0N/A This Apache module provides strong cryptography for the Apache 2.0 webserver
0N/A via the Secure Sockets Layer (SSL
v2/v3) and Transport Layer Security (TLS
0N/A v1) protocols by the help of the
SSL/TLS implementation library OpenSSL which
0N/A is based on SSLeay from Eric A. Young and Tim J. Hudson.
0N/A The mod_ssl package was created in April 1998 by Ralf S. Engelschall
0N/A and was originally derived from software developed by Ben Laurie for
0N/A use in the Apache-SSL HTTP server project. The mod_ssl implementation
0N/A for Apache 1.3 continues to be supported by the modssl project
0N/A See the top-level LAYOUT file in httpd-2.0 for file descriptions.
0N/A The source files are written in clean ANSI C and pass the ``gcc -O -g
0N/A -ggdb3 -Wall -Wshadow -Wpointer-arith -Wcast-align -Wmissing-prototypes
0N/A -Wmissing-declarations -Wnested-externs -Winline'' compiler test
0N/A (assuming `gcc' is GCC 2.95.2 or newer) without any complains. When
0N/A you make changes or additions make sure the source still passes this
0N/A Inside the source code you will be confronted with the following types of
0N/A functions which can be identified by their prefixes:
0N/A ap_xxxx() ............... Apache API function
0N/A ssl_xxxx() .............. mod_ssl function
0N/A SSL_xxxx() .............. OpenSSL function (SSL library)
0N/A OpenSSL_xxxx() .......... OpenSSL function (SSL library)
597N/A X509_xxxx() ............. OpenSSL function (Crypto library)
0N/A PEM_xxxx() .............. OpenSSL function (Crypto library)
0N/A EVP_xxxx() .............. OpenSSL function (Crypto library)
0N/A RSA_xxxx() .............. OpenSSL function (Crypto library)
0N/A Inside the source code you will be confronted with the following
0N/A server_rec .............. Apache (Virtual) Server
0N/A conn_rec ................ Apache Connection
0N/A request_rec ............. Apache Request
0N/A SSLModConfig ............ mod_ssl (Global) Module Configuration
0N/A SSLSrvConfig ............ mod_ssl (Virtual) Server Configuration
0N/A SSLDirConfig ............ mod_ssl Directory Configuration
0N/A SSLConnConfig ........... mod_ssl Connection Configuration
0N/A SSLFilterRec ............ mod_ssl Filter Context
0N/A SSL_CTX ................. OpenSSL Context
0N/A SSL_METHOD .............. OpenSSL Protocol Method
0N/A SSL_CIPHER .............. OpenSSL Cipher
0N/A SSL_SESSION ............. OpenSSL Session
597N/A SSL ..................... OpenSSL Connection
597N/A BIO ..................... OpenSSL Connection Buffer
0N/A For an overview how these are related and chained together have a look at the
0N/A structures. It's designed for DIN A4 paper size, but you can easily generate
0N/A a smaller version inside XFig by specifing a magnification on the Export
0N/A Experimental code is always encapsulated as following:
0N/A | #ifdef SSL_EXPERIMENTAL_xxxx
0N/A This way it is only compiled in when this define is enabled with
597N/A the APACI --enable-rule=SSL_EXPERIMENTAL option and as long as the
597N/A C pre-processor variable SSL_EXPERIMENTAL_xxxx_IGNORE is _NOT_
0N/A defined (via CFLAGS). Or in other words: SSL_EXPERIMENTAL enables all
0N/A SSL_EXPERIMENTAL_xxxx variables, except if SSL_EXPERIMENTAL_xxxx_IGNORE
0N/A is already defined. Currently the following features are experimental:
0N/A o SSL_EXPERIMENTAL_ENGINE
0N/A The ability to support the new forthcoming OpenSSL ENGINE stuff.
0N/A Until this development branch of OpenSSL is merged into the main
0N/A mod_ssl automatically recognizes this OpenSSL variant and then can
0N/A activate external crypto devices through SSLCryptoDevice directive.
0N/A The following intentional incompatibilities exist between mod_ssl
2.x 0N/A from Apache 1.3 and this mod_ssl version for Apache 2.0:
0N/A o The complete EAPI-based SSL_VENDOR stuff was removed.
597N/A o The complete EAPI-based SSL_COMPAT stuff was removed.
597N/A o The <IfDefine> variable MOD_SSL is no longer provided automatically
597N/A The following major changes were made between mod_ssl
2.x 597N/A from Apache 1.3 and this mod_ssl version for Apache 2.0:
597N/A o The DBM based session cache is now based on APR's DBM API only.
597N/A o The shared memory based session cache is now based on APR's APIs.
597N/A o SSL I/O is now implemented in terms of filters rather than BUFF
597N/A o Eliminated ap_global_ctx. Storing Persistant information in
597N/A process_rec->pool->user_data. The ssl_pphrase_Handle_CB() and
597N/A ssl_config_global_* () functions have an extra parameter now -
597N/A "server_rec *" - which is used to retrieve the SSLModConfigRec.
597N/A o Properly support restarts, allowing mod_ssl to be added to a server
597N/A o Various performance enhancements
597N/A o proxy support is no longer an "extension", much of the mod_ssl core
597N/A was re-written (ssl_engine_{init,kernel,config}.c) to be generic so
597N/A it could be re-used in proxy mode.
0N/A - the optional function ssl_proxy_enable is provide for mod_proxy
0N/A to enable proxy support
0N/A - proxy support now requires 'SSLProxyEngine on' to be configured
0N/A - proxy now supports SSLProxyCARevocation{Path,File} in addition to
0N/A the original SSLProxy* directives
0N/A o per-directory SSLCACertificate{File,Path} is now thread-safe but
0N/A requires SSL_set_cert_store patch to OpenSSL
0N/A o the ssl_engine_{ds,ext}.c source files are obsolete and no longer
0N/A See the top-level STATUS file in httpd-2.0 for current efforts and goals.