mod_ssl: Add support for OpenSSL providers
"Graham Leggett via dev" <[email protected]> Wed, 29 Jul 2026 22:45:22 +0100
| Newsgroups | gmane.comp.apache.devel |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_C5F16D59-51D9-4D2E-B5C1-2D6850C667FE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi all, OpenSSL3+ added support for full certificate and key stores, based on = their provider mechanism. What this means in plain english is that you can point OpenSSL at a PEM = file, a PKCS12 file, a pcks11: URI, the whole Windows certificate store, = whatever is going, and it will just work. OpenSSL addresses each of these stores using a URI. I have added support for this to mod_ssl here: https://github.com/apache/httpd/pull/698 There are a series of new directives, for example in addition to = SSLCertificateFile and SSLCertificatePath we have SSLCertificateURI. The URI directives are a completely clean break from the legacy OpenSSL = functions like PEM_X509_INFO_read_bio() and = SSL_CTX_load_verify_locations() that have weird historical quirks and = inconsistencies. OpenSSL's OSSL_STORE_open_ex() appears to be the one = ring to rule them all. You can now point at a whole certificate store = and the correct certificate will be selected and the correct chain = added. You can use File and URI directives in the same config to load a = cert/key pair from the one, a a cert/key pair from the other, but they = don't interact with one another. The quirks are left to history. Regards, Graham -- --Apple-Mail=_C5F16D59-51D9-4D2E-B5C1-2D6850C667FE Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dus-ascii"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">Hi = all,<div><br></div><div>OpenSSL3+ added support for full certificate and = key stores, based on their provider = mechanism.</div><div><br></div><div>What this means in plain english is = that you can point OpenSSL at a PEM file, a PKCS12 file, a pcks11: URI, = the whole Windows certificate store, whatever is going, and it will just = work.</div><div><br></div><div>OpenSSL addresses each of these stores = using a URI.</div><div><br></div><div>I have added support for this to = mod_ssl here:</div><div><br></div><div><a = href=3D"https://github.com/apache/httpd/pull/698">https://github.com/apach= e/httpd/pull/698</a><br></div><div><br></div><div>There are a series of = new directives, for example in addition to SSLCertificateFile and = SSLCertificatePath we have = SSLCertificateURI.</div><div><br></div><div>The URI directives are a = completely clean break from the legacy OpenSSL functions = like PEM_X509_INFO_read_bio() = and SSL_CTX_load_verify_locations() that have weird historical = quirks and inconsistencies. OpenSSL's OSSL_STORE_open_ex() appears = to be the one ring to rule them all. You can now point at a whole = certificate store and the correct certificate will be selected and the = correct chain added.</div><div><br></div><div>You can use File and URI = directives in the same config to load a cert/key pair from the one, a a = cert/key pair from the other, but they don't interact with one another. = The quirks are left to = history.</div><div><br></div><div>Regards,</div><div>Graham</div><div>--</= div><div><br></div><div></div></body></html>= --Apple-Mail=_C5F16D59-51D9-4D2E-B5C1-2D6850C667FE--