ${APACHE_LOG_DIR}/lup-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# LUP Stage - .bahn.business - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.lup.bahn.business

    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.lup.bahn.business
    ServerAlias cs-bw.lup.bahn.business
    ServerAlias ccc.lup.bahn.business
    ServerAlias ccc-b.lup.bahn.business
    ServerAlias ccc-bw.lup.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-lup.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-lup.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/lup-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/lup-error.log
    CustomLog ${APACHE_LOG_DIR}/lup-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PRES Stage - .bahn.services - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.pres.bahn.services
    

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-pres.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-pres.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/pres-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/pres-error.log
    CustomLog ${APACHE_LOG_DIR}/pres-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PRES Stage - .bahn.services - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.pres.bahn.services
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.pres.bahn.services
    ServerAlias cs-bw.pres.bahn.services
    ServerAlias ccc.pres.bahn.services
    ServerAlias ccc-b.pres.bahn.services
    ServerAlias ccc-bw.pres.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-pres.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-pres.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/pres-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/pres-error.log
    CustomLog ${APACHE_LOG_DIR}/pres-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PRES Stage - .bahn.business - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.pres.bahn.business


    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-pres.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-pres.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/pres-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/pres-error.log
    CustomLog ${APACHE_LOG_DIR}/pres-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PRES Stage - .bahn.business - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.pres.bahn.business

    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.pres.bahn.business
    ServerAlias cs-bw.pres.bahn.business
    ServerAlias ccc.pres.bahn.business
    ServerAlias ccc-b.pres.bahn.business
    ServerAlias ccc-bw.pres.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-pres.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-pres.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/pres-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/pres-error.log
    CustomLog ${APACHE_LOG_DIR}/pres-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PEN Stage - .bahn.services - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.pen.bahn.services
    

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-pen.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-pen.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/pen-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/pen-error.log
    CustomLog ${APACHE_LOG_DIR}/pen-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PEN Stage - .bahn.services - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.pen.bahn.services
    
    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.pen.bahn.services
    ServerAlias cs-bw.pen.bahn.services
    ServerAlias ccc.pen.bahn.services
    ServerAlias ccc-b.pen.bahn.services
    ServerAlias ccc-bw.pen.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-pen.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-pen.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/pen-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/pen-error.log
    CustomLog ${APACHE_LOG_DIR}/pen-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PEN Stage - .bahn.business - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.pen.bahn.business


    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-pen.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-pen.db-app.workers.dev/

    # mTLS Client Authentication (OPTIONAL for cert.* domains)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/pen-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/pen-error.log
    CustomLog ${APACHE_LOG_DIR}/pen-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# PEN Stage - .bahn.business - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.pen.bahn.business

    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.pen.bahn.business
    ServerAlias cs-bw.pen.bahn.business
    ServerAlias ccc.pen.bahn.business
    ServerAlias ccc-b.pen.bahn.business
    ServerAlias ccc-bw.pen.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-pen.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-pen.db-app.workers.dev/

    # mTLS Client Authentication
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/pen-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    # Location-specific mTLS Enforcement
    <Location />
        SSLRequireSSL
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Location>

    ErrorDocument 403 "Client certificate required"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/pen-error.log
    CustomLog ${APACHE_LOG_DIR}/pen-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# DEV Stage - .bahn.services - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.dev.bahn.services
    

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-dev.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-dev.db-app.workers.dev/

    # mTLS - Accept any client certificate (self-signed, any CA)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/dev-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/dev-error.log
    CustomLog ${APACHE_LOG_DIR}/dev-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# DEV Stage - .bahn.services - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.dev.bahn.services

    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.dev.bahn.services
    ServerAlias cs-bw.dev.bahn.services
    ServerAlias ccc.dev.bahn.services
    ServerAlias ccc-b.dev.bahn.services
    ServerAlias ccc-bw.dev.bahn.services

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-dev.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-dev.db-app.workers.dev/

    # mTLS - Require client certificate (any CA accepted)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/dev-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/dev-error.log
    CustomLog ${APACHE_LOG_DIR}/dev-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-services/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-services/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# DEV Stage - .bahn.business - cert.* domains (OPTIONAL mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName
    ServerName cert.dev.bahn.business
    

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-dev.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-dev.db-app.workers.dev/

    # mTLS - Accept any client certificate (self-signed, any CA)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/dev-ca-all.pem
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication (services credentials - same backend as services)
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/dev-error.log
    CustomLog ${APACHE_LOG_DIR}/dev-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

# ============================================================================
# DEV Stage - .bahn.business - cs.*/ccc.* domains (REQUIRED mTLS)
# ============================================================================

<VirtualHost *:443>
    # Primary ServerName (services)
    ServerName cs.dev.bahn.business

    # cs.* and ccc.* aliases (all variants)
    ServerAlias cs-b.dev.bahn.business
    ServerAlias cs-bw.dev.bahn.business
    ServerAlias ccc.dev.bahn.business
    ServerAlias ccc-b.dev.bahn.business
    ServerAlias ccc-bw.dev.bahn.business

    ServerAdmin cert@bahn.business
    DocumentRoot /var/www/html

    # SSL Proxy Configuration
    SSLProxyEngine On
    SSLProxyCheckPeerCN on
    SSLProxyCheckPeerExpire on

    # Security: Block IP-based access
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+$
    RewriteRule ^ - [F]

    # Security: Require client certificate (any CA accepted)
    RewriteCond %{SSL:SSL_CLIENT_CERT} ^$
    RewriteRule .* - [F,L]

    # Reverse Proxy to Cloudflare Worker
    ProxyRequests Off
    ProxyPreserveHost Off
    ProxyPass / https://cert-server-dev.db-app.workers.dev/
    ProxyPassReverse / https://cert-server-dev.db-app.workers.dev/

    # mTLS - Require client certificate (any CA accepted)
    SSLCACertificateFile /root/projects/cert-pki/ca-chains/dev-ca-all.pem
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +ExportCertData

    # Cloudflare Access Authentication
    # === SUBJECT INFORMATIONEN ===
    RequestHeader set X-CC-S-DN-CN "%{SSL_CLIENT_S_DN_CN}e"
    RequestHeader set X-CC-S-DN "%{SSL_CLIENT_S_DN}e"
    RequestHeader set X-CC-S-DN-O "%{SSL_CLIENT_S_DN_O}e"
    RequestHeader set X-CC-S-DN-OU "%{SSL_CLIENT_S_DN_OU}e"
    RequestHeader set X-CC-S-DN-Email "%{SSL_CLIENT_S_DN_Email}e"

    # === ISSUER INFORMATIONEN ===
    RequestHeader set X-CC-I-DN "%{SSL_CLIENT_I_DN}e"
    RequestHeader set X-CC-I-DN-CN "%{SSL_CLIENT_I_DN_CN}e"
    RequestHeader set X-CC-I-DN-O "%{SSL_CLIENT_I_DN_O}e"

    # === ZERTIFIKAT METADATEN ===
    RequestHeader set X-CC-M-Serial "%{SSL_CLIENT_M_SERIAL}e"
    RequestHeader set X-CC-M-Version "%{SSL_CLIENT_M_VERSION}e"

    # === ALGORITHMEN ===
    RequestHeader set X-CC-A-Sig "%{SSL_CLIENT_A_SIG}e"
    RequestHeader set X-CC-A-Key "%{SSL_CLIENT_A_KEY}e"

    # === GÜLTIGKEIT ===
    RequestHeader set X-CC-V-Start "%{SSL_CLIENT_V_START}e"
    RequestHeader set X-CC-V-End "%{SSL_CLIENT_V_END}e"
    RequestHeader set X-CC-V-Remain "%{SSL_CLIENT_V_REMAIN}e"

    # === VALIDIERUNG ===
    RequestHeader set X-CC-Verify "%{SSL_CLIENT_VERIFY}e"

    # === VOLLSTÄNDIGE ZERTIFIKATE (PEM) ===
    RequestHeader set X-CC-Client-Cert "%{SSL_CLIENT_CERT}e"
    RequestHeader set X-CC-CA-Cert "%{SSL_CLIENT_CERT_CHAIN_0}e"

    # === ACCESS CREDENTIALS ===
    RequestHeader set X-CC-Access-Id "34b20ecff0e95117f7a40671f663943e.access"
    RequestHeader set X-CC-Access-Secret "7ef7630a499c7ccfc68e1a5671c5c9834c7b5fe03f1494cd05992b1d65e95eaa"

    # === PHYSISCHER PROXY SERVER ===
    RequestHeader set X-CC-Server "%{HOSTNAME}e"

    LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/dev-error.log
    CustomLog ${APACHE_LOG_DIR}/dev-access.log mtls_vhost

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cert-business/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cert-business/privkey.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
</VirtualHost>

