svn commit: r1936863 - in httpd/httpd/trunk: docs/manual/mod modules/ssl

Author: minfrin
Date: Tue Aug  4 12:09:50 2026
New Revision: 1936863

Log:
Add declaration and docs for SSLCADNRequestURI directive.

Modified:
   httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
   httpd/httpd/trunk/modules/ssl/mod_ssl.c

Modified: httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml	Tue Aug  4 11:29:05 2026	(r1936862)
+++ httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml	Tue Aug  4 12:09:50 2026	(r1936863)
@@ -1366,22 +1366,25 @@ in the SSL handshake.  These CA names ca
 select an appropriate client certificate out of those it has
 available.</p>
 
-<p>If neither of the directives <directive
-module="mod_ssl">SSLCADNRequestPath</directive> or <directive
-module="mod_ssl">SSLCADNRequestFile</directive> are given, then the
+<p>If none of the directives <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, <directive
+module="mod_ssl">SSLCADNRequestPath</directive>, or <directive
+module="mod_ssl">SSLCADNRequestURI</directive> are given, then the
 set of acceptable CA names sent to the client is the names of all the
 CA certificates given by the <directive
-module="mod_ssl">SSLCACertificateFile</directive> and <directive
-module="mod_ssl">SSLCACertificatePath</directive> directives; in other
+module="mod_ssl">SSLCACertificateFile</directive>, <directive
+module="mod_ssl">SSLCACertificatePath</directive>, and <directive
+module="mod_ssl">SSLCACertificateURI</directive> directives; in other
 words, the names of the CAs which will actually be used to verify the
 client certificate.</p>
 
 <p>In some circumstances, it is useful to be able to send a set of
 acceptable CA names which differs from the actual CAs used to verify
 the client certificate - for example, if the client certificates are
-signed by intermediate CAs.  In such cases, <directive
-module="mod_ssl">SSLCADNRequestPath</directive> and/or <directive
-module="mod_ssl">SSLCADNRequestFile</directive> can be used; the
+signed by intermediate CAs. In such cases, <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, <directive
+module="mod_ssl">SSLCADNRequestPath</directive>, and/or <directive
+module="mod_ssl">SSLCADNRequestURI</directive> can be used; the
 acceptable CA names are then taken from the complete set of
 certificates in the directory and/or file specified by this pair of
 directives.</p>
@@ -1440,6 +1443,70 @@ to take effect.</p>
 </directivesynopsis>
 
 <directivesynopsis>
+<name>SSLCADNRequestURI</name>
+<description>certificate store of CA Certificates for defining
+acceptable CA names</description>
+<syntax>SSLCADNRequestURI <var>uri</var></syntax>
+<contextlist><context>server config</context>
+<context>virtual host</context></contextlist>
+
+<usage>
+<p>When a client certificate is requested by mod_ssl, a list of
+<em>acceptable Certificate Authority names</em> is sent to the client
+in the SSL handshake.  These CA names can be used by the client to
+select an appropriate client certificate out of those it has
+available.</p>
+
+<p>If none of the directives <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, <directive
+module="mod_ssl">SSLCADNRequestPath</directive>, or <directive
+module="mod_ssl">SSLCADNRequestURI</directive> are given, then the
+set of acceptable CA names sent to the client is the names of all the
+CA certificates given by the <directive
+module="mod_ssl">SSLCACertificateFile</directive>, <directive
+module="mod_ssl">SSLCACertificatePath</directive>, and <directive
+module="mod_ssl">SSLCACertificateURI</directive> directives; in other
+words, the names of the CAs which will actually be used to verify the
+client certificate.</p>
+
+<p>In some circumstances, it is useful to be able to send a set of
+acceptable CA names which differs from the actual CAs used to verify
+the client certificate - for example, if the client certificates are
+signed by intermediate CAs. In such cases, <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, <directive
+module="mod_ssl">SSLCADNRequestPath</directive>, and/or <directive
+module="mod_ssl">SSLCADNRequestURI</directive> can be used; the
+acceptable CA names are then taken from the complete set of
+certificates in the directory and/or file specified by this pair of
+directives.</p>
+
+<p><directive module="mod_ssl">SSLCADNRequestURI</directive> must
+specify an <em>all-in-one</em> certificate store uri containing a
+set of CA certificates.</p>
+
+<example><title>Example</title>
+<highlight language="config">
+SSLCADNRequestURI "file:///usr/local/apache2/conf/ca-names.crt"
+</highlight>
+</example>
+
+<p>A <var>file:</var> URI pointing at a file of PEM encoded certificates
+can be used instead of <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, and a <var>file:</var>
+URI pointing at a directory of PEM encoded certificates can be used
+instead of <directive
+module="mod_ssl">SSLCADNRequestPath</directive>.
+</p>
+
+<p>This store is read at server startup, while the server is still running
+as <code>root</code> (before privilege dropping), so it may be owned by
+and readable only by <code>root</code>. The uri is not re-read during
+normal operation; a server restart is required for changes to take
+effect.</p>
+</usage>
+</directivesynopsis>
+
+<directivesynopsis>
 <name>SSLCARevocationPath</name>
 <description>Directory of PEM-encoded CA CRLs for
 Client Auth</description>
@@ -1525,6 +1592,14 @@ SSLCARevocationURI "/usr/local/apache2/c
 </highlight>
 </example>
 
+<p>A <var>file:</var> URI pointing at a file of PEM encoded CRLs
+can be used instead of <directive
+module="mod_ssl">SSLCARevocationFile</directive>, and a <var>file:</var>
+URI pointing at a directory of PEM encoded CRLs can be used
+instead of <directive
+module="mod_ssl">SSLCARevocationPath</directive>.
+</p>
+
 <p>This URI is read at server startup, while the server is still running
 as <code>root</code> (before privilege dropping), so it may be owned by
 and readable only by <code>root</code>. The URI is not re-read during

Modified: httpd/httpd/trunk/modules/ssl/mod_ssl.c
==============================================================================
--- httpd/httpd/trunk/modules/ssl/mod_ssl.c	Tue Aug  4 11:29:05 2026	(r1936862)
+++ httpd/httpd/trunk/modules/ssl/mod_ssl.c	Tue Aug  4 12:09:50 2026	(r1936863)
@@ -147,6 +147,9 @@ static const command_rec ssl_config_cmds
     SSL_CMD_SRV(CADNRequestFile, TAKE1,
                 "SSL CA Distinguished Name file "
                 "('/path/to/file' - PEM encoded to derive acceptable CA names to request)")
+    SSL_CMD_SRV(CADNRequestURI, TAKE1,
+                "SSL CA Distinguished Name uri "
+                "('file:', 'pkcs11:' - URI of certificates to derive acceptable CA names to request)")
     SSL_CMD_SRV(CARevocationURI, TAKE1,
                 "SSL CA Certificate Revocation List (CRL) uri "
                 "('file:', 'pkcs11:' - URI of CRLs)")