</directivesynopsis>
<directivesynopsis>
-<name>SSLCertificateURI</name>
+<name>SSLStoreURI</name>
<description>Server certificate and key store</description>
-<syntax>SSLCertificateURI <var>uri</var></syntax>
+<syntax>SSLStoreURI <var>uri</var></syntax>
<contextlist><context>server config</context>
<context>virtual host</context></contextlist>
<compatibility>Available in httpd 2.5.1 and later, when linked with
<example><title>Example</title>
<highlight language="config">
# Example using a PEM-encoded file.
-SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.crt"
+SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.crt"
# Example using a PKCS12 file.
-SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.p12"
+SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.p12"
# Example use of a certificate and private key from a PKCS#11 token:
-SSLCertificateURI "pkcs11:token=My%20Token%20Name;id=45"
+SSLStoreURI "pkcs11:token=My%20Token%20Name;id=45"
</highlight>
</example>
normal operation; a server restart is required for changes to take
effect.</p>
-<note type="warning"><title>Using SSLCertificateFile and SSLCertificateURI
+<note type="warning"><title>Using SSLCertificateFile and SSLStoreURI
together</title>
<p>
-You can use both SSLCertificateFile and SSLCertificateURI together, however
+You can use both SSLCertificateFile and SSLStoreURI together, however
there is no overlap between the mechanisms. A certificate defined by
-SSLCertificateFile will not be matched with a key from SSLCertificateURI.
+SSLCertificateFile will not be matched with a key from SSLStoreURI.
</p>
</note>
</directivesynopsis>
<directivesynopsis>
-<name>SSLCACertificateURI</name>
+<name>SSLTrustURI</name>
<description>Server CA certificate store for Client Authentication</description>
-<syntax>SSLCACertificateURI <var>uri</var></syntax>
+<syntax>SSLTrustURI <var>uri</var></syntax>
<contextlist><context>server config</context>
<context>virtual host</context></contextlist>
<override>AuthConfig</override>
<usage>
<p>
-This directive sets the <em>all-in-one</em> URI where you can assemble the
-Certificates of Certification Authorities (CA) whose <em>clients</em> you deal
-with. These are used for Client Authentication. This can be used alternatively
-and/or additionally to <directive module="mod_ssl">SSLCACertificateFile</directive>
+This directive sets URIs where you can assemble the Certificates of Certification
+Authorities (CA) whose <em>clients</em> you deal with. These are used for Client
+Authentication. This can be used alternatively and/or additionally to
+<directive module="mod_ssl">SSLCACertificateFile</directive>
or <directive module="mod_ssl">SSLCACertificatePath</directive>.</p>
<example><title>Example</title>
<highlight language="config">
# trust certs in a PEM encoded certificate bundle
-SSLCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt"
+SSLTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt"
# trust all certs in a typical Linux machine
-SSLCACertificateURI "pkcs11:token=System%20Trust"
+SSLTrustURI "pkcs11:token=System%20Trust"
# trust all certs in the Windows trust store
-SSLCACertificateURI "org.openssl.winstore:"
+SSLTrustURI "org.openssl.winstore:"
</highlight>
</example>
+<p>
+This directive will also read in Certificate Revocation Lists (CRL) of
+Certification Authorities (CAs) whose clients you deal with. These are used
+to revoke the client certificate on Client Authentication.</p>
+
<p>This URI is read at server startup, while the server is still running
as <code>root</code> (before privilege dropping), so it may be owned by
and readable only by <code>root</code>. The URI is not re-read during
<p>If none of the directives <directive
module="mod_ssl">SSLCADNRequestFile</directive>, <directive
module="mod_ssl">SSLCADNRequestPath</directive>, or <directive
-module="mod_ssl">SSLCADNRequestURI</directive> are given, then the
+module="mod_ssl">SSLTrustRequestURI</directive> are given, then the
set of acceptable CA names sent to the client is the names of all the
CA certificates given by the <directive
module="mod_ssl">SSLCACertificateFile</directive>, <directive
module="mod_ssl">SSLCACertificatePath</directive>, and <directive
-module="mod_ssl">SSLCACertificateURI</directive> directives; in other
+module="mod_ssl">SSLTrustURI</directive> directives; in other
words, the names of the CAs which will actually be used to verify the
client certificate.</p>
signed by intermediate CAs. In such cases, <directive
module="mod_ssl">SSLCADNRequestFile</directive>, <directive
module="mod_ssl">SSLCADNRequestPath</directive>, and/or <directive
-module="mod_ssl">SSLCADNRequestURI</directive> can be used; the
+module="mod_ssl">SSLTrustRequestURI</directive> can be used; the
acceptable CA names are then taken from the complete set of
certificates in the directory and/or file specified by this pair of
directives.</p>
</directivesynopsis>
<directivesynopsis>
-<name>SSLCADNRequestURI</name>
+<name>SSLTrustRequestURI</name>
<description>certificate store of CA Certificates for defining
acceptable CA names</description>
-<syntax>SSLCADNRequestURI <var>uri</var></syntax>
+<syntax>SSLTrustRequestURI <var>uri</var></syntax>
<contextlist><context>server config</context>
<context>virtual host</context></contextlist>
<p>If none of the directives <directive
module="mod_ssl">SSLCADNRequestFile</directive>, <directive
module="mod_ssl">SSLCADNRequestPath</directive>, or <directive
-module="mod_ssl">SSLCADNRequestURI</directive> are given, then the
+module="mod_ssl">SSLTrustRequestURI</directive> are given, then the
set of acceptable CA names sent to the client is the names of all the
CA certificates given by the <directive
module="mod_ssl">SSLCACertificateFile</directive>, <directive
module="mod_ssl">SSLCACertificatePath</directive>, and <directive
-module="mod_ssl">SSLCACertificateURI</directive> directives; in other
+module="mod_ssl">SSLTrustURI</directive> directives; in other
words, the names of the CAs which will actually be used to verify the
client certificate.</p>
signed by intermediate CAs. In such cases, <directive
module="mod_ssl">SSLCADNRequestFile</directive>, <directive
module="mod_ssl">SSLCADNRequestPath</directive>, and/or <directive
-module="mod_ssl">SSLCADNRequestURI</directive> can be used; the
+module="mod_ssl">SSLTrustRequestURI</directive> can be used; the
acceptable CA names are then taken from the complete set of
certificates in the directory and/or file specified by this pair of
directives.</p>
-<p><directive module="mod_ssl">SSLCADNRequestURI</directive> must
+<p><directive module="mod_ssl">SSLTrustRequestURI</directive> must
specify an <em>all-in-one</em> certificate store uri containing a
set of CA certificates.</p>
<example><title>Example</title>
<highlight language="config">
-SSLCADNRequestURI "file:///usr/local/apache2/conf/ca-names.crt"
+SSLTrustRequestURI "file:///usr/local/apache2/conf/ca-names.crt"
</highlight>
</example>
</usage>
</directivesynopsis>
-<directivesynopsis>
-<name>SSLCARevocationURI</name>
-<description>Server CA certificate revocation list store for Client Authentication</description>
-<syntax>SSLCARevocationURI <var>uri</var></syntax>
-<contextlist><context>server config</context>
-<context>virtual host</context></contextlist>
-
-<usage>
-<p>
-This directive sets the <em>all-in-one</em> file where you can
-assemble the Certificate Revocation Lists (CRL) of Certification
-Authorities (CA) whose <em>clients</em> you deal with. These are used
-for Client Authentication. This can be used alternatively and/or
-additionally to <directive
-module="mod_ssl">SSLCARevocationFile</directive> and <directive
-module="mod_ssl">SSLCARevocationPath</directive>.</p>
-<example><title>Example</title>
-<highlight language="config">
-SSLCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl"
-</highlight>
-</example>
-
-<p>A <var>file:</var> URI pointing at a file of PEM encoded CRLs
-can be used instead of <directive
-module="mod_ssl">SSLCARevocationFile</directive>, and a <var>file:</var>
-URI pointing at a directory of PEM encoded CRLs can be used
-instead of <directive
-module="mod_ssl">SSLCARevocationPath</directive>.
-</p>
-
-<p>This URI is read at server startup, while the server is still running
-as <code>root</code> (before privilege dropping), so it may be owned by
-and readable only by <code>root</code>. The URI is not re-read during
-normal operation; a server restart is required for changes to take
-effect.</p>
-</usage>
-</directivesynopsis>
-
<directivesynopsis>
<name>SSLCARevocationCheck</name>
<description>Enable CRL-based revocation checking</description>
</directivesynopsis>
<directivesynopsis>
-<name>SSLProxyMachineCertificateURI</name>
+<name>SSLProxyStoreURI</name>
<description>Proxy certificate and key stores</description>
-<syntax>SSLProxyMachineCertificateURI <var>uri</var></syntax>
+<syntax>SSLProxyStoreURI <var>uri</var></syntax>
<contextlist><context>server config</context> <context>virtual host</context>
<context>proxy section</context></contextlist>
<compatibility>Available in httpd 2.5.1 and later, when linked with
<example><title>Example</title>
<highlight language="config">
# Example using a PEM-encoded file.
-SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.pem"
+SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.pem"
# Example using a PKCS12 file.
-SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.p12"
+SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.p12"
# Example use of a certificate and private key from a PKCS#11 token:
-SSLProxyMachineCertificateURI "pkcs11:token=My%20Token%20Name;id=45"
+SSLProxyStoreURI "pkcs11:token=My%20Token%20Name;id=45"
</highlight>
</example>
configuration).</p>
<note type="warning"><title>Using SSLProxyMachineCertificateFile and
-SSLProxyMachineCertificateURI together</title>
+SSLProxyStoreURI together</title>
<p>
You can use both SSLProxyMachineCertificateFile and
-SSLProxyMachineCertificateURI together, however there is
+SSLProxyStoreURI together, however there is
no overlap between the mechanisms. A certificate defined by
SSLProxyMachineCertificateFile will not be matched with a
-key from SSLProxyMachineCertificateURI.
+key from SSLProxyStoreURI.
</p>
</note>
</directivesynopsis>
<directivesynopsis>
-<name>SSLProxyCACertificateURI</name>
+<name>SSLProxyTrustURI</name>
<description>Proxy CA certificate store for Remote Server Auth</description>
-<syntax>SSLProxyCACertificateURI <var>uri</var></syntax>
+<syntax>SSLProxyTrustURI <var>uri</var></syntax>
<contextlist><context>server config</context> <context>virtual host</context>
<context>proxy section</context></contextlist>
<compatibility>Available in httpd 2.5.1 and later, when linked with
<usage>
<p>
-This directive sets the <em>all-in-one</em> URI where you can assemble the
+This directive sets URIs where you can assemble the
Certificates of Certification Authorities (CA) whose <em>remote servers</em> you deal
with. These are used for Remote Server Authentication. This can be used alternatively
and/or additionally to
<directive module="mod_ssl">SSLProxyCACertificatePath</directive>.</p>
<example><title>Example</title>
<highlight language="config">
-SSLProxyCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt"
+SSLProxyTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt"
</highlight>
</example>
+<p>
+This directive will also process Certificate Revocation Lists (CRL) of Certification
+Authorities (CAs) whose remote servers you deal with, if they fall within scope.
+These are used to revoke the remote server certificate on Remote Server Authentication.
+</p>
</usage>
</directivesynopsis>
</usage>
</directivesynopsis>
-<directivesynopsis>
-<name>SSLProxyCARevocationURI</name>
-<description>Proxy CA certificate revocation list store for Remote Server Auth</description>
-<syntax>SSLProxyCARevocationURI <var>uri</var></syntax>
-<contextlist><context>server config</context> <context>virtual host</context>
-<context>proxy section</context></contextlist>
-<compatibility>Available in httpd 2.5.1 and later, when linked with
-OpenSSL v3 or later.</compatibility>
-
-<usage>
-<p>
-This directive sets the <em>all-in-one</em> URI where you can
-assemble the Certificate Revocation Lists (CRL) of Certification
-Authorities (CA) whose <em>remote servers</em> you deal with. These are used
-for Remote Server Authentication. This can be
-used alternatively and/or additionally to <directive
-module="mod_ssl">SSLProxyCARevocationFile</directive> and <directive
-module="mod_ssl">SSLProxyCARevocationPath</directive>.</p>
-<example><title>Example</title>
-<highlight language="config">
-SSLProxyCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-remote-server.crl"
-</highlight>
-</example>
-</usage>
-</directivesynopsis>
-
<directivesynopsis>
<name>SSLProxyCARevocationCheck</name>
<description>Enable CRL-based revocation checking for Remote Server Auth</description>
SSL_CMD_ALL(CipherSuite, TAKE12,
"Colon-delimited list of permitted SSL Ciphers, optional preceded "
"by protocol identifier ('XXX:...:XXX' - see manual)")
- SSL_CMD_SRV(CertificateURI, TAKE1,
+ SSL_CMD_SRV(StoreURI, TAKE1,
"SSL Server Certificate/Key uri "
"('file:', 'pkcs11:' - URI of certificate or key)")
SSL_CMD_SRV(CertificateFile, TAKE1,
"TLS ECH Key Directory"
"('/path/to/dir' - directory with ECH key pairs)")
#endif
- SSL_CMD_SRV(CACertificateURI, TAKE1,
+ SSL_CMD_SRV(TrustURI, TAKE1,
"SSL CA Certificate uri "
"('file:', 'pkcs11:' - URI of CA certificates)")
SSL_CMD_ALL(CACertificatePath, TAKE1,
SSL_CMD_SRV(CADNRequestFile, TAKE1,
"SSL CA Distinguished Name file "
"('/path/to/file' - PEM encoded to derive acceptable CA names to request)")
- SSL_CMD_SRV(CADNRequestURI, TAKE1,
+ SSL_CMD_SRV(TrustRequestURI, TAKE1,
"SSL CA Distinguished Name uri "
"('file:', 'pkcs11:' - URI of certificates to derive acceptable CA names to request)")
- SSL_CMD_SRV(CARevocationURI, TAKE1,
- "SSL CA Certificate Revocation List (CRL) uri "
- "('file:', 'pkcs11:' - URI of CRLs)")
SSL_CMD_SRV(CARevocationPath, TAKE1,
"SSL CA Certificate Revocation List (CRL) path "
"('/path/to/dir' - contains PEM encoded files)")
SSL_CMD_PXY(ProxyVerifyDepth, TAKE1,
"SSL Proxy: maximum certificate verification depth "
"('N' - number of intermediate certificates)")
- SSL_CMD_PXY(ProxyCACertificateURI, TAKE1,
- "SSL Proxy: uri referring to server certificates "
+ SSL_CMD_PXY(ProxyTrustURI, TAKE1,
+ "SSL Proxy: uri referring to trusted server certificates "
"('file:', 'pkcs11:' - URI of CA certificates)")
SSL_CMD_PXY(ProxyCACertificateFile, TAKE1,
"SSL Proxy: file containing server certificates "
SSL_CMD_PXY(ProxyCACertificatePath, TAKE1,
"SSL Proxy: directory containing server certificates "
"('/path/to/dir' - contains PEM encoded certificates)")
- SSL_CMD_PXY(ProxyCARevocationURI, TAKE1,
- "SSL Proxy: CA Certificate Revocation List (CRL) uri "
- "('file:', 'pkcs11:' - URI of CRLs)")
SSL_CMD_PXY(ProxyCARevocationPath, TAKE1,
"SSL Proxy: CA Certificate Revocation List (CRL) path "
"('/path/to/dir' - contains PEM encoded files)")
"('/path/to/file' - PEM encoded)")
SSL_CMD_PXY(ProxyCARevocationCheck, RAW_ARGS,
"SSL Proxy: CA Certificate Revocation List (CRL) checking mode")
- SSL_CMD_PXY(ProxyMachineCertificateURI, TAKE1,
+ SSL_CMD_PXY(ProxyStoreURI, TAKE1,
"SSL Proxy: uri referring to client certificates "
"('file:', 'pkcs11:' - URI of certificate or key)")
SSL_CMD_PXY(ProxyMachineCertificateFile, TAKE1,
mctx->crl_file = NULL;
mctx->crl_path = NULL;
- mctx->crl_uri = NULL;
mctx->crl_check_mask = UNSET;
- mctx->auth.ca_cert_uri = NULL;
+ mctx->auth.trust_uris = apr_array_make(p, 3, sizeof(char *));;
mctx->auth.ca_cert_path = NULL;
mctx->auth.ca_cert_file = NULL;
mctx->auth.cipher_suite = NULL;
mctx->pks = apr_pcalloc(p, sizeof(*mctx->pks));
mctx->pks->uris = apr_array_make(p, 3, sizeof(char *));
+ mctx->pks->trust_request_uris = apr_array_make(p, 3, sizeof(char *));
mctx->pks->cert_files = apr_array_make(p, 3, sizeof(char *));
mctx->pks->key_files = apr_array_make(p, 3, sizeof(char *));
cfgMerge(crl_file, NULL);
cfgMerge(crl_path, NULL);
- cfgMerge(crl_uri, NULL);
cfgMergeInt(crl_check_mask);
- cfgMergeString(auth.ca_cert_uri);
+ cfgMergeArray(auth.trust_uris);
cfgMergeString(auth.ca_cert_path);
cfgMergeString(auth.ca_cert_file);
cfgMergeString(auth.cipher_suite);
cfgMergeArray(pks->cert_files);
cfgMergeArray(pks->key_files);
- cfgMergeString(pks->ca_name_uri);
+ cfgMergeArray(pks->trust_request_uris);
cfgMergeString(pks->ca_name_path);
cfgMergeString(pks->ca_name_file);
}
-const char *ssl_cmd_SSLCertificateURI(cmd_parms *cmd,
+const char *ssl_cmd_SSLStoreURI(cmd_parms *cmd,
void *dcfg,
const char *arg)
{
#define NO_PER_DIR_SSL_CA \
"Your SSL library does not have support for per-directory CA"
-const char *ssl_cmd_SSLCACertificateURI(cmd_parms *cmd,
+const char *ssl_cmd_SSLTrustURI(cmd_parms *cmd,
void *dcfg,
const char *arg)
{
}
/* XXX: bring back per-dir */
- sc->server->auth.ca_cert_uri = arg;
+ *(const char **)apr_array_push(sc->server->auth.trust_uris) = arg;
return NULL;
}
return NULL;
}
-const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *cmd, void *dcfg,
- const char *arg)
+const char *ssl_cmd_SSLTrustRequestURI(cmd_parms *cmd, void *dcfg,
+ const char *arg)
{
SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
const char *err;
return err;
}
- sc->server->pks->ca_name_uri = arg;
+ *(const char **)apr_array_push(sc->server->pks->trust_request_uris) = arg;
return NULL;
}
return NULL;
}
-const char *ssl_cmd_SSLCARevocationURI(cmd_parms *cmd,
- void *dcfg,
- const char *arg)
-{
- SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
- const char *err;
-
- if ((err = ssl_cmd_check_uri(cmd, arg))) {
- return err;
- }
-
- sc->server->crl_uri = arg;
-
- return NULL;
-}
-
const char *ssl_cmd_SSLCARevocationPath(cmd_parms *cmd,
void *dcfg,
const char *arg)
return NULL;
}
-const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *cmd,
+const char *ssl_cmd_SSLProxyTrustURI(cmd_parms *cmd,
void *dcfg,
const char *arg)
{
return err;
}
- dc->proxy->auth.ca_cert_uri = arg;
+ *(const char **)apr_array_push(dc->proxy->auth.trust_uris) = arg;
return NULL;
}
return NULL;
}
-const char *ssl_cmd_SSLProxyCARevocationURI(cmd_parms *cmd,
- void *dcfg,
- const char *arg)
-{
- SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
- const char *err;
-
- if ((err = ssl_cmd_check_uri(cmd, arg))) {
- return err;
- }
-
- dc->proxy->crl_uri = arg;
-
- return NULL;
-}
-
const char *ssl_cmd_SSLProxyCARevocationPath(cmd_parms *cmd,
void *dcfg,
const char *arg)
return ssl_cmd_crlcheck_parse(cmd, arg, &dc->proxy->crl_check_mask);
}
-const char *ssl_cmd_SSLProxyMachineCertificateURI(cmd_parms *cmd,
- void *dcfg,
- const char *arg)
+const char *ssl_cmd_SSLProxyStoreURI(cmd_parms *cmd,
+ void *dcfg,
+ const char *arg)
{
SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
const char *err;
SSLSrvConfigRec *sc = mySrvConfig(s);
if (sc && sc->server) {
- if (sc->server->auth.ca_cert_uri) {
+
+ int i;
+
+ for (i = 0; (i < sc->server->auth.trust_uris->nelts) &&
+ APR_ARRAY_IDX(sc->server->auth.trust_uris, i, const char *);
+ i++) {
apr_file_printf(out, " %s\n",
- sc->server->auth.ca_cert_uri);
+ APR_ARRAY_IDX(sc->server->auth.trust_uris,
+ i, const char *));
}
if (sc->server->auth.ca_cert_path) {
apr_file_printf(out, " %s\n",
#endif
DMP_VERIFY(proxy? "SSLProxyVerify" : "SSLVerifyClient", auth->verify_mode);
DMP_LONG( proxy? "SSLProxyVerify" : "SSLVerifyDepth", auth->verify_depth);
- DMP_STRING(proxy? "SSLProxyCACertificateURI" : "SSLCACertificateURI", auth->ca_cert_uri);
+ DMP_STRARR(proxy? "SSLProxyTrustURI" : "SSLTrustURI", auth->trust_uris);
DMP_STRING(proxy? "SSLProxyCACertificateFile" : "SSLCACertificateFile", auth->ca_cert_file);
DMP_STRING(proxy? "SSLProxyCACertificatePath" : "SSLCACertificatePath", auth->ca_cert_path);
}
DMP_STRING(proxy? "SSLProxyCARevocationFile" : "SSLCARevocationFile", ctx->crl_file);
DMP_STRING(proxy? "SSLProxyCARevocationPath" : "SSLCARevocationPath", ctx->crl_path);
- DMP_STRING(proxy? "SSLProxyCARevocationURI" : "SSLCARevocationURI", ctx->crl_uri);
DMP_CRLCHK(proxy? "SSLProxyCARevocationCheck" : "SSLCARevocationCheck", ctx->crl_check_mask);
if (!proxy) {
DMP_PHRASE("SSLPassPhraseDialog", ctx->pphrase_dialog_type, ctx->pphrase_dialog_path);
if (ctx->pks) {
- DMP_STRING("SSLCADNRequestURI", ctx->pks->ca_name_uri);
+ DMP_STRARR("SSLTrustRequestURI", ctx->pks->trust_request_uris);
DMP_STRING("SSLCADNRequestFile", ctx->pks->ca_name_file);
DMP_STRING("SSLCADNRequestPath", ctx->pks->ca_name_path);
- DMP_STRARR("SSLCertificateURI", ctx->pks->uris);
+ DMP_STRARR("SSLStoreURI", ctx->pks->uris);
DMP_STRARR("SSLCertificateFile", ctx->pks->cert_files);
DMP_STRARR("SSLCertificateKeyFile", ctx->pks->key_files);
}
}
else { /* proxy */
if (ctx->pkp) {
- DMP_STRARR("SSLProxyMachineCertificateURI", ctx->pkp->uris);
+ DMP_STRARR("SSLProxyStoreURI", ctx->pkp->uris);
DMP_STRING("SSLProxyMachineCertificateFile", ctx->pkp->cert_file);
DMP_STRING("SSLProxyMachineCertificatePath", ctx->pkp->cert_path);
DMP_STRING("SSLProxyMachineCertificateChainFile", ctx->pkp->ca_cert_file);
md5_strarray_hash(ptemp, hash, "key_files:", ctx->pks->key_files);
}
-static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx)
+static void hash_sni_policy_auth(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ctx_t *ctx)
{
modssl_pk_server_t *pks = ctx->pks;
modssl_auth_ctx_t *a = &ctx->auth;
md5_fmt_update(hash, "verify_depth:%d", a->verify_depth);
md5_fmt_update(hash, "verify_mode:%d", a->verify_mode);
- md5_ifstr_update(hash, "ca_name_uri:", pks->ca_name_uri);
+ md5_strarray_hash(ptemp, hash, "trust_request_uris:", pks->trust_request_uris);
md5_ifstr_update(hash, "ca_name_path:", pks->ca_name_path);
md5_ifstr_update(hash, "ca_name_file:", pks->ca_name_file);
- md5_ifstr_update(hash, "ca_cert_uri:", a->ca_cert_uri);
+ md5_strarray_hash(ptemp, hash, "trust_uris:", a->trust_uris);
md5_ifstr_update(hash, "ca_cert_path:", a->ca_cert_path);
md5_ifstr_update(hash, "ca_cert_file:", a->ca_cert_file);
- md5_ifstr_update(hash, "crl_uri:", ctx->crl_uri);
md5_ifstr_update(hash, "crl_path:", ctx->crl_path);
md5_ifstr_update(hash, "crl_file:", ctx->crl_file);
md5_fmt_update(hash, "crl_check_mask:%d", ctx->crl_check_mask);
/* Create the vhost policy hash for comparison later. */
apr_md5_init(&hash);
- hash_sni_policy_auth(&hash, sc->server);
+ hash_sni_policy_auth(ptemp, &hash, sc->server);
if (policy == MODSSL_SNIVH_SECURE)
hash_sni_policy_pk(ptemp, &hash, sc->server);
apr_md5_final(digest, &hash);
break;
}
+ case OSSL_STORE_INFO_CRL: {
+
+ X509_CRL *crl;
+
+ if (!(crl = OSSL_STORE_INFO_get0_CRL(info))) {
+ OSSL_STORE_close(sctx);
+ return APR_EGENERAL;
+ }
+ if (X509_STORE_add_crl(store, crl)) {
+
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(10601)
+ "Host %s: Certificate revocation list from URI: %s",
+ mctx->sc->vhost_id,
+ modssl_X509_NAME_to_string(ptemp,
+ X509_CRL_get_issuer(crl), 0));
+
+ }
+
+ break;
+ }
}
}
*/
if (mctx->auth.ca_cert_file || mctx->auth.ca_cert_path ||
- mctx->auth.ca_cert_uri) {
+ mctx->auth.trust_uris->nelts) {
+ const char *trust_uri;
+
+ int i;
apr_status_t rv;
ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
"Configuring client authentication");
- if ((rv = modssl_CTX_load_verify_store(s, ptemp,
- mctx->auth.ca_cert_uri, 1, mctx)) != APR_SUCCESS) {
- ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10600)
- "Unable to configure verify store "
- "for client authentication");
- ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
- return ssl_die(s);
+ for (i = 0; (i < mctx->auth.trust_uris->nelts) &&
+ (trust_uri = APR_ARRAY_IDX(mctx->auth.trust_uris, i,
+ const char *));
+ i++) {
+
+ if ((rv = modssl_CTX_load_verify_store(s, ptemp,
+ trust_uri, 1, mctx)) != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10600)
+ "Unable to configure verify store "
+ "for client authentication: %s", trust_uri);
+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+ return ssl_die(s);
+ }
+
}
if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file,
}
if (mctx->pks && (mctx->pks->ca_name_file || mctx->pks->ca_name_path ||
- mctx->pks->ca_name_uri)) {
+ mctx->pks->trust_request_uris->nelts)) {
ca_list = ssl_init_FindCAList(s, ptemp,
mctx->pks->ca_name_file,
mctx->pks->ca_name_path,
- mctx->pks->ca_name_uri,
+ mctx->pks->trust_request_uris,
mctx);
} else {
ca_list = ssl_init_FindCAList(s, ptemp,
mctx->auth.ca_cert_file,
mctx->auth.ca_cert_path,
- mctx->auth.ca_cert_uri,
+ mctx->auth.trust_uris,
mctx);
}
return 1;
}
-/*
- * OpenSSL has a X509_STORE_load_store() function, but this
- * function has side effects - it loads both CRLs and trusted
- * CA certificates.
- *
- * An end user reasonably wants to configure a URI pointing at
- * CRLs and not have any surprises if the scope of the URI
- * included trusted CA certificates for whatever reason.
- *
- * As a result we consider CRLs exclusively below.
- */
-
-static APR_INLINE
-apr_status_t modssl_X509_STORE_load_crl(server_rec *s,
- apr_pool_t *ptemp,
- const char *uri,
- int depth,
- modssl_ctx_t *mctx)
-{
-#if MODSSL_HAVE_OPENSSL_STORE
- OSSL_STORE_CTX *sctx;
- OSSL_STORE_INFO *info;
-
- apr_status_t rv = APR_SUCCESS;
-
- X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx);
-
- ap_assert(store != NULL); /* safe to assume always non-NULL? */
-
- if (!uri) {
- return APR_SUCCESS;
- }
-
- if ((!(sctx = OSSL_STORE_open_ex(uri, mctx->libctx, NULL, NULL, NULL,
- NULL, NULL, NULL)))) {
- return APR_EGENERAL;
- }
-
- while (!OSSL_STORE_eof(sctx) && !OSSL_STORE_error(sctx)) {
-
- if (!(info = OSSL_STORE_load(sctx))) {
- continue;
- }
-
- switch(OSSL_STORE_INFO_get_type(info)) {
- case OSSL_STORE_INFO_NAME: {
-
- if (depth > 0) {
- rv = modssl_X509_STORE_load_crl(s, ptemp,
- OSSL_STORE_INFO_get0_NAME(info),
- depth - 1, mctx);
- if (APR_SUCCESS != rv) {
- OSSL_STORE_close(sctx);
- return rv;
- }
- }
-
- break;
- }
- case OSSL_STORE_INFO_CRL: {
-
- X509_CRL *crl;
-
- if (!(crl = OSSL_STORE_INFO_get0_CRL(info))) {
- return APR_EGENERAL;
- }
- if (X509_STORE_add_crl(store, crl)) {
-
- ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(10601)
- "Host %s: Certificate revocation list from URI: %s",
- mctx->sc->vhost_id,
- modssl_X509_NAME_to_string(ptemp,
- X509_CRL_get_issuer(crl), 0));
-
- }
-
- break;
- }
- }
- }
-
- OSSL_STORE_close(sctx);
-
- return rv;
-#else
- if (!uri) {
- return APR_SUCCESS;
- }
-
- return APR_ENOTIMPL;
-#endif
-}
-
static apr_status_t ssl_init_ctx_crl(server_rec *s,
apr_pool_t *p,
apr_pool_t *ptemp,
* Configure Certificate Revocation List (CRL) Details
*/
- if (!(mctx->crl_uri || mctx->crl_file || mctx->crl_path)) {
+ if (!(mctx->auth.trust_uris->nelts || mctx->crl_file || mctx->crl_path)) {
if (crl_check_mode == SSL_CRLCHECK_LEAF ||
crl_check_mode == SSL_CRLCHECK_CHAIN) {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01899)
"Host %s: CRL checking has been enabled, but "
- "neither %sCARevocationURI, %sCARevocationFile nor %sCARevocationPath "
+ "neither %sTrustURI, %sCARevocationFile nor %sCARevocationPath "
"is configured", mctx->sc->vhost_id, cfgp, cfgp, cfgp);
return ssl_die(s);
}
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
"Configuring certificate revocation facility");
- if ((rv = modssl_X509_STORE_load_crl(s, ptemp, mctx->crl_uri, 1, mctx)) != APR_SUCCESS) {
- ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10602)
- "Host %s: unable to configure X.509 CRL uri "
- "for certificate revocation", mctx->sc->vhost_id);
- ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
- return ssl_die(s);
- }
-
if (!modssl_X509_STORE_load_locations(store,
mctx->crl_file, mctx->crl_path)) {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
apr_pool_t *ptemp,
const char *ca_file,
const char *ca_path,
- const char *ca_uri,
+ apr_array_header_t *trust_uris,
modssl_ctx_t *mctx)
{
+ const char *trust_uri;
+ int i;
+
STACK_OF(X509_NAME) *ca_list = sk_X509_NAME_new_null();;
/*
* Process CA certificate store uri
*/
- if (ca_uri &&
- ssl_init_ca_cert_uri(s, ptemp,
- ca_uri, ca_list, 1, mctx) != APR_SUCCESS) {
- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10616)
- "Failed to open Certificate URI `%s'", ca_uri);
- sk_X509_NAME_pop_free(ca_list, X509_NAME_free);
- return NULL;
+
+ for (i = 0; (i < trust_uris->nelts) &&
+ (trust_uri = APR_ARRAY_IDX(trust_uris, i,
+ const char *));
+ i++) {
+
+ if (trust_uris->nelts &&
+ ssl_init_ca_cert_uri(s, ptemp,
+ trust_uri, ca_list, 1, mctx) != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10616)
+ "Failed to open Trust URI `%s'", trust_uri);
+ sk_X509_NAME_pop_free(ca_list, X509_NAME_free);
+ return NULL;
+ }
+
}
/*
/** Certificates which specify the set of CA names which should be
* sent in the CertificateRequest message: */
- const char *ca_name_uri;
+ apr_array_header_t *trust_request_uris;
const char *ca_name_path;
const char *ca_name_file;
/** stuff related to authentication that can also be per-dir */
typedef struct {
/** known/trusted CAs */
- const char *ca_cert_uri;
+ apr_array_header_t *trust_uris;
const char *ca_cert_path;
const char *ca_cert_file;
const char *cert_chain;
/** certificate revocation list */
- const char *crl_uri;
const char *crl_path;
const char *crl_file;
int crl_check_mask;
const char *ssl_cmd_SSLECHKeyDir(cmd_parms *cmd, void *dcfg, const char *arg);
#endif
const char *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *, const char *);
-const char *ssl_cmd_SSLCertificateURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLStoreURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCertificateFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCertificateChainFile(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLCACertificateURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLTrustURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCACertificatePath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCACertificateFile(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLTrustRequestURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCADNRequestPath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCADNRequestFile(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLCARevocationURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCARevocationPath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCARevocationFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCARevocationCheck(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *, const char *);
const char *ssl_cmd_SSLProxyVerify(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLProxyTrustURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCACertificateFile(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLProxyCARevocationURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCARevocationPath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCARevocationFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyCARevocationCheck(cmd_parms *, void *, const char *);
-const char *ssl_cmd_SSLProxyMachineCertificateURI(cmd_parms *, void *, const char *);
+const char *ssl_cmd_SSLProxyStoreURI(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyMachineCertificatePath(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyMachineCertificateFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLProxyMachineCertificateChainFile(cmd_parms *, void *, const char *);
apr_pool_t *ptemp, server_rec *s,
ap_conf_vector_t *section_config);
STACK_OF(X509_NAME)
- *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *, const char *, modssl_ctx_t *);
+ *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *, apr_array_header_t *, modssl_ctx_t *);
void ssl_init_Child(apr_pool_t *, server_rec *);
apr_status_t ssl_init_ModuleKill(void *data);
projects / thirdparty / apache / httpd.git / commitdiff
