Q:

.htaccess "deny from all" doesn't work correctly

I`m trying to configure the .htaccess to deny downloads of a certificate file(.pfx). My website structure is:
/app
/resources
   - cert1.pfx
.htaccess
cert2.pfx

My htaccess :
<Files *.pfx>
    deny from all
</files>

In the directory explorer I don't see any of the certificate files.
But when I try to download the following:
localhost/resources/cert1.pfx
The certificate file is downloaded... If I try to download certificate located in the root folder:
localhost/cert2.pfx
It throw a 403 forbidden error.
I don't understand why one of the certificates is denied and the other one no. Any sense?
Thanks.

A:

The reason you have one cert downloaded but second not is about Files. Simple *.pfx matches only files in that directory. Documentation says the following
To address files found in a particular part of the filesystem, the <Files> and <Directory> sections can be combined. 
For example, the following configuration will deny access to 

/var/web/dir1/private.html, 
/var/web/dir1/subdir2/private.html, /var/web/dir1/subdir3/private.html, and any other instance of private.html 
found under the /var/web/dir1/ directory.

<Directory "/var/web/dir1">
    <Files "private.html">
        Require all denied
    </Files>
</Directory>

Some other hints can be found here
This setup is referring to .conf files, but in .htaccess you may use Location instead. Some more explanation.
Also, I strongly recommend to use "Require" instead of outdated "Allow/Deny".

