Re: mod_ssl: Add support for OpenSSL providers

On Wed, Jul 29, 2026 at 10:45:22PM +0100, Graham Leggett via dev wrote:
> Hi all,
> 
> OpenSSL3+ added support for full certificate and key stores, based on their provider mechanism.
> 
> What this means in plain english is that you can point OpenSSL at a PEM file, a PKCS12 file, a pcks11: URI, the whole Windows certificate store, whatever is going, and it will just work.
> 
> OpenSSL addresses each of these stores using a URI.
> 
> I have added support for this to mod_ssl here:
> 
> https://github.com/apache/httpd/pull/698

It's a lot of new directives, which is... challenging. Do we really want 
to support 3xN for every cert config command variant forever? Similarly, 
with a *lot* of new directives I would expect to see a lot of new test 
cases, where are they?

SSLCADNRequestURI doesn't seem to be registered.

At least some of the merging seems to be missing, I can't see ->crl_uri 
is merged and I haven't checked the rest thoroughly.

All the num_ fields in modssl_ctx_uri should be unsigned

I don't get the error handling in ssl_cmd_check_uri() - does that really 
work? OSSL_STORE_open_ex() returns NULL on error AFAICT and so can you 
reach the error path for unrecognized URIs? It looks like it's not, 
"SSLCertficateURI foo://bar" only fails at runtime which is I assume not 
intentional.