[RFC/PATCH] mod_ssl: add SSLVHostSNIPolicy directive

Joe Orton <[email protected]> Mon, 20 Oct 2025 10:21:50 +0100

Newsgroups	gmane.comp.apache.devel
Organization	Registered in England and Wales under Company Registration No. 03798903 Directors: Michael Cunningham (US), Michael O'Neill (Ireland), Paul Argiry (US)
Message-ID	<[email protected]>

I've opened a PR with a proposed new directive SSLVHostSNIPolicy to 
resolve the issues many users are having migrating to 2.4.65. 
https://github.com/apache/httpd/pull/561

This both:
a) allows users to select a weaker vhost compatibility mode
b) strengthens the default and allows a stronger mode selection

Usage: SSLVHostSNIPolicy <policy> where policy must be one of:

* strict => fail for any vhost mismatch
* authonly => fail only for client verification/auth differences
* secure => fail as authonly plus ciphersuite, protocol, keypair differences
* insecure => allow everything

"secure" is the proposed default which keeps current (2.4.65) behaviour.

I've added checking for any difference in use of SSLOpenSSLConfCmd to 
"authonly" since the semantics of those directives are unknown to 
mod_ssl. But open to other opinions on that.

Regards, Joe