Apache 2.4: Require client certificate only for non-GET methods

You can use mod_ssl with basic auth to allow only who have presented a valid certificate. You need to modify the LimitExcept part like this:

<LimitExcept GET>
    AuthType Basic
    AuthName "no-GET thingy"
    Require ssl-verify-client
</LimitExcept>

You can use any number and combination of Require statements, so if you want to check the certificate properties as well, you can do something like this:

<LimitExcept GET>
    AuthType Basic
    AuthName "no-GET thingy"
    <RequireAll>
        Require ssl-verify-client
        Require expr "'${SSL_CLIENT_S_DN_O}' == 'org'"
        Require expr "'${SSL_CLIENT_S_DN_OUT}' == 'theOU'"
        Require expr "'${SSL_CLIENT_S_DN_CN}' != 'notThisUser'"
    </RequireAll>
</LimitExcept>