Author: minfrin
Date: Thu Aug 6 11:01:29 2026
New Revision: 1936908
Log:
mod_ssl: Rename URI directives to follow the pattern SSLStoreURI
and SSLTrustURI. Move CRL functionality from a dedicated directive
into SSLTrustURI.
Modified:
httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
httpd/httpd/trunk/modules/ssl/mod_ssl.c
httpd/httpd/trunk/modules/ssl/ssl_engine_config.c
httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
httpd/httpd/trunk/modules/ssl/ssl_private.h
Modified: httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml Thu Aug 6 08:30:29 2026 (r1936907)
+++ httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml Thu Aug 6 11:01:29 2026 (r1936908)
@@ -1168,9 +1168,9 @@ effect.</p>
</directivesynopsis>
<directivesynopsis>
-<name>SSLCertificateURI</name>
+<name>SSLStoreURI</name>
<description>Server certificate and key store</description>
-<syntax>SSLCertificateURI <var>uri</var></syntax>
+<syntax>SSLStoreURI <var>uri</var></syntax>
<contextlist><context>server config</context>
<context>virtual host</context></contextlist>
<compatibility>Available in httpd 2.5.1 and later, when linked with
@@ -1224,11 +1224,11 @@ at startup time.</p>
<example><title>Example</title>
<highlight language="config">
# Example using a PEM-encoded file.
-SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.crt"
+SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.crt"
# Example using a PKCS12 file.
-SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.p12"
+SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.p12"
# Example use of a certificate and private key from a PKCS#11 token:
-SSLCertificateURI "pkcs11:token=My%20Token%20Name;id=45"
+SSLStoreURI "pkcs11:token=My%20Token%20Name;id=45"
</highlight>
</example>
@@ -1238,12 +1238,12 @@ and readable only by <code>root</code>.
normal operation; a server restart is required for changes to take
effect.</p>
-<note type="warning"><title>Using SSLCertificateFile and SSLCertificateURI
+<note type="warning"><title>Using SSLCertificateFile and SSLStoreURI
together</title>
<p>
-You can use both SSLCertificateFile and SSLCertificateURI together, however
+You can use both SSLCertificateFile and SSLStoreURI together, however
there is no overlap between the mechanisms. A certificate defined by
-SSLCertificateFile will not be matched with a key from SSLCertificateURI.
+SSLCertificateFile will not be matched with a key from SSLStoreURI.
</p>
</note>
@@ -1316,9 +1316,9 @@ effect.</p>
</directivesynopsis>
<directivesynopsis>
-<name>SSLCACertificateURI</name>
+<name>SSLTrustURI</name>
<description>Server CA certificate store for Client Authentication</description>
-<syntax>SSLCACertificateURI <var>uri</var></syntax>
+<syntax>SSLTrustURI <var>uri</var></syntax>
<contextlist><context>server config</context>
<context>virtual host</context></contextlist>
<override>AuthConfig</override>
@@ -1327,22 +1327,27 @@ OpenSSL v3 or later.</compatibility>
<usage>
<p>
-This directive sets the <em>all-in-one</em> URI where you can assemble the
-Certificates of Certification Authorities (CA) whose <em>clients</em> you deal
-with. These are used for Client Authentication. This can be used alternatively
-and/or additionally to <directive module="mod_ssl">SSLCACertificateFile</directive>
+This directive sets URIs where you can assemble the Certificates of Certification
+Authorities (CA) whose <em>clients</em> you deal with. These are used for Client
+Authentication. This can be used alternatively and/or additionally to
+<directive module="mod_ssl">SSLCACertificateFile</directive>
or <directive module="mod_ssl">SSLCACertificatePath</directive>.</p>
<example><title>Example</title>
<highlight language="config">
# trust certs in a PEM encoded certificate bundle
-SSLCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt"
+SSLTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt"
# trust all certs in a typical Linux machine
-SSLCACertificateURI "pkcs11:token=System%20Trust"
+SSLTrustURI "pkcs11:token=System%20Trust"
# trust all certs in the Windows trust store
-SSLCACertificateURI "org.openssl.winstore:"
+SSLTrustURI "org.openssl.winstore:"
</highlight>
</example>
+<p>
+This directive will also read in Certificate Revocation Lists (CRL) of
+Certification Authorities (CAs) whose clients you deal with. These are used
+to revoke the client certificate on Client Authentication.</p>
+
<p>This URI is read at server startup, while the server is still running
as <code>root</code> (before privilege dropping), so it may be owned by
and readable only by <code>root</code>. The URI is not re-read during
@@ -1369,12 +1374,12 @@ available.</p>
<p>If none of the directives <directive
module="mod_ssl">SSLCADNRequestFile</directive>, <directive
module="mod_ssl">SSLCADNRequestPath</directive>, or <directive
-module="mod_ssl">SSLCADNRequestURI</directive> are given, then the
+module="mod_ssl">SSLTrustRequestURI</directive> are given, then the
set of acceptable CA names sent to the client is the names of all the
CA certificates given by the <directive
module="mod_ssl">SSLCACertificateFile</directive>, <directive
module="mod_ssl">SSLCACertificatePath</directive>, and <directive
-module="mod_ssl">SSLCACertificateURI</directive> directives; in other
+module="mod_ssl">SSLTrustURI</directive> directives; in other
words, the names of the CAs which will actually be used to verify the
client certificate.</p>
@@ -1384,7 +1389,7 @@ the client certificate - for example, if
signed by intermediate CAs. In such cases, <directive
module="mod_ssl">SSLCADNRequestFile</directive>, <directive
module="mod_ssl">SSLCADNRequestPath</directive>, and/or <directive
-module="mod_ssl">SSLCADNRequestURI</directive> can be used; the
+module="mod_ssl">SSLTrustRequestURI</directive> can be used; the
acceptable CA names are then taken from the complete set of
certificates in the directory and/or file specified by this pair of
directives.</p>
@@ -1443,10 +1448,10 @@ to take effect.</p>
</directivesynopsis>
<directivesynopsis>
-<name>SSLCADNRequestURI</name>
+<name>SSLTrustRequestURI</name>
<description>certificate store of CA Certificates for defining
acceptable CA names</description>
-<syntax>SSLCADNRequestURI <var>uri</var></syntax>
+<syntax>SSLTrustRequestURI <var>uri</var></syntax>
<contextlist><context>server config</context>
<context>virtual host</context></contextlist>
@@ -1460,12 +1465,12 @@ available.</p>
<p>If none of the directives <directive
module="mod_ssl">SSLCADNRequestFile</directive>, <directive
module="mod_ssl">SSLCADNRequestPath</directive>, or <directive
-module="mod_ssl">SSLCADNRequestURI</directive> are given, then the
+module="mod_ssl">SSLTrustRequestURI</directive> are given, then the
set of acceptable CA names sent to the client is the names of all the
CA certificates given by the <directive
module="mod_ssl">SSLCACertificateFile</directive>, <directive
module="mod_ssl">SSLCACertificatePath</directive>, and <directive
-module="mod_ssl">SSLCACertificateURI</directive> directives; in other
+module="mod_ssl">SSLTrustURI</directive> directives; in other
words, the names of the CAs which will actually be used to verify the
client certificate.</p>
@@ -1475,18 +1480,18 @@ the client certificate - for example, if
signed by intermediate CAs. In such cases, <directive
module="mod_ssl">SSLCADNRequestFile</directive>, <directive
module="mod_ssl">SSLCADNRequestPath</directive>, and/or <directive
-module="mod_ssl">SSLCADNRequestURI</directive> can be used; the
+module="mod_ssl">SSLTrustRequestURI</directive> can be used; the
acceptable CA names are then taken from the complete set of
certificates in the directory and/or file specified by this pair of
directives.</p>
-<p><directive module="mod_ssl">SSLCADNRequestURI</directive> must
+<p><directive module="mod_ssl">SSLTrustRequestURI</directive> must
specify an <em>all-in-one</em> certificate store uri containing a
set of CA certificates.</p>
<example><title>Example</title>
<highlight language="config">
-SSLCADNRequestURI "file:///usr/local/apache2/conf/ca-names.crt"
+SSLTrustRequestURI "file:///usr/local/apache2/conf/ca-names.crt"
</highlight>
</example>
@@ -1571,44 +1576,6 @@ effect.</p>
</directivesynopsis>
<directivesynopsis>
-<name>SSLCARevocationURI</name>
-<description>Server CA certificate revocation list store for Client Authentication</description>
-<syntax>SSLCARevocationURI <var>uri</var></syntax>
-<contextlist><context>server config</context>
-<context>virtual host</context></contextlist>
-
-<usage>
-<p>
-This directive sets the <em>all-in-one</em> file where you can
-assemble the Certificate Revocation Lists (CRL) of Certification
-Authorities (CA) whose <em>clients</em> you deal with. These are used
-for Client Authentication. This can be used alternatively and/or
-additionally to <directive
-module="mod_ssl">SSLCARevocationFile</directive> and <directive
-module="mod_ssl">SSLCARevocationPath</directive>.</p>
-<example><title>Example</title>
-<highlight language="config">
-SSLCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl"
-</highlight>
-</example>
-
-<p>A <var>file:</var> URI pointing at a file of PEM encoded CRLs
-can be used instead of <directive
-module="mod_ssl">SSLCARevocationFile</directive>, and a <var>file:</var>
-URI pointing at a directory of PEM encoded CRLs can be used
-instead of <directive
-module="mod_ssl">SSLCARevocationPath</directive>.
-</p>
-
-<p>This URI is read at server startup, while the server is still running
-as <code>root</code> (before privilege dropping), so it may be owned by
-and readable only by <code>root</code>. The URI is not re-read during
-normal operation; a server restart is required for changes to take
-effect.</p>
-</usage>
-</directivesynopsis>
-
-<directivesynopsis>
<name>SSLCARevocationCheck</name>
<description>Enable CRL-based revocation checking</description>
<syntax>SSLCARevocationCheck chain|leaf|none [<var>flag</var>s ...]</syntax>
@@ -2387,9 +2354,9 @@ SSLProxyMachineCertificateChainFile "/us
</directivesynopsis>
<directivesynopsis>
-<name>SSLProxyMachineCertificateURI</name>
+<name>SSLProxyStoreURI</name>
<description>Proxy certificate and key stores</description>
-<syntax>SSLProxyMachineCertificateURI <var>uri</var></syntax>
+<syntax>SSLProxyStoreURI <var>uri</var></syntax>
<contextlist><context>server config</context> <context>virtual host</context>
<context>proxy section</context></contextlist>
<compatibility>Available in httpd 2.5.1 and later, when linked with
@@ -2437,11 +2404,11 @@ at startup time.</p>
<example><title>Example</title>
<highlight language="config">
# Example using a PEM-encoded file.
-SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.pem"
+SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.pem"
# Example using a PKCS12 file.
-SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.p12"
+SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.p12"
# Example use of a certificate and private key from a PKCS#11 token:
-SSLProxyMachineCertificateURI "pkcs11:token=My%20Token%20Name;id=45"
+SSLProxyStoreURI "pkcs11:token=My%20Token%20Name;id=45"
</highlight>
</example>
@@ -2469,13 +2436,13 @@ likely fail the SSL/TLS handshake (depen
configuration).</p>
<note type="warning"><title>Using SSLProxyMachineCertificateFile and
-SSLProxyMachineCertificateURI together</title>
+SSLProxyStoreURI together</title>
<p>
You can use both SSLProxyMachineCertificateFile and
-SSLProxyMachineCertificateURI together, however there is
+SSLProxyStoreURI together, however there is
no overlap between the mechanisms. A certificate defined by
SSLProxyMachineCertificateFile will not be matched with a
-key from SSLProxyMachineCertificateURI.
+key from SSLProxyStoreURI.
</p>
</note>
@@ -2790,9 +2757,9 @@ SSLProxyCACertificateFile "/usr/local/ap
</directivesynopsis>
<directivesynopsis>
-<name>SSLProxyCACertificateURI</name>
+<name>SSLProxyTrustURI</name>
<description>Proxy CA certificate store for Remote Server Auth</description>
-<syntax>SSLProxyCACertificateURI <var>uri</var></syntax>
+<syntax>SSLProxyTrustURI <var>uri</var></syntax>
<contextlist><context>server config</context> <context>virtual host</context>
<context>proxy section</context></contextlist>
<compatibility>Available in httpd 2.5.1 and later, when linked with
@@ -2800,7 +2767,7 @@ OpenSSL v3 or later.</compatibility>
<usage>
<p>
-This directive sets the <em>all-in-one</em> URI where you can assemble the
+This directive sets URIs where you can assemble the
Certificates of Certification Authorities (CA) whose <em>remote servers</em> you deal
with. These are used for Remote Server Authentication. This can be used alternatively
and/or additionally to
@@ -2808,9 +2775,14 @@ and/or additionally to
<directive module="mod_ssl">SSLProxyCACertificatePath</directive>.</p>
<example><title>Example</title>
<highlight language="config">
-SSLProxyCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt"
+SSLProxyTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt"
</highlight>
</example>
+<p>
+This directive will also process Certificate Revocation Lists (CRL) of Certification
+Authorities (CAs) whose remote servers you deal with, if they fall within scope.
+These are used to revoke the remote server certificate on Remote Server Authentication.
+</p>
</usage>
</directivesynopsis>
@@ -2866,32 +2838,6 @@ SSLProxyCARevocationFile "/usr/local/apa
</highlight>
</example>
</usage>
-</directivesynopsis>
-
-<directivesynopsis>
-<name>SSLProxyCARevocationURI</name>
-<description>Proxy CA certificate revocation list store for Remote Server Auth</description>
-<syntax>SSLProxyCARevocationURI <var>uri</var></syntax>
-<contextlist><context>server config</context> <context>virtual host</context>
-<context>proxy section</context></contextlist>
-<compatibility>Available in httpd 2.5.1 and later, when linked with
-OpenSSL v3 or later.</compatibility>
-
-<usage>
-<p>
-This directive sets the <em>all-in-one</em> URI where you can
-assemble the Certificate Revocation Lists (CRL) of Certification
-Authorities (CA) whose <em>remote servers</em> you deal with. These are used
-for Remote Server Authentication. This can be
-used alternatively and/or additionally to <directive
-module="mod_ssl">SSLProxyCARevocationFile</directive> and <directive
-module="mod_ssl">SSLProxyCARevocationPath</directive>.</p>
-<example><title>Example</title>
-<highlight language="config">
-SSLProxyCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-remote-server.crl"
-</highlight>
-</example>
-</usage>
</directivesynopsis>
<directivesynopsis>
Modified: httpd/httpd/trunk/modules/ssl/mod_ssl.c
==============================================================================
--- httpd/httpd/trunk/modules/ssl/mod_ssl.c Thu Aug 6 08:30:29 2026 (r1936907)
+++ httpd/httpd/trunk/modules/ssl/mod_ssl.c Thu Aug 6 11:01:29 2026 (r1936908)
@@ -110,7 +110,7 @@ static const command_rec ssl_config_cmds
SSL_CMD_ALL(CipherSuite, TAKE12,
"Colon-delimited list of permitted SSL Ciphers, optional preceded "
"by protocol identifier ('XXX:...:XXX' - see manual)")
- SSL_CMD_SRV(CertificateURI, TAKE1,
+ SSL_CMD_SRV(StoreURI, TAKE1,
"SSL Server Certificate/Key uri "
"('file:', 'pkcs11:' - URI of certificate or key)")
SSL_CMD_SRV(CertificateFile, TAKE1,
@@ -132,7 +132,7 @@ static const command_rec ssl_config_cmds
"TLS ECH Key Directory"
"('/path/to/dir' - directory with ECH key pairs)")
#endif
- SSL_CMD_SRV(CACertificateURI, TAKE1,
+ SSL_CMD_SRV(TrustURI, TAKE1,
"SSL CA Certificate uri "
"('file:', 'pkcs11:' - URI of CA certificates)")
SSL_CMD_ALL(CACertificatePath, TAKE1,
@@ -147,12 +147,9 @@ static const command_rec ssl_config_cmds
SSL_CMD_SRV(CADNRequestFile, TAKE1,
"SSL CA Distinguished Name file "
"('/path/to/file' - PEM encoded to derive acceptable CA names to request)")
- SSL_CMD_SRV(CADNRequestURI, TAKE1,
+ SSL_CMD_SRV(TrustRequestURI, TAKE1,
"SSL CA Distinguished Name uri "
"('file:', 'pkcs11:' - URI of certificates to derive acceptable CA names to request)")
- SSL_CMD_SRV(CARevocationURI, TAKE1,
- "SSL CA Certificate Revocation List (CRL) uri "
- "('file:', 'pkcs11:' - URI of CRLs)")
SSL_CMD_SRV(CARevocationPath, TAKE1,
"SSL CA Certificate Revocation List (CRL) path "
"('/path/to/dir' - contains PEM encoded files)")
@@ -228,8 +225,8 @@ static const command_rec ssl_config_cmds
SSL_CMD_PXY(ProxyVerifyDepth, TAKE1,
"SSL Proxy: maximum certificate verification depth "
"('N' - number of intermediate certificates)")
- SSL_CMD_PXY(ProxyCACertificateURI, TAKE1,
- "SSL Proxy: uri referring to server certificates "
+ SSL_CMD_PXY(ProxyTrustURI, TAKE1,
+ "SSL Proxy: uri referring to trusted server certificates "
"('file:', 'pkcs11:' - URI of CA certificates)")
SSL_CMD_PXY(ProxyCACertificateFile, TAKE1,
"SSL Proxy: file containing server certificates "
@@ -237,9 +234,6 @@ static const command_rec ssl_config_cmds
SSL_CMD_PXY(ProxyCACertificatePath, TAKE1,
"SSL Proxy: directory containing server certificates "
"('/path/to/dir' - contains PEM encoded certificates)")
- SSL_CMD_PXY(ProxyCARevocationURI, TAKE1,
- "SSL Proxy: CA Certificate Revocation List (CRL) uri "
- "('file:', 'pkcs11:' - URI of CRLs)")
SSL_CMD_PXY(ProxyCARevocationPath, TAKE1,
"SSL Proxy: CA Certificate Revocation List (CRL) path "
"('/path/to/dir' - contains PEM encoded files)")
@@ -248,7 +242,7 @@ static const command_rec ssl_config_cmds
"('/path/to/file' - PEM encoded)")
SSL_CMD_PXY(ProxyCARevocationCheck, RAW_ARGS,
"SSL Proxy: CA Certificate Revocation List (CRL) checking mode")
- SSL_CMD_PXY(ProxyMachineCertificateURI, TAKE1,
+ SSL_CMD_PXY(ProxyStoreURI, TAKE1,
"SSL Proxy: uri referring to client certificates "
"('file:', 'pkcs11:' - URI of certificate or key)")
SSL_CMD_PXY(ProxyMachineCertificateFile, TAKE1,
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_config.c
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_config.c Thu Aug 6 08:30:29 2026 (r1936907)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_config.c Thu Aug 6 11:01:29 2026 (r1936908)
@@ -132,10 +132,9 @@ static void modssl_ctx_init(modssl_ctx_t
mctx->crl_file = NULL;
mctx->crl_path = NULL;
- mctx->crl_uri = NULL;
mctx->crl_check_mask = UNSET;
- mctx->auth.ca_cert_uri = NULL;
+ mctx->auth.trust_uris = apr_array_make(p, 3, sizeof(char *));;
mctx->auth.ca_cert_path = NULL;
mctx->auth.ca_cert_file = NULL;
mctx->auth.cipher_suite = NULL;
@@ -204,6 +203,7 @@ static void modssl_ctx_init_server(SSLSr
mctx->pks = apr_pcalloc(p, sizeof(*mctx->pks));
mctx->pks->uris = apr_array_make(p, 3, sizeof(char *));
+ mctx->pks->trust_request_uris = apr_array_make(p, 3, sizeof(char *));
mctx->pks->cert_files = apr_array_make(p, 3, sizeof(char *));
mctx->pks->key_files = apr_array_make(p, 3, sizeof(char *));
@@ -281,10 +281,9 @@ static void modssl_ctx_cfg_merge(apr_poo
cfgMerge(crl_file, NULL);
cfgMerge(crl_path, NULL);
- cfgMerge(crl_uri, NULL);
cfgMergeInt(crl_check_mask);
- cfgMergeString(auth.ca_cert_uri);
+ cfgMergeArray(auth.trust_uris);
cfgMergeString(auth.ca_cert_path);
cfgMergeString(auth.ca_cert_file);
cfgMergeString(auth.cipher_suite);
@@ -343,7 +342,7 @@ static void modssl_ctx_cfg_merge_server(
cfgMergeArray(pks->cert_files);
cfgMergeArray(pks->key_files);
- cfgMergeString(pks->ca_name_uri);
+ cfgMergeArray(pks->trust_request_uris);
cfgMergeString(pks->ca_name_path);
cfgMergeString(pks->ca_name_file);
@@ -1096,7 +1095,7 @@ static const char *ssl_cmd_check_dir(cmd
}
-const char *ssl_cmd_SSLCertificateURI(cmd_parms *cmd,
+const char *ssl_cmd_SSLStoreURI(cmd_parms *cmd,
void *dcfg,
const char *arg)
{
@@ -1185,7 +1184,7 @@ const char *ssl_cmd_SSLSessionTicketKeyF
#define NO_PER_DIR_SSL_CA \
"Your SSL library does not have support for per-directory CA"
-const char *ssl_cmd_SSLCACertificateURI(cmd_parms *cmd,
+const char *ssl_cmd_SSLTrustURI(cmd_parms *cmd,
void *dcfg,
const char *arg)
{
@@ -1202,7 +1201,7 @@ const char *ssl_cmd_SSLCACertificateURI(
}
/* XXX: bring back per-dir */
- sc->server->auth.ca_cert_uri = arg;
+ *(const char **)apr_array_push(sc->server->auth.trust_uris) = arg;
return NULL;
}
@@ -1251,8 +1250,8 @@ const char *ssl_cmd_SSLCACertificateFile
return NULL;
}
-const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *cmd, void *dcfg,
- const char *arg)
+const char *ssl_cmd_SSLTrustRequestURI(cmd_parms *cmd, void *dcfg,
+ const char *arg)
{
SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
const char *err;
@@ -1261,7 +1260,7 @@ const char *ssl_cmd_SSLCADNRequestURI(cm
return err;
}
- sc->server->pks->ca_name_uri = arg;
+ *(const char **)apr_array_push(sc->server->pks->trust_request_uris) = arg;
return NULL;
}
@@ -1296,22 +1295,6 @@ const char *ssl_cmd_SSLCADNRequestFile(c
return NULL;
}
-const char *ssl_cmd_SSLCARevocationURI(cmd_parms *cmd,
- void *dcfg,
- const char *arg)
-{
- SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
- const char *err;
-
- if ((err = ssl_cmd_check_uri(cmd, arg))) {
- return err;
- }
-
- sc->server->crl_uri = arg;
-
- return NULL;
-}
-
const char *ssl_cmd_SSLCARevocationPath(cmd_parms *cmd,
void *dcfg,
const char *arg)
@@ -1857,7 +1840,7 @@ const char *ssl_cmd_SSLProxyVerifyDepth(
return NULL;
}
-const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *cmd,
+const char *ssl_cmd_SSLProxyTrustURI(cmd_parms *cmd,
void *dcfg,
const char *arg)
{
@@ -1868,7 +1851,7 @@ const char *ssl_cmd_SSLProxyCACertificat
return err;
}
- dc->proxy->auth.ca_cert_uri = arg;
+ *(const char **)apr_array_push(dc->proxy->auth.trust_uris) = arg;
return NULL;
}
@@ -1905,22 +1888,6 @@ const char *ssl_cmd_SSLProxyCACertificat
return NULL;
}
-const char *ssl_cmd_SSLProxyCARevocationURI(cmd_parms *cmd,
- void *dcfg,
- const char *arg)
-{
- SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
- const char *err;
-
- if ((err = ssl_cmd_check_uri(cmd, arg))) {
- return err;
- }
-
- dc->proxy->crl_uri = arg;
-
- return NULL;
-}
-
const char *ssl_cmd_SSLProxyCARevocationPath(cmd_parms *cmd,
void *dcfg,
const char *arg)
@@ -1962,9 +1929,9 @@ const char *ssl_cmd_SSLProxyCARevocation
return ssl_cmd_crlcheck_parse(cmd, arg, &dc->proxy->crl_check_mask);
}
-const char *ssl_cmd_SSLProxyMachineCertificateURI(cmd_parms *cmd,
- void *dcfg,
- const char *arg)
+const char *ssl_cmd_SSLProxyStoreURI(cmd_parms *cmd,
+ void *dcfg,
+ const char *arg)
{
SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
const char *err;
@@ -2529,9 +2496,15 @@ void ssl_hook_ConfigTest(apr_pool_t *pco
SSLSrvConfigRec *sc = mySrvConfig(s);
if (sc && sc->server) {
- if (sc->server->auth.ca_cert_uri) {
+
+ int i;
+
+ for (i = 0; (i < sc->server->auth.trust_uris->nelts) &&
+ APR_ARRAY_IDX(sc->server->auth.trust_uris, i, const char *);
+ i++) {
apr_file_printf(out, " %s\n",
- sc->server->auth.ca_cert_uri);
+ APR_ARRAY_IDX(sc->server->auth.trust_uris,
+ i, const char *));
}
if (sc->server->auth.ca_cert_path) {
apr_file_printf(out, " %s\n",
@@ -2800,7 +2773,7 @@ static void modssl_auth_ctx_dump(modssl_
#endif
DMP_VERIFY(proxy? "SSLProxyVerify" : "SSLVerifyClient", auth->verify_mode);
DMP_LONG( proxy? "SSLProxyVerify" : "SSLVerifyDepth", auth->verify_depth);
- DMP_STRING(proxy? "SSLProxyCACertificateURI" : "SSLCACertificateURI", auth->ca_cert_uri);
+ DMP_STRARR(proxy? "SSLProxyTrustURI" : "SSLTrustURI", auth->trust_uris);
DMP_STRING(proxy? "SSLProxyCACertificateFile" : "SSLCACertificateFile", auth->ca_cert_file);
DMP_STRING(proxy? "SSLProxyCACertificatePath" : "SSLCACertificatePath", auth->ca_cert_path);
}
@@ -2820,15 +2793,14 @@ static void modssl_ctx_dump(modssl_ctx_t
DMP_STRING(proxy? "SSLProxyCARevocationFile" : "SSLCARevocationFile", ctx->crl_file);
DMP_STRING(proxy? "SSLProxyCARevocationPath" : "SSLCARevocationPath", ctx->crl_path);
- DMP_STRING(proxy? "SSLProxyCARevocationURI" : "SSLCARevocationURI", ctx->crl_uri);
DMP_CRLCHK(proxy? "SSLProxyCARevocationCheck" : "SSLCARevocationCheck", ctx->crl_check_mask);
if (!proxy) {
DMP_PHRASE("SSLPassPhraseDialog", ctx->pphrase_dialog_type, ctx->pphrase_dialog_path);
if (ctx->pks) {
- DMP_STRING("SSLCADNRequestURI", ctx->pks->ca_name_uri);
+ DMP_STRARR("SSLTrustRequestURI", ctx->pks->trust_request_uris);
DMP_STRING("SSLCADNRequestFile", ctx->pks->ca_name_file);
DMP_STRING("SSLCADNRequestPath", ctx->pks->ca_name_path);
- DMP_STRARR("SSLCertificateURI", ctx->pks->uris);
+ DMP_STRARR("SSLStoreURI", ctx->pks->uris);
DMP_STRARR("SSLCertificateFile", ctx->pks->cert_files);
DMP_STRARR("SSLCertificateKeyFile", ctx->pks->key_files);
}
@@ -2879,7 +2851,7 @@ static void modssl_ctx_dump(modssl_ctx_t
}
else { /* proxy */
if (ctx->pkp) {
- DMP_STRARR("SSLProxyMachineCertificateURI", ctx->pkp->uris);
+ DMP_STRARR("SSLProxyStoreURI", ctx->pkp->uris);
DMP_STRING("SSLProxyMachineCertificateFile", ctx->pkp->cert_file);
DMP_STRING("SSLProxyMachineCertificatePath", ctx->pkp->cert_path);
DMP_STRING("SSLProxyMachineCertificateChainFile", ctx->pkp->ca_cert_file);
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_init.c Thu Aug 6 08:30:29 2026 (r1936907)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_init.c Thu Aug 6 11:01:29 2026 (r1936908)
@@ -339,7 +339,7 @@ static void hash_sni_policy_pk(apr_pool_
md5_strarray_hash(ptemp, hash, "key_files:", ctx->pks->key_files);
}
-static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx)
+static void hash_sni_policy_auth(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ctx_t *ctx)
{
modssl_pk_server_t *pks = ctx->pks;
modssl_auth_ctx_t *a = &ctx->auth;
@@ -347,13 +347,12 @@ static void hash_sni_policy_auth(apr_md5
md5_fmt_update(hash, "verify_depth:%d", a->verify_depth);
md5_fmt_update(hash, "verify_mode:%d", a->verify_mode);
- md5_ifstr_update(hash, "ca_name_uri:", pks->ca_name_uri);
+ md5_strarray_hash(ptemp, hash, "trust_request_uris:", pks->trust_request_uris);
md5_ifstr_update(hash, "ca_name_path:", pks->ca_name_path);
md5_ifstr_update(hash, "ca_name_file:", pks->ca_name_file);
- md5_ifstr_update(hash, "ca_cert_uri:", a->ca_cert_uri);
+ md5_strarray_hash(ptemp, hash, "trust_uris:", a->trust_uris);
md5_ifstr_update(hash, "ca_cert_path:", a->ca_cert_path);
md5_ifstr_update(hash, "ca_cert_file:", a->ca_cert_file);
- md5_ifstr_update(hash, "crl_uri:", ctx->crl_uri);
md5_ifstr_update(hash, "crl_path:", ctx->crl_path);
md5_ifstr_update(hash, "crl_file:", ctx->crl_file);
md5_fmt_update(hash, "crl_check_mask:%d", ctx->crl_check_mask);
@@ -393,7 +392,7 @@ static char *create_sni_policy_hash(apr_
/* Create the vhost policy hash for comparison later. */
apr_md5_init(&hash);
- hash_sni_policy_auth(&hash, sc->server);
+ hash_sni_policy_auth(ptemp, &hash, sc->server);
if (policy == MODSSL_SNIVH_SECURE)
hash_sni_policy_pk(ptemp, &hash, sc->server);
apr_md5_final(digest, &hash);
@@ -1307,6 +1306,26 @@ apr_status_t modssl_CTX_load_verify_stor
break;
}
+ case OSSL_STORE_INFO_CRL: {
+
+ X509_CRL *crl;
+
+ if (!(crl = OSSL_STORE_INFO_get0_CRL(info))) {
+ OSSL_STORE_close(sctx);
+ return APR_EGENERAL;
+ }
+ if (X509_STORE_add_crl(store, crl)) {
+
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(10601)
+ "Host %s: Certificate revocation list from URI: %s",
+ mctx->sc->vhost_id,
+ modssl_X509_NAME_to_string(ptemp,
+ X509_CRL_get_issuer(crl), 0));
+
+ }
+
+ break;
+ }
}
}
@@ -1361,20 +1380,30 @@ static apr_status_t ssl_init_ctx_verify(
*/
if (mctx->auth.ca_cert_file || mctx->auth.ca_cert_path ||
- mctx->auth.ca_cert_uri) {
+ mctx->auth.trust_uris->nelts) {
+ const char *trust_uri;
+
+ int i;
apr_status_t rv;
ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
"Configuring client authentication");
- if ((rv = modssl_CTX_load_verify_store(s, ptemp,
- mctx->auth.ca_cert_uri, 1, mctx)) != APR_SUCCESS) {
- ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10600)
- "Unable to configure verify store "
- "for client authentication");
- ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
- return ssl_die(s);
+ for (i = 0; (i < mctx->auth.trust_uris->nelts) &&
+ (trust_uri = APR_ARRAY_IDX(mctx->auth.trust_uris, i,
+ const char *));
+ i++) {
+
+ if ((rv = modssl_CTX_load_verify_store(s, ptemp,
+ trust_uri, 1, mctx)) != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10600)
+ "Unable to configure verify store "
+ "for client authentication: %s", trust_uri);
+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+ return ssl_die(s);
+ }
+
}
if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file,
@@ -1387,18 +1416,18 @@ static apr_status_t ssl_init_ctx_verify(
}
if (mctx->pks && (mctx->pks->ca_name_file || mctx->pks->ca_name_path ||
- mctx->pks->ca_name_uri)) {
+ mctx->pks->trust_request_uris->nelts)) {
ca_list = ssl_init_FindCAList(s, ptemp,
mctx->pks->ca_name_file,
mctx->pks->ca_name_path,
- mctx->pks->ca_name_uri,
+ mctx->pks->trust_request_uris,
mctx);
} else {
ca_list = ssl_init_FindCAList(s, ptemp,
mctx->auth.ca_cert_file,
mctx->auth.ca_cert_path,
- mctx->auth.ca_cert_uri,
+ mctx->auth.trust_uris,
mctx);
}
@@ -1493,99 +1522,6 @@ int modssl_X509_STORE_load_locations(X50
return 1;
}
-/*
- * OpenSSL has a X509_STORE_load_store() function, but this
- * function has side effects - it loads both CRLs and trusted
- * CA certificates.
- *
- * An end user reasonably wants to configure a URI pointing at
- * CRLs and not have any surprises if the scope of the URI
- * included trusted CA certificates for whatever reason.
- *
- * As a result we consider CRLs exclusively below.
- */
-
-static APR_INLINE
-apr_status_t modssl_X509_STORE_load_crl(server_rec *s,
- apr_pool_t *ptemp,
- const char *uri,
- int depth,
- modssl_ctx_t *mctx)
-{
-#if MODSSL_HAVE_OPENSSL_STORE
- OSSL_STORE_CTX *sctx;
- OSSL_STORE_INFO *info;
-
- apr_status_t rv = APR_SUCCESS;
-
- X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx);
-
- ap_assert(store != NULL); /* safe to assume always non-NULL? */
-
- if (!uri) {
- return APR_SUCCESS;
- }
-
- if ((!(sctx = OSSL_STORE_open_ex(uri, mctx->libctx, NULL, NULL, NULL,
- NULL, NULL, NULL)))) {
- return APR_EGENERAL;
- }
-
- while (!OSSL_STORE_eof(sctx) && !OSSL_STORE_error(sctx)) {
-
- if (!(info = OSSL_STORE_load(sctx))) {
- continue;
- }
-
- switch(OSSL_STORE_INFO_get_type(info)) {
- case OSSL_STORE_INFO_NAME: {
-
- if (depth > 0) {
- rv = modssl_X509_STORE_load_crl(s, ptemp,
- OSSL_STORE_INFO_get0_NAME(info),
- depth - 1, mctx);
- if (APR_SUCCESS != rv) {
- OSSL_STORE_close(sctx);
- return rv;
- }
- }
-
- break;
- }
- case OSSL_STORE_INFO_CRL: {
-
- X509_CRL *crl;
-
- if (!(crl = OSSL_STORE_INFO_get0_CRL(info))) {
- return APR_EGENERAL;
- }
- if (X509_STORE_add_crl(store, crl)) {
-
- ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(10601)
- "Host %s: Certificate revocation list from URI: %s",
- mctx->sc->vhost_id,
- modssl_X509_NAME_to_string(ptemp,
- X509_CRL_get_issuer(crl), 0));
-
- }
-
- break;
- }
- }
- }
-
- OSSL_STORE_close(sctx);
-
- return rv;
-#else
- if (!uri) {
- return APR_SUCCESS;
- }
-
- return APR_ENOTIMPL;
-#endif
-}
-
static apr_status_t ssl_init_ctx_crl(server_rec *s,
apr_pool_t *p,
apr_pool_t *ptemp,
@@ -1612,12 +1548,12 @@ static apr_status_t ssl_init_ctx_crl(ser
* Configure Certificate Revocation List (CRL) Details
*/
- if (!(mctx->crl_uri || mctx->crl_file || mctx->crl_path)) {
+ if (!(mctx->auth.trust_uris->nelts || mctx->crl_file || mctx->crl_path)) {
if (crl_check_mode == SSL_CRLCHECK_LEAF ||
crl_check_mode == SSL_CRLCHECK_CHAIN) {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01899)
"Host %s: CRL checking has been enabled, but "
- "neither %sCARevocationURI, %sCARevocationFile nor %sCARevocationPath "
+ "neither %sTrustURI, %sCARevocationFile nor %sCARevocationPath "
"is configured", mctx->sc->vhost_id, cfgp, cfgp, cfgp);
return ssl_die(s);
}
@@ -1627,14 +1563,6 @@ static apr_status_t ssl_init_ctx_crl(ser
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
"Configuring certificate revocation facility");
- if ((rv = modssl_X509_STORE_load_crl(s, ptemp, mctx->crl_uri, 1, mctx)) != APR_SUCCESS) {
- ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10602)
- "Host %s: unable to configure X.509 CRL uri "
- "for certificate revocation", mctx->sc->vhost_id);
- ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
- return ssl_die(s);
- }
-
if (!modssl_X509_STORE_load_locations(store,
mctx->crl_file, mctx->crl_path)) {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
@@ -3632,21 +3560,32 @@ STACK_OF(X509_NAME) *ssl_init_FindCAList
apr_pool_t *ptemp,
const char *ca_file,
const char *ca_path,
- const char *ca_uri,
+ apr_array_header_t *trust_uris,
modssl_ctx_t *mctx)
{
+ const char *trust_uri;
+ int i;
+
STACK_OF(X509_NAME) *ca_list = sk_X509_NAME_new_null();;
/*
* Process CA certificate store uri
*/
- if (ca_uri &&
- ssl_init_ca_cert_uri(s, ptemp,
- ca_uri, ca_list, 1, mctx) != APR_SUCCESS) {
- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10616)
- "Failed to open Certificate URI `%s'", ca_uri);
- sk_X509_NAME_pop_free(ca_list, X509_NAME_free);
- return NULL;
+
+ for (i = 0; (i < trust_uris->nelts) &&
+ (trust_uri = APR_ARRAY_IDX(trust_uris, i,
+ const char *));
+ i++) {
+
+ if (trust_uris->nelts &&
+ ssl_init_ca_cert_uri(s, ptemp,
+ trust_uri, ca_list, 1, mctx) != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10616)
+ "Failed to open Trust URI `%s'", trust_uri);
+ sk_X509_NAME_pop_free(ca_list, X509_NAME_free);
+ return NULL;
+ }
+
}
/*
Modified: httpd/httpd/trunk/modules/ssl/ssl_private.h
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_private.h Thu Aug 6 08:30:29 2026 (r1936907)
+++ httpd/httpd/trunk/modules/ssl/ssl_private.h Thu Aug 6 11:01:29 2026 (r1936908)
@@ -761,7 +761,7 @@ typedef struct {
/** Certificates which specify the set of CA names which should be
* sent in the CertificateRequest message: */
- const char *ca_name_uri;
+ apr_array_header_t *trust_request_uris;
const char *ca_name_path;
const char *ca_name_file;
@@ -788,7 +788,7 @@ typedef struct {
/** stuff related to authentication that can also be per-dir */
typedef struct {
/** known/trusted CAs */
- const char *ca_cert_uri;
+ apr_array_header_t *trust_uris;
const char *ca_cert_path;
const char *ca_cert_file;
@@ -849,7 +849,6 @@ typedef struct {
const char *cert_chain;
/** certificate revocation list */
- const char *crl_uri;
const char *crl_path;
const char *crl_file;
int crl_check_mask;
@@ -990,17 +989,16 @@ const char *ssl_cmd_SSLEngine(cmd_parms
const char *ssl_cmd_SSLECHKeyDir(cmd_parms *cmd, void *dcfg, const char *arg);
#endif
const char *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *, const char *);
-const char *ssl_cmd_SSLCertificateURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLStoreURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCertificateFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCertificateChainFile(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLCACertificateURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLTrustURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCACertificatePath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCACertificateFile(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLTrustRequestURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCADNRequestPath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCADNRequestFile(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLCARevocationURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCARevocationPath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCARevocationFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCARevocationCheck(cmd_parms *, void *, const char *);
@@ -1027,14 +1025,13 @@ const char *ssl_cmd_SSLProxyProtocol(cm
const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *, const char *);
const char *ssl_cmd_SSLProxyVerify(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLProxyTrustURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCACertificateFile(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLProxyCARevocationURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCARevocationPath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCARevocationFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCARevocationCheck(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLProxyMachineCertificateURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLProxyStoreURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyMachineCertificatePath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyMachineCertificateFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyMachineCertificateChainFile(cmd_parms *, void *, const char *);
@@ -1080,7 +1077,7 @@ int ssl_proxy_section_post_conf
apr_pool_t *ptemp, server_rec *s,
ap_conf_vector_t *section_config);
STACK_OF(X509_NAME)
- *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *, const char *, modssl_ctx_t *);
+ *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *, apr_array_header_t *, modssl_ctx_t *);
void ssl_init_Child(apr_pool_t *, server_rec *);
apr_status_t ssl_init_ModuleKill(void *data);
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.