mod_ssl

Reference
HowTo

All PCs are compatible. But some of them are more compatible than others.
Unknown

ere we talk about backward compatibility to other SSL solutions. As you perhaps know, mod_ssl is not the only existing SSL solution for Apache. Actually there are four additional major products available on the market: Ben Laurie's freely available Apache-SSL (from where mod_ssl were originally derived in 1998), RedHat's commercial Secure Web Server (which is based on mod_ssl), Covalent's commercial Raven SSL Module (also based on mod_ssl) and finally C2Net's commercial product Stronghold (based on a different evolution branch named Sioux up to Stronghold 2.x and based on mod_ssl since Stronghold 3.x).   
Table Of Contents
        Configuration Directives
        Environment Variables
        Custom Log Functions

The idea in mod_ssl is mainly the following: because mod_ssl provides mostly a superset of the functionality of all other solutions we can easily provide backward compatibility for most of the cases. Actually there are three compatibility areas we currently address: configuration directives, environment variables and custom log functions.

Configuration Directives

For backward compatibility to the configuration directives of other SSL solutions we do an on-the-fly mapping: directives which have a direct counterpart in mod_ssl are mapped silently while other directives lead to a warning message in the logfiles. The currently implemented directive mapping is listed in Table 1. Currently full backward compatibilty is provided only for Apache-SSL 1.x and mod_ssl 2.0.x. Compatibility to Sioux 1.x and Stronghold 2.x is only partial because of special functionality in these interfaces which mod_ssl (still) doesn't provide.

Table 1: Configuration Directive Mapping
Old Directive mod_ssl Directive Comment
Apache-SSL 1.x & mod_ssl 2.0.x compatibility:
SSLEnable SSLEngine on compactified
SSLDisable SSLEngine off compactified
SSLLogFile file SSLLog file compactified
SSLRequiredCiphers spec SSLCipherSuite spec renamed
SSLRequireCipher c1 ... SSLRequire %{SSL_CIPHER} in {"c1", ...} generalized
SSLBanCipher c1 ... SSLRequire not (%{SSL_CIPHER} in {"c1", ...}) generalized
SSLFakeBasicAuth SSLOptions +FakeBasicAuth merged
SSLCacheServerPath dir - functionality removed
SSLCacheServerPort integer - functionality removed
Apache-SSL 1.x compatibility:
SSLExportClientCertificates SSLOptions +ExportCertData merged
SSLCacheServerRunDir dir - functionality not supported
Sioux 1.x compatibility:
SSL_CertFile file SSLCertificateFile file renamed
SSL_KeyFile file SSLCertificateKeyFile file renamed
SSL_CipherSuite arg SSLCipherSuite arg renamed
SSL_X509VerifyDir arg SSLCACertificatePath arg renamed
SSL_Log file SSLLogFile file renamed
SSL_Connect flag SSLEngine flag renamed
SSL_ClientAuth arg SSLVerifyClient arg renamed
SSL_X509VerifyDepth arg SSLVerifyDepth arg renamed
SSL_FetchKeyPhraseFrom arg - not directly mappable; use SSLPassPhraseDialog
SSL_SessionDir dir - not directly mappable; use SSLSessionCache
SSL_Require expr - not directly mappable; use SSLRequire
SSL_CertFileType arg - functionality not supported
SSL_KeyFileType arg - functionality not supported
SSL_X509VerifyPolicy arg - functionality not supported
SSL_LogX509Attributes arg - functionality not supported
Stronghold 2.x compatibility:
StrongholdAccelerator dir - functionality not supported
StrongholdKey dir - functionality not supported
StrongholdLicenseFile dir - functionality not supported
SSLFlag flag SSLEngine flag renamed
SSLSessionLockFile file SSLMutex file renamed
SSLCipherList spec SSLCipherSuite spec renamed
RequireSSL SSLRequireSSL renamed
SSLErrorFile file - functionality not supported
SSLRoot dir - functionality not supported
SSL_CertificateLogDir dir - functionality not supported
AuthCertDir dir - functionality not supported
SSL_Group name - functionality not supported
SSLProxyMachineCertPath dir - functionality not supported
SSLProxyMachineCertFile file - functionality not supported
SSLProxyCACertificatePath dir - functionality not supported
SSLProxyCACertificateFile file - functionality not supported
SSLProxyVerifyDepth number - functionality not supported
SSLProxyCipherList spec - functionality not supported


Environment Variables

When you use ``SSLOptions +CompatEnvVars'' additional environment variables are generated. They all correspond to existing official mod_ssl variables. The currently implemented variable derivation is listed in Table 2.

Table 2: Environment Variable Derivation
Old Variable mod_ssl Variable Comment
SSL_PROTOCOL_VERSION SSL_PROTOCOL renamed
SSLEAY_VERSION SSL_VERSION_LIBRARY renamed
HTTPS_SECRETKEYSIZE SSL_CIPHER_USEKEYSIZE renamed
HTTPS_KEYSIZE SSL_CIPHER_ALGKEYSIZE renamed
HTTPS_CIPHER SSL_CIPHER renamed
HTTPS_EXPORT SSL_CIPHER_EXPORT renamed
SSL_SERVER_KEY_SIZE SSL_CIPHER_ALGKEYSIZE renamed
SSL_SERVER_CERTIFICATE SSL_SERVER_CERT renamed
SSL_SERVER_CERT_START SSL_SERVER_V_START renamed
SSL_SERVER_CERT_END SSL_SERVER_V_END renamed
SSL_SERVER_CERT_SERIAL SSL_SERVER_M_SERIAL renamed
SSL_SERVER_SIGNATURE_ALGORITHM SSL_SERVER_A_SIG renamed
SSL_SERVER_DN SSL_SERVER_S_DN renamed
SSL_SERVER_CN SSL_SERVER_S_DN_CN renamed
SSL_SERVER_EMAIL SSL_SERVER_S_DN_Email renamed
SSL_SERVER_O SSL_SERVER_S_DN_O renamed
SSL_SERVER_OU SSL_SERVER_S_DN_OU renamed
SSL_SERVER_C SSL_SERVER_S_DN_C renamed
SSL_SERVER_SP SSL_SERVER_S_DN_SP renamed
SSL_SERVER_L SSL_SERVER_S_DN_L renamed
SSL_SERVER_IDN SSL_SERVER_I_DN renamed
SSL_SERVER_ICN SSL_SERVER_I_DN_CN renamed
SSL_SERVER_IEMAIL SSL_SERVER_I_DN_Email renamed
SSL_SERVER_IO SSL_SERVER_I_DN_O renamed
SSL_SERVER_IOU SSL_SERVER_I_DN_OU renamed
SSL_SERVER_IC SSL_SERVER_I_DN_C renamed
SSL_SERVER_ISP SSL_SERVER_I_DN_SP renamed
SSL_SERVER_IL SSL_SERVER_I_DN_L renamed
SSL_CLIENT_CERTIFICATE SSL_CLIENT_CERT renamed
SSL_CLIENT_CERT_START SSL_CLIENT_V_START renamed
SSL_CLIENT_CERT_END SSL_CLIENT_V_END renamed
SSL_CLIENT_CERT_SERIAL SSL_CLIENT_M_SERIAL renamed
SSL_CLIENT_SIGNATURE_ALGORITHM SSL_CLIENT_A_SIG renamed
SSL_CLIENT_DN SSL_CLIENT_S_DN renamed
SSL_CLIENT_CN SSL_CLIENT_S_DN_CN renamed
SSL_CLIENT_EMAIL SSL_CLIENT_S_DN_Email renamed
SSL_CLIENT_O SSL_CLIENT_S_DN_O renamed
SSL_CLIENT_OU SSL_CLIENT_S_DN_OU renamed
SSL_CLIENT_C SSL_CLIENT_S_DN_C renamed
SSL_CLIENT_SP SSL_CLIENT_S_DN_SP renamed
SSL_CLIENT_L SSL_CLIENT_S_DN_L renamed
SSL_CLIENT_IDN SSL_CLIENT_I_DN renamed
SSL_CLIENT_ICN SSL_CLIENT_I_DN_CN renamed
SSL_CLIENT_IEMAIL SSL_CLIENT_I_DN_Email renamed
SSL_CLIENT_IO SSL_CLIENT_I_DN_O renamed
SSL_CLIENT_IOU SSL_CLIENT_I_DN_OU renamed
SSL_CLIENT_IC SSL_CLIENT_I_DN_C renamed
SSL_CLIENT_ISP SSL_CLIENT_I_DN_SP renamed
SSL_CLIENT_IL SSL_CLIENT_I_DN_L renamed
SSL_EXPORT SSL_CIPHER_EXPORT renamed
SSL_KEYSIZE SSL_CIPHER_ALGKEYSIZE renamed
SSL_SECKEYSIZE SSL_CIPHER_USEKEYSIZE renamed
SSL_SSLEAY_VERSION SSL_VERSION_LIBRARY renamed
SSL_STRONG_CRYPTO - Not supported by mod_ssl
SSL_SERVER_KEY_EXP - Not supported by mod_ssl
SSL_SERVER_KEY_ALGORITHM - Not supported by mod_ssl
SSL_SERVER_KEY_SIZE - Not supported by mod_ssl
SSL_SERVER_SESSIONDIR - Not supported by mod_ssl
SSL_SERVER_CERTIFICATELOGDIR - Not supported by mod_ssl
SSL_SERVER_CERTFILE - Not supported by mod_ssl
SSL_SERVER_KEYFILE - Not supported by mod_ssl
SSL_SERVER_KEYFILETYPE - Not supported by mod_ssl
SSL_CLIENT_KEY_EXP - Not supported by mod_ssl
SSL_CLIENT_KEY_ALGORITHM - Not supported by mod_ssl
SSL_CLIENT_KEY_SIZE - Not supported by mod_ssl


Custom Log Functions

When mod_ssl is built into Apache or at least loaded (under DSO situation) additional functions exist for the Custom Log Format of mod_log_config as documented in the Reference Chapter. Beside the ``%{varname}x'' eXtension format function which can be used to expand any variables provided by any module, an additional Cryptography ``%{name}c'' cryptography format function exists for backward compatibility. The currently implemented function calls are listed in Table 3.

Table 3: Custom Log Cryptography Function
Function Call Description
%...{version}c SSL protocol version
%...{cipher}c SSL cipher
%...{subjectdn}c Client Certificate Subject Distinguished Name
%...{issuerdn}c Client Certificate Issuer Distinguished Name
%...{errcode}c Certificate Verification Error (numerical)
%...{errstr}c Certificate Verification Error (string)



Reference
HowTo
mod_ssl 2.8, User Manual
The Apache Interface to OpenSSL		 Copyright © 1998-2001 Ralf S. Engelschall
All Rights Reserved