From: Graham Leggett <minfrin@apache.org>
Date: Tue, 4 Aug 2026 12:09:50 +0000 (+0000)
Subject: Add declaration and docs for SSLCADNRequestURI directive.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;ds=sidebyside;p=thirdparty%2Fapache%2Fhttpd.git

Add declaration and docs for SSLCADNRequestURI directive.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936863 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml
index 94b9c8992a..37df8d1c7c 100644
--- a/docs/manual/mod/mod_ssl.xml
+++ b/docs/manual/mod/mod_ssl.xml
@@ -1366,22 +1366,25 @@ in the SSL handshake.  These CA names can be used by the client to
 select an appropriate client certificate out of those it has
 available.</p>
 
-<p>If neither of the directives <directive
-module="mod_ssl">SSLCADNRequestPath</directive> or <directive
-module="mod_ssl">SSLCADNRequestFile</directive> are given, then the
+<p>If none of the directives <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, <directive
+module="mod_ssl">SSLCADNRequestPath</directive>, or <directive
+module="mod_ssl">SSLCADNRequestURI</directive> are given, then the
 set of acceptable CA names sent to the client is the names of all the
 CA certificates given by the <directive
-module="mod_ssl">SSLCACertificateFile</directive> and <directive
-module="mod_ssl">SSLCACertificatePath</directive> directives; in other
+module="mod_ssl">SSLCACertificateFile</directive>, <directive
+module="mod_ssl">SSLCACertificatePath</directive>, and <directive
+module="mod_ssl">SSLCACertificateURI</directive> directives; in other
 words, the names of the CAs which will actually be used to verify the
 client certificate.</p>
 
 <p>In some circumstances, it is useful to be able to send a set of
 acceptable CA names which differs from the actual CAs used to verify
 the client certificate - for example, if the client certificates are
-signed by intermediate CAs.  In such cases, <directive
-module="mod_ssl">SSLCADNRequestPath</directive> and/or <directive
-module="mod_ssl">SSLCADNRequestFile</directive> can be used; the
+signed by intermediate CAs. In such cases, <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, <directive
+module="mod_ssl">SSLCADNRequestPath</directive>, and/or <directive
+module="mod_ssl">SSLCADNRequestURI</directive> can be used; the
 acceptable CA names are then taken from the complete set of
 certificates in the directory and/or file specified by this pair of
 directives.</p>
@@ -1439,6 +1442,70 @@ to take effect.</p>
 </usage>
 </directivesynopsis>
 
+<directivesynopsis>
+<name>SSLCADNRequestURI</name>
+<description>certificate store of CA Certificates for defining
+acceptable CA names</description>
+<syntax>SSLCADNRequestURI <var>uri</var></syntax>
+<contextlist><context>server config</context>
+<context>virtual host</context></contextlist>
+
+<usage>
+<p>When a client certificate is requested by mod_ssl, a list of
+<em>acceptable Certificate Authority names</em> is sent to the client
+in the SSL handshake.  These CA names can be used by the client to
+select an appropriate client certificate out of those it has
+available.</p>
+
+<p>If none of the directives <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, <directive
+module="mod_ssl">SSLCADNRequestPath</directive>, or <directive
+module="mod_ssl">SSLCADNRequestURI</directive> are given, then the
+set of acceptable CA names sent to the client is the names of all the
+CA certificates given by the <directive
+module="mod_ssl">SSLCACertificateFile</directive>, <directive
+module="mod_ssl">SSLCACertificatePath</directive>, and <directive
+module="mod_ssl">SSLCACertificateURI</directive> directives; in other
+words, the names of the CAs which will actually be used to verify the
+client certificate.</p>
+
+<p>In some circumstances, it is useful to be able to send a set of
+acceptable CA names which differs from the actual CAs used to verify
+the client certificate - for example, if the client certificates are
+signed by intermediate CAs. In such cases, <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, <directive
+module="mod_ssl">SSLCADNRequestPath</directive>, and/or <directive
+module="mod_ssl">SSLCADNRequestURI</directive> can be used; the
+acceptable CA names are then taken from the complete set of
+certificates in the directory and/or file specified by this pair of
+directives.</p>
+
+<p><directive module="mod_ssl">SSLCADNRequestURI</directive> must
+specify an <em>all-in-one</em> certificate store uri containing a
+set of CA certificates.</p>
+
+<example><title>Example</title>
+<highlight language="config">
+SSLCADNRequestURI "file:///usr/local/apache2/conf/ca-names.crt"
+</highlight>
+</example>
+
+<p>A <var>file:</var> URI pointing at a file of PEM encoded certificates
+can be used instead of <directive
+module="mod_ssl">SSLCADNRequestFile</directive>, and a <var>file:</var>
+URI pointing at a directory of PEM encoded certificates can be used
+instead of <directive
+module="mod_ssl">SSLCADNRequestPath</directive>.
+</p>
+
+<p>This store is read at server startup, while the server is still running
+as <code>root</code> (before privilege dropping), so it may be owned by
+and readable only by <code>root</code>. The uri is not re-read during
+normal operation; a server restart is required for changes to take
+effect.</p>
+</usage>
+</directivesynopsis>
+
 <directivesynopsis>
 <name>SSLCARevocationPath</name>
 <description>Directory of PEM-encoded CA CRLs for
@@ -1525,6 +1592,14 @@ SSLCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl"
 </highlight>
 </example>
 
+<p>A <var>file:</var> URI pointing at a file of PEM encoded CRLs
+can be used instead of <directive
+module="mod_ssl">SSLCARevocationFile</directive>, and a <var>file:</var>
+URI pointing at a directory of PEM encoded CRLs can be used
+instead of <directive
+module="mod_ssl">SSLCARevocationPath</directive>.
+</p>
+
 <p>This URI is read at server startup, while the server is still running
 as <code>root</code> (before privilege dropping), so it may be owned by
 and readable only by <code>root</code>. The URI is not re-read during
diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
index 20d3db1a0d..5d5efa2e8a 100644
--- a/modules/ssl/mod_ssl.c
+++ b/modules/ssl/mod_ssl.c
@@ -147,6 +147,9 @@ static const command_rec ssl_config_cmds[] = {
     SSL_CMD_SRV(CADNRequestFile, TAKE1,
                 "SSL CA Distinguished Name file "
                 "('/path/to/file' - PEM encoded to derive acceptable CA names to request)")
+    SSL_CMD_SRV(CADNRequestURI, TAKE1,
+                "SSL CA Distinguished Name uri "
+                "('file:', 'pkcs11:' - URI of certificates to derive acceptable CA names to request)")
     SSL_CMD_SRV(CARevocationURI, TAKE1,
                 "SSL CA Certificate Revocation List (CRL) uri "
                 "('file:', 'pkcs11:' - URI of CRLs)")