##                      _             _ 
##  _ __ ___   ___   __| |    ___ ___| |  
## | '_ ` _ \ / _ \ / _` |   / __/ __| |  
## | | | | | | (_) | (_| |   \__ \__ \ | mod_ssl - Apache Interface to SSLeay  
## |_| |_| |_|\___/ \__,_|___|___/___/_| http://www.engelschall.com/sw/mod_ssl/
##                      |_____|         
## ____________________________________________________________________________
##
## apache.patch -- Annotated Apache SSL Patches
## Copyright (c) 1998 Ralf S. Engelschall, All Rights Reserved. 
## Created on: 09-Sep-1998
##
## This file assembles all changes to existing Apache source files between the
## original Apache and the SSL-patched variant. It can be automatically applied
## to a vanilla Apache source tree with the 'patch' tool to upgrade those files
## to be SSL-aware. Each patch snippet is annotated with a short description.
##

#  Now first we have to patch APACI's configuration script to make sure
#  mod_ssl is not implicitly configured as a DSO (which doesn't work) on
#  --enable-shared options. Additionally a flag is passed to Makefile.tmpl
#  which indicated whether mod_ssl is activated or not and support for the
#  SSL_BASE variable is added. Finally we also provide adjustments of
#  the HTTPS port (443) similar to the HTTP port (80).

Index: configure
===================================================================
*** configure	1998/07/21 18:46:16	1.1.1.2
--- configure	1998/09/16 11:41:51	1.7
***************
*** 173,178 ****
--- 173,181 ----
  suexec_gidmin=100
  suexec_safepath="/usr/local/bin:/usr/bin:/bin"
  
+ #   ssl defaults
+ ssl=0
+ 
  #   with support tools
  support=1
  
***************
*** 254,260 ****
  echo "##" >>$configstatus
  echo "" >>$configstatus
  for var in CC OPTIM CFLAGS CFLAGS_SHLIB LDFLAGS LD_SHLIB LDFLAGS_SHLIB \
!            LDFLAGS_SHLIB_EXPORT LIBS INCLUDES RANLIB; do
      eval "val=\"\$$var\""
      if [ ".$val" != . ]; then
          echo "$var=$val" |\
--- 257,263 ----
  echo "##" >>$configstatus
  echo "" >>$configstatus
  for var in CC OPTIM CFLAGS CFLAGS_SHLIB LDFLAGS LD_SHLIB LDFLAGS_SHLIB \
!            LDFLAGS_SHLIB_EXPORT LIBS INCLUDES RANLIB SSL_BASE RSA_BASE; do
      eval "val=\"\$$var\""
      if [ ".$val" != . ]; then
          echo "$var=$val" |\
***************
*** 580,586 ****
                                 eval "shared_${module}=yes" 
                             done
                             IFS="$OIFS"
!                            shared_so=no        # because of bootstrapping
                             ;;
                         remain ) 
                             OIFS="$IFS" IFS=':'
--- 583,592 ----
                                 eval "shared_${module}=yes" 
                             done
                             IFS="$OIFS"
!                            shared_so=no         # because of bootstrapping
!                            shared_ssl=no        # only static per design
!                            shared_proxy=no      # SSL-awareness forces this
!                            shared_log_config=no # SSL-awareness forces this
                             ;;
                         remain ) 
                             OIFS="$IFS" IFS=':'
***************
*** 593,598 ****
--- 599,607 ----
                             done
                             IFS="$OIFS"
                             shared_so=no
+                            shared_ssl=no        # only static per design
+                            shared_proxy=no      # SSL-awareness forces this
+                            shared_log_config=no # SSL-awareness forces this
                             ;;
                         * ) 
                             eval "exists=\$module_${apc_optarg}" 
***************
*** 737,742 ****
--- 746,778 ----
          echo " + Perhaps you have to select one with --with-perl=FILE."
      fi
  fi
+ if [ ".$module_ssl" = .yes ]; then
+     if [ .$quiet = .no ]; then
+         if [ ".$module_proxy" = .yes ]; then
+             if [ ".$shared_proxy" = .yes ]; then
+                 echo " + Warning: You enabled SSL in conjunction with DSO support for mod_proxy."
+                 echo " +          This doesn't work on all platforms. The chance is high that on"
+                 echo " +          your platform the mod_proxy DSO will fail to build and/or load."
+                 echo " +          We strongly recommend you to build mod_proxy statically!"
+             fi
+         fi
+         if [ ".$module_log_config" = .yes ]; then
+             if [ ".$shared_log_config" = .yes ]; then
+                 echo " + Warning: You enabled SSL in conjunction with DSO support for mod_log_config."
+                 echo " +          This doesn't work on all platforms. The chance is high that on"
+                 echo " +          your platform the mod_log_config DSO will fail to build and/or load."
+                 echo " +          We strongly recommend you to build mod_log_config statically!"
+             fi
+         fi
+     fi
+ fi
+ 
+ ##
+ ##  SSL support
+ ##
+ if [ ".$module_ssl" = .yes ]; then
+     ssl=1
+ fi
  
  ##
  ##  expand path variables and make sure
***************
*** 786,791 ****
--- 822,828 ----
  ##
  conf_group="#-1"
  conf_port="80"
+ conf_port_ssl="443"
  conf_serveradmin="you@your.address"
  conf_servername="new.host.name"
  if [ ".$confadjust" = .1 ]; then
***************
*** 797,802 ****
--- 834,840 ----
      fi
      if [ ".`id | grep root`" = . ]; then
          conf_port="8080"
+         conf_port_ssl="8443"
      fi
      username="$LOGNAME"
      if [ ".$username" = . ]; then
***************
*** 919,926 ****
--- 957,966 ----
  -e "s%@suexec_uidmin@%$suexec_uidmin%g" \
  -e "s%@suexec_gidmin@%$suexec_gidmin%g" \
  -e "s%@suexec_safepath@%$suexec_safepath%g" \
+ -e "s%@ssl@%$ssl%g" \
  -e "s%@conf_group@%$conf_group%g" \
  -e "s%@conf_port@%$conf_port%g" \
+ -e "s%@conf_port_ssl@%$conf_port_ssl%g" \
  -e "s%@conf_serveradmin@%$conf_serveradmin%g" \
  -e "s%@conf_servername@%$conf_servername%g" \
  -e "s%@build_support@%$build_support%g" \
***************
*** 963,969 ****
  #   generate settings from imported environment variables
  OIFS="$IFS" IFS="$DIFS"
  for var in CC OPTIM CFLAGS CFLAGS_SHLIB LDFLAGS LD_SHLIB LDFLAGS_SHLIB \
!            LDFLAGS_SHLIB_EXPORT LIBS INCLUDES RANLIB DEPS; do
      eval "val=\"\$$var\"";
      if [ ".$val" != . ]; then
          case $var in 
--- 1003,1009 ----
  #   generate settings from imported environment variables
  OIFS="$IFS" IFS="$DIFS"
  for var in CC OPTIM CFLAGS CFLAGS_SHLIB LDFLAGS LD_SHLIB LDFLAGS_SHLIB \
!            LDFLAGS_SHLIB_EXPORT LIBS INCLUDES RANLIB DEPS SSL_BASE RSA_BASE; do
      eval "val=\"\$$var\"";
      if [ ".$val" != . ]; then
          case $var in 

#  Now we incorporate support for the `make certificate' procedure and
#  second support for the `make install' procedure where the configuration
#  now is also adjusted for SSL directives and SSL certs and support programs
#  are now additionally installed.

Index: Makefile.tmpl
===================================================================
*** Makefile.tmpl	1998/07/21 18:46:13	1.1.1.2
--- Makefile.tmpl	1998/09/17 11:01:15	1.19
***************
*** 118,126 ****
--- 118,130 ----
  suexec_gidmin   = @suexec_gidmin@
  suexec_safepath = @suexec_safepath@
  
+ #  SSL (optional)
+ ssl = @ssl@
+ 
  #   some substituted configuration parameters
  conf_group       = @conf_group@
  conf_port        = @conf_port@
+ conf_port_ssl    = @conf_port_ssl@
  conf_serveradmin = @conf_serveradmin@
  conf_servername  = @conf_servername@
  
***************
*** 130,135 ****
--- 134,144 ----
  clean-support     = @clean_support@
  distclean-support = @distclean_support@
  
+ #   `make certificate' parameters
+ TYPE = test
+ CRT  =
+ KEY  =
+ 
  #   forwarding arguments
  MFWD = root=$(root)
  
***************
*** 147,153 ****
  #   build the package
  build:
  	@echo "===> $(SRC)"
! 	@$(MAKE) -f $(MKF) $(MFLAGS) $(MFWD) build-std $(build-support)
  	@touch $(TOP)/$(SRC)/.apaci.build.ok
  	@echo "<=== $(SRC)"
  
--- 156,162 ----
  #   build the package
  build:
  	@echo "===> $(SRC)"
! 	@$(MAKE) -f $(MKF) $(MFLAGS) $(MFWD) build-std $(build-support) build-certificate
  	@touch $(TOP)/$(SRC)/.apaci.build.ok
  	@echo "<=== $(SRC)"
  
***************
*** 174,179 ****
--- 183,221 ----
  	fi; \
  	echo "<=== $(SRC)/support"
  
+ #   SSL certificate generation
+ build-certificate:
+ 	-@if [ ".$(ssl)" = .1 ]; then \
+ 		if [ ".`grep '(SKIPME)' $(TOP)/conf/ssl.crt/server.crt`" != . ]; then \
+ 			if [ ".$(QUIET)" != .1 ]; then \
+ 				echo "+---------------------------------------------------------------------+"; \
+ 				echo "| Before you install the package you now should prepare the SSL       |"; \
+ 				echo "| certificate system by running the 'make certificate' command.       |"; \
+ 				echo "| For different situations the following variants are provided:       |"; \
+ 				echo "|                                                                     |"; \
+ 				echo "| % make certificate TYPE=dummy    (dummy self-signed Snake Oil cert) |"; \
+ 				echo "| % make certificate TYPE=test     (test cert signed by Snake Oil CA) |"; \
+ 				echo "| % make certificate TYPE=custom   (custom cert signed by own CA)     |"; \
+ 				echo "| % make certificate TYPE=existing (existing cert)                    |"; \
+ 				echo "|        CRT=/path/to/your.crt [KEY=/path/to/your.key]                |"; \
+ 				echo "|                                                                     |"; \
+ 				echo "| Use TYPE=dummy    when you're a vendor package maintainer,          |"; \
+ 				echo "| the TYPE=test     when you're an admin but want to do tests only,   |"; \
+ 				echo "| the TYPE=custom   when you're an admin willing to run a real server |"; \
+ 				echo "| and TYPE=existing when you're an admin who upgrades it's server.    |"; \
+ 				echo "| (The default is TYPE=test)                                          |"; \
+ 				echo "|                                                                     |"; \
+ 				echo "| Thanks for using Apache & mod_ssl.       Ralf S. Engelschall        |"; \
+ 				echo "|                                          rse@engelschall.com        |"; \
+ 				echo "|                                          www.engelschall.com        |"; \
+ 				echo "+---------------------------------------------------------------------+"; \
+ 			fi \
+ 		fi \
+ 	fi
+ 
+ certificate:
+ 	@cd $(TOP)/$(SRC); $(MAKE) $(MFLAGS) certificate TYPE=$(TYPE) CRT=$(CRT) KEY=$(KEY)
+ 
  ## ------------------------------------------------------------------
  ##                       Installation Targets
  ## ------------------------------------------------------------------
***************
*** 206,211 ****
--- 248,257 ----
  		echo "|                                                        |"; \
  		echo "|   $(sbindir)/apachectl start"; \
  		echo "|                                                        |"; \
+ 		echo "| Or when you want to run it with SSL enabled use:       |"; \
+ 		echo "|                                                        |"; \
+ 		echo "|   $(sbindir)/apachectl startssl"; \
+ 		echo "|                                                        |"; \
  		echo "| Thanks for using Apache.       The Apache Group        |"; \
  		echo "|                                http://www.apache.org/  |"; \
  		echo "+--------------------------------------------------------+"; \
***************
*** 224,229 ****
--- 270,278 ----
  	$(MKDIR) $(root)$(mandir)/man1
  	$(MKDIR) $(root)$(mandir)/man8
  	$(MKDIR) $(root)$(sysconfdir)
+ 	$(MKDIR) $(root)$(sysconfdir)/ssl.crt
+ 	$(MKDIR) $(root)$(sysconfdir)/ssl.csr
+ 	$(MKDIR) $(root)$(sysconfdir)/ssl.key
  	$(MKDIR) $(root)$(datadir)/htdocs
  	$(MKDIR) $(root)$(datadir)/icons
  	$(MKDIR) $(root)$(datadir)/cgi-bin
***************
*** 374,379 ****
--- 423,434 ----
  		 echo ""; \
  		 cat $(TOP)/conf/$${conf}-dist ) |\
  		 sed -e '/# LoadModule/r $(TOP)/$(SRC)/.apaci.install.conf' \
+ 			-e 's;logs/ssl_mutex;$(runtimedir)/ssl_mutex;' \
+ 			-e 's;logs/ssl_scache;$(runtimedir)/ssl_scache;' \
+ 			-e 's;logs/ssl_engine_log;$(logfiledir)/ssl_engine_log;' \
+ 			-e 's;logs/ssl_request_log;$(logfiledir)/ssl_request_log;' \
+ 			-e 's;@@ServerRoot@@/conf/ssl.crt;$(sysconfdir)/ssl.crt;' \
+ 			-e 's;@@ServerRoot@@/conf/ssl.key;$(sysconfdir)/ssl.key;' \
  			-e 's;@@ServerRoot@@/htdocs;$(datadir)/htdocs;' \
  			-e 's;@@ServerRoot@@/htdocs;$(datadir)/htdocs;' \
  			-e 's;@@ServerRoot@@/icons;$(datadir)/icons;' \
***************
*** 391,398 ****
--- 446,456 ----
  			-e 's;conf/mime.types;$(sysconfdir)/mime.types;' \
  			-e 's;Group #-1;Group $(conf_group);' \
  			-e 's;Port 80;Port $(conf_port);' \
+ 			-e 's;Listen 80;Listen $(conf_port);' \
+ 			-e 's;Listen 443;Listen $(conf_port_ssl);' \
  			-e 's;ServerAdmin you@your.address;ServerAdmin $(conf_serveradmin);' \
  			-e 's;ServerName new.host.name;ServerName $(conf_servername);' \
+ 			-e 's;VirtualHost _default_:443;VirtualHost _default_:$(conf_port_ssl);' \
          	> $(TOP)/$(SRC)/.apaci.install.tmp && \
  		echo "$(INSTALL_DATA) $(TOP)/conf/$${conf}-dist[*] $(root)$(sysconfdir)/$${conf}.default"; \
  		$(INSTALL_DATA) $(TOP)/$(SRC)/.apaci.install.tmp $(root)$(sysconfdir)/$${conf}.default; \
***************
*** 413,418 ****
--- 471,519 ----
  			echo "[PRESERVING EXISTING CONFIG FILE: $(root)$(sysconfdir)/$${conf}]"; \
  		fi; \
  	done
+ 	-@if [ ".$(ssl)" = .1 ]; then \
+ 		echo "chmod 755 $(root)$(sysconfdir)/ssl.crt"; \
+ 		chmod 755 $(root)$(sysconfdir)/ssl.crt; \
+ 		echo "chmod 755 $(root)$(sysconfdir)/ssl.csr"; \
+ 		chmod 755 $(root)$(sysconfdir)/ssl.csr; \
+ 		echo "chmod 700 $(root)$(sysconfdir)/ssl.key"; \
+ 		chmod 700 $(root)$(sysconfdir)/ssl.key; \
+ 		if [ ! -f "$(root)$(sysconfdir)/ssl.crt/README.CRT" ]; then \
+ 			echo "$(INSTALL_DATA) $(TOP)/conf/ssl.crt/README.CRT $(root)$(sysconfdir)/ssl.crt/README.CRT"; \
+ 			$(INSTALL) $(TOP)/conf/ssl.crt/README.CRT $(root)$(sysconfdir)/ssl.crt/README.CRT; \
+ 			echo "$(INSTALL_DATA) $(TOP)/conf/ssl.crt/Makefile $(root)$(sysconfdir)/ssl.crt/Makefile"; \
+ 			$(INSTALL) $(TOP)/conf/ssl.crt/Makefile $(root)$(sysconfdir)/ssl.crt/Makefile; \
+ 			echo "$(INSTALL_DATA) -m 400 $(TOP)/conf/ssl.crt/ca-bundle.crt $(root)$(sysconfdir)/ssl.crt/ca-bundle.crt"; \
+ 			$(INSTALL) -m 400 $(TOP)/conf/ssl.crt/ca-bundle.crt $(root)$(sysconfdir)/ssl.crt/ca-bundle.crt; \
+ 			echo "$(INSTALL_DATA) -m 400 $(TOP)/conf/ssl.crt/snakeoil.crt $(root)$(sysconfdir)/ssl.crt/snakeoil.crt"; \
+ 			$(INSTALL) -m 400 $(TOP)/conf/ssl.crt/snakeoil.crt $(root)$(sysconfdir)/ssl.crt/snakeoil.crt; \
+ 			echo "$(INSTALL_DATA) -m 400 $(TOP)/conf/ssl.crt/server.crt $(root)$(sysconfdir)/ssl.crt/server.crt"; \
+ 			$(INSTALL) -m 400 $(TOP)/conf/ssl.crt/server.crt $(root)$(sysconfdir)/ssl.crt/server.crt; \
+ 		else \
+ 			echo "[PRESERVING EXISTING CERTIFICATE FILES: $(root)$(sysconfdir)/ssl.crt/*]"; \
+ 		fi; \
+ 		echo "Updating hash symlinks in $(root)$(sysconfdir)/ssl.crt/:"; \
+ 		SSL_PROGRAM="`grep '^SSL_PROGRAM=' $(TOP)/$(SRC)/Makefile.config | sed -e 's:^.*=::'`"; \
+ 		(cd $(root)$(sysconfdir)/ssl.crt/ && $(MAKE) $(MFLAGS) SSLEAY=$$SSL_PROGRAM); \
+ 		if [ ! -f "$(root)$(sysconfdir)/ssl.csr/README.CSR" ]; then \
+ 			echo "$(INSTALL_DATA) $(TOP)/conf/ssl.csr/README.CSR $(root)$(sysconfdir)/ssl.csr/README.CSR"; \
+ 			$(INSTALL) $(TOP)/conf/ssl.csr/README.CSR $(root)$(sysconfdir)/ssl.csr/README.CSR; \
+ 			echo "$(INSTALL_DATA) -m 400 $(TOP)/conf/ssl.csr/server.csr $(root)$(sysconfdir)/ssl.csr/server.csr"; \
+ 			$(INSTALL) -m 400 $(TOP)/conf/ssl.csr/server.csr $(root)$(sysconfdir)/ssl.csr/server.csr; \
+ 		else \
+ 			echo "[PRESERVING EXISTING CSR FILES: $(root)$(sysconfdir)/ssl.csr/*]"; \
+ 		fi; \
+ 		if [ ! -f "$(root)$(sysconfdir)/ssl.key/README.KEY" ]; then \
+ 			echo "$(INSTALL_DATA) $(TOP)/conf/ssl.key/README.KEY $(root)$(sysconfdir)/ssl.key/README.KEY"; \
+ 			$(INSTALL) $(TOP)/conf/ssl.key/README.KEY $(root)$(sysconfdir)/ssl.key/README.KEY; \
+ 			echo "$(INSTALL_DATA) -m 400 $(TOP)/conf/ssl.key/snakeoil.key $(root)$(sysconfdir)/ssl.key/snakeoil.key"; \
+ 			$(INSTALL) -m 400 $(TOP)/conf/ssl.key/snakeoil.key $(root)$(sysconfdir)/ssl.key/snakeoil.key; \
+ 			echo "$(INSTALL_DATA) -m 400 $(TOP)/conf/ssl.key/server.key $(root)$(sysconfdir)/ssl.key/server.key"; \
+ 			$(INSTALL) -m 400 $(TOP)/conf/ssl.key/server.key $(root)$(sysconfdir)/ssl.key/server.key; \
+ 		else \
+ 			echo "[PRESERVING EXISTING KEY FILES: $(root)$(sysconfdir)/ssl.key/*]"; \
+ 		fi; \
+ 	fi
  	@echo "<=== [config]"
  
  

#  Now we just add the SSL_BASE variable and the AddModule entry for mod_ssl
#  (libssl.a). This way an SSL-aware Apache can still be built with the old
#  Apache 1.2 configuration procedure.

Index: src/Configuration.tmpl
===================================================================
*** src/Configuration.tmpl	1998/07/21 18:46:20	1.1.1.2
--- src/Configuration.tmpl	1998/09/10 11:29:08	1.5
***************
*** 26,31 ****
--- 26,52 ----
  # not enabled).  The AddModule directive can be used to enable such a
  # module.  By default no such modules are defined.
  
+ ################################################################
+ # SSL support:
+ #
+ # o Set SSL_BASE to either the directory of your SSLeay 
+ #   source tree or the installation tree. Alternatively you can
+ #   also use the value 'SYSTEM' which then indicates that SSLeay
+ #   is installed under various system locations.
+ #
+ # o If you're a US-citizen you have to compile SSLeay with the
+ #   RSAref library (which replaces the RSA code of SSLeay)
+ #   because of patent legalities with the RSA algorithm used for
+ #   the SSL protocol. For this situation you already have to
+ #   compile SSLeay with the -DRSAref define and now you have to
+ #   force Apache to link against the RSAglue library (from
+ #   SSLeay) and the rsaref library (from RSA). So, set RSA_BASE
+ #   to the directory of your RSAref source tree or to 'SYSTEM'
+ #   (indicating that librsaref.a is installed under a system
+ #   location)
+ 
+ #SSL_BASE=/usr/local/ssl
+ #RSA_BASE=/usr/local/rsa
  
  ################################################################
  # Makefile configuration
***************
*** 378,381 ****
--- 399,408 ----
  ## should be the last (highest priority) module.
  
  AddModule modules/standard/mod_setenvif.o
+ 
+ ## mod_ssl incorporates SSL into Apache.
+ ## It must stay last here to be first in execution to 
+ ## fake basic authorization.
+ 
+ # AddModule modules/ssl/libssl.a
  

#  Now we add the `certificate' Make target which can be used to
#  create a self-signed dummy server certificate for testing.

Index: src/Makefile.tmpl
===================================================================
*** src/Makefile.tmpl	1998/07/21 18:46:22	1.1.1.2
--- src/Makefile.tmpl	1998/09/16 11:14:56	1.6
***************
*** 11,16 ****
--- 11,20 ----
    $(OSDIR)/libos.a \
    ap/libap.a
  
+ TYPE=test
+ CRT=
+ KEY=
+ 
  .c.o:
  	$(CC) -c $(INCLUDES) $(CFLAGS) $<
  
***************
*** 50,55 ****
--- 54,63 ----
  		    ln libhttpd.so libhttpd.so.$$suffix; \
  		done; \
  	fi
+ 
+ certificate:   
+ 	@./support/mkcert.sh "$(SSL_PROGRAM)" "$(TYPE)" "$(CRT)" "$(KEY)"
+ 	@cd ../conf/ssl.crt; $(MAKE) SSLEAY=$(SSL_PROGRAM) >/dev/null 2>&1
  
  subdirs:
  	@for i in $(SUBDIRS); do \

#  Now we have to add additional structure variables which
#  hold the SSL context information under run-time.

Index: src/include/buff.h
===================================================================
*** src/include/buff.h	1998/07/21 18:46:42	1.1.1.2
--- src/include/buff.h	1998/09/16 11:43:16	1.3
***************
*** 68,73 ****
--- 68,78 ----
  
  #include <stdarg.h>
  
+ #ifdef MOD_SSL
+ #include <stdio.h>
+ #include <ssl.h>
+ #endif /* MOD_SSL */
+ 
  /* Reading is buffered */
  #define B_RD     (1)
  /* Writing is buffered */
***************
*** 123,128 ****
--- 128,140 ----
  
      /* transport handle, for RPC binding handle or some such */
      void *t_handle;
+ 
+ #ifdef MOD_SSL
+     /* Add some context for SSL */
+     SSL *ssl;
+     char *szClientX509;
+     int nVerifyError;
+ #endif /* MOD_SSL */
  
  #ifdef B_SFIO
      Sfio_t *sf_in;

#  Now we just force some configuration defines which are globally required
#  for mod_ssl.

Index: src/include/ap_config.h
===================================================================
*** src/include/ap_config.h	1998/07/21 18:46:41	1.1.1.1
--- src/include/ap_config.h	1998/09/16 11:43:06	1.4
***************
*** 1168,1173 ****
--- 1168,1180 ----
  #define ap_wait_t int
  #endif
  
+ /*
+ **  SSL stuff
+ */
+ #ifdef MOD_SSL
+ #define NO_WRITEV
+ #endif /* MOD_SSL */
+ 
  #ifdef __cplusplus
  }
  #endif

#  Now we just have to add support for the HTTPS protocol scheme.

Index: src/include/httpd.h
===================================================================
*** src/include/httpd.h	1998/07/21 18:46:59	1.1.1.2
--- src/include/httpd.h	1998/08/11 09:41:56	1.4
***************
*** 129,136 ****
--- 129,141 ----
  #define DEFAULT_HTTP_PORT	80
  #define DEFAULT_HTTPS_PORT	443
  #define ap_is_default_port(port,r)	((port) == ap_default_port(r))
+ #ifdef MOD_SSL
+ #define ap_http_method(r)          ((r)->connection->client->ssl ? "https" : "http")
+ #define ap_default_port(r)         ((r)->connection->client->ssl ? DEFAULT_HTTPS_PORT : DEFAULT_HTTP_PORT)
+ #else
  #define ap_http_method(r)	"http"
  #define ap_default_port(r)	DEFAULT_HTTP_PORT
+ #endif
  
  /* --------- Default user name and group name running standalone ---------- */
  /* --- These may be specified as numbers by placing a # before a number --- */

#  Now we have to patch the output routines to make sure that SSLeay's
#  output functions are used instead of the standard Unix functions when SSL
#  is enabled.

Index: src/main/buff.c
===================================================================
*** src/main/buff.c	1998/07/21 18:47:10	1.1.1.2
--- src/main/buff.c	1998/09/16 11:43:46	1.4
***************
*** 242,247 ****
--- 242,252 ----
      }
      else
  #endif
+ #ifdef MOD_SSL
+         if (fb->ssl)
+             rv = SSL_read(fb->ssl, buf, nbyte);
+         else
+ #endif /* MOD_SSL */
  	rv = read(fb->fd_in, buf, nbyte);
      
      return rv;
***************
*** 277,282 ****
--- 282,292 ----
      }
      else
  #endif
+ #ifdef MOD_SSL
+         if (fb->ssl)
+             rv = SSL_write(fb->ssl, (char *)buf, nbyte);
+         else
+ #endif /* MOD_SSL */
  #if defined (B_SFIO)
  	rv = sfwrite(fb->sf_out, buf, nbyte);
  #else
***************
*** 366,371 ****
--- 376,386 ----
      fb->sf_out = sfnew(fb->sf_out, NIL(Void_t *),
  		       (size_t) SF_UNBOUND, 1, SF_WRITE);
  #endif
+ 
+ #ifdef MOD_SSL
+     fb->ssl = NULL;
+     fb->szClientX509 = NULL;
+ #endif /* MOD_SSL */
  
      return fb;
  }

#  Now we have to apply the only really ugly patch for SSL support: Because
#  Apache's API lacks a hook for the socket connection phase we directly have
#  to call a pseudo-API function inside mod_ssl right after a new connection
#  was established to be able to do the initial SSL handshake.

Index: src/main/http_main.c
===================================================================
*** src/main/http_main.c	1998/07/21 18:47:27	1.1.1.2
--- src/main/http_main.c	1998/09/16 11:43:46	1.7
***************
*** 119,124 ****
--- 119,132 ----
  #include <netinet/tcp.h>
  #endif
  
+ /*  
+  *  needed for direct call inside main() 
+  *  because of missing API hook...
+  */
+ #ifdef MOD_SSL
+ int SSL_HOOK_SetupConnection(conn_rec *);
+ #endif /* MOD_SSL */
+ 
  #ifdef HAVE_BSTRING_H
  #include <bstring.h>		/* for IRIX, FD_SET calls bzero() */
  #endif
***************
*** 3248,3253 ****
--- 3256,3270 ----
  #endif
  }
  
+ #ifdef MOD_SSL
+ static void add_config_define(char *define)
+ {
+     char **var;
+     var = (char **)ap_push_array(ap_server_config_defines);
+     *var = ap_pstrdup(pcommands, define);
+     return;
+ }
+ #endif /* MOD_SSL */
  
  /* Some init code that's common between win32 and unix... well actually
   * some of it is #ifdef'd but was duplicated before anyhow.  This stuff
***************
*** 3622,3628 ****
--- 3639,3655 ----
  				          (struct sockaddr_in *) &sa_server,
  				          my_child_num);
  
+ #ifdef MOD_SSL
  	/*
+ 	 * This returns false if the connection cannot be setup,
+ 	 * so maybe we should do something with this here...
+ 	 * however it also blocks the BUFF connections
+ 	 * so the next bit should fall out anyway!
+ 	 */
+ 	SSL_HOOK_SetupConnection(current_conn);
+ #endif /* MOD_SSL */
+   
+ 	/*
  	 * Read and process each request found on our connection
  	 * until no requests are left or we decide to close.
  	 */
***************
*** 4242,4247 ****
--- 4269,4278 ----
      MONCONTROL(0);
  
      common_init();
+ 
+ #ifdef MOD_SSL
+     add_config_define("MOD_SSL");
+ #endif /* MOD_SSL */
      
      ap_server_argv0 = argv[0];
      ap_cpystrn(ap_server_root, HTTPD_ROOT, sizeof(ap_server_root));
***************
*** 4402,4407 ****
--- 4433,4449 ----
  	conn = new_connection(ptrans, server_conf, cio,
  			          (struct sockaddr_in *) &sa_client,
  			          (struct sockaddr_in *) &sa_server, -1);
+ 
+ #ifdef MOD_SSL
+ 	/*
+ 	 * This returns false if the connection cannot be setup,
+ 	 * so maybe we should do something with this here...
+ 	 * however it also blocks the BUFF connections
+ 	 * so the next bit should fall out anyway!
+ 	 */
+ 	SSL_HOOK_SetupConnection(conn);
+ #endif /* MOD_SSL */
+ 
  	r = ap_read_request(conn);
  	if (r)
  	    ap_process_request(r);	/* else premature EOF (ignore) */
***************
*** 4706,4711 ****
--- 4748,4763 ----
  				          (struct sockaddr_in *) &sa_client,
  				          (struct sockaddr_in *) &sa_server,
  				          child_num);
+ 
+ #ifdef MOD_SSL
+ 	/* 
+ 	 * This returns false if the connection cannot be setup,
+ 	 * so maybe we should do something with this here...
+ 	 * however it also blocks the BUFF connections
+ 	 * so the next bit should fall out anyway!
+ 	 */
+ 	SSL_HOOK_SetupConnection(current_conn);
+ #endif /* MOD_SSL */
  
  	/*
  	 * Read and process each request found on our connection

#  Now we have to make sure that a des_encrypt() function prototype inside
#  the vendor <crypt.h> header file doesn't conflict with the one from
#  SSLeay. Because des_encrypt() is not used inside Apache we just move the
#  prototype away overriding the name with a define.

Index: src/modules/standard/mod_auth.c
===================================================================
*** src/modules/standard/mod_auth.c	1998/07/21 18:48:07	1.1.1.2
--- src/modules/standard/mod_auth.c	1998/08/11 09:42:11	1.3
***************
*** 75,81 ****
--- 75,87 ----
  #include "http_log.h"
  #include "http_protocol.h"
  #if defined(HAVE_CRYPT_H)
+ #if defined(MOD_SSL)
+ #define des_encrypt MOVE_AWAY_des_encrypt
  #include <crypt.h>
+ #undef des_encrypt
+ #else
+ #include <crypt.h>
+ #endif /* MOD_SSL */
  #endif
  
  typedef struct auth_config_struct {

#  Now we add additional %{xxx}c tags to the CustomLog directive which can
#  be used to create an own SSL logfile. That's just for convenience.

Index: src/modules/standard/mod_log_config.c
===================================================================
*** src/modules/standard/mod_log_config.c	1998/07/21 18:48:29	1.1.1.2
--- src/modules/standard/mod_log_config.c	1998/09/16 11:42:32	1.9
***************
*** 127,132 ****
--- 127,142 ----
   * %...l:  remote logname (from identd, if supplied)
   * %...{Foobar}n:  The contents of note "Foobar" from another module.
   * %...{Foobar}o:  The contents of Foobar: header line(s) in the reply.
+  *
+  * Additional SSL directives:
+  *
+  * %...{version}c:    SSL protocol version
+  * %...{cipher}c:     SSL cipher used for encryption
+  * %...{subjectdn}c:  client certificate subject distinguished name
+  * %...{issuerdn}c:   client certificate issuer  distinguished name
+  * %...{errcode}c:    X509 verify error code
+  * %...{errstr}c:     X509 verify error string
+  *
   * %...p:  the port the request was served to
   * %...P:  the process ID of the child that serviced the request.
   * %...r:  first line of request
***************
*** 173,178 ****
--- 183,193 ----
  #include "http_log.h"
  #include <limits.h>
  
+ #ifdef MOD_SSL
+ #include <ssl.h>
+ #include <crypto.h>
+ #endif /* MOD_SSL */
+ 
  module MODULE_VAR_EXPORT config_log_module;
  
  static int xfer_flags = (O_WRONLY | O_APPEND | O_CREAT);
***************
*** 421,426 ****
--- 436,445 ----
      return ap_psprintf(r->pool, "%ld", (long) getpid());
  }
  
+ #ifdef MOD_SSL
+ static const char *log_ssl_info(request_rec *r, char *a);
+ #endif /* MOD_SSL */
+ 
  /*****************************************************************
   *
   * Parsing the log format string
***************
*** 486,492 ****
--- 505,516 ----
      {
          'P', log_child_pid, 0
      },
+ #ifdef MOD_SSL
      {
+         'c', log_ssl_info, 0
+     },
+ #endif /* MOD_SSL */
+     {
          '\0'
      }
  };
***************
*** 631,636 ****
--- 655,711 ----
      parse_log_item(p, (log_format_item *) ap_push_array(a), &s);
      return a;
  }
+ 
+ #ifdef MOD_SSL
+ static const char *log_ssl_info(request_rec *r, char *a)
+ {
+     char *result = NULL;
+     char *s;
+     X509 *xs;
+ 
+     if (!r->connection->client->ssl)
+         return NULL;
+ 
+     if (strcmp(a, "version") == 0) {
+         result = SSL_get_version(r->connection->client->ssl);
+     }
+     else if (strcmp(a, "cipher") == 0) {
+         result = SSL_get_cipher(r->connection->client->ssl);
+     }
+     else if (strcmp(a, "subjectdn") == 0 || strcmp(a, "clientcert") == 0) {
+ #if 0
+         /* the expensive way */
+         if ((xs = SSL_get_peer_certificate(r->connection->client->ssl)) != NULL) {
+             s = X509_NAME_oneline(X509_get_subject_name(xs), NULL, 0);
+             result = ap_pstrdup(r->pool, s);
+             free(s);
+         }
+ #else
+         /* the cheap way */
+         result = r->connection->client->szClientX509;
+ #endif
+     }
+     else if (strcmp(a, "issuerdn") == 0 || strcmp(a, "cacert") == 0) {
+         if ((xs = SSL_get_peer_certificate(r->connection->client->ssl)) != NULL) {
+             s = X509_NAME_oneline(X509_get_issuer_name(xs), NULL, 0);
+             result = ap_pstrdup(r->pool, s);
+             free(s);
+         }
+     }
+     else if (strcmp(a, "errcode") == 0) {
+         if(r->connection->client->nVerifyError) {
+             result = ap_psprintf(r->pool, "%d", r->connection->client->nVerifyError);
+         }
+     }
+     else if (strcmp(a, "errstr") == 0) {
+         if (r->connection->client->nVerifyError) {
+             s = X509_verify_cert_error_string(r->connection->client->nVerifyError);
+             result = ap_pstrdup(r->pool, s);
+         }
+     }
+     return result;
+ }
+ #endif /* MOD_SSL */
  
  /*****************************************************************
   *

#  Now we add support for HTTPS to the proxy module. Because we want
#  to avoid redundancy instead of creating an own proxy_https.c we
#  enhance proxy_http.c so it now handles HTTP and HTTPS. Because
#  the difference is minimal. First in mod_proxy.h we just adjust
#  the prototype of the HTTP handler because it now uses a flag
#  for HTTP/HTTPS.

Index: src/modules/proxy/mod_proxy.h
===================================================================
*** src/modules/proxy/mod_proxy.h	1998/07/21 18:47:53	1.1.1.2
--- src/modules/proxy/mod_proxy.h	1998/09/06 18:34:42	1.2
***************
*** 265,272 ****
--- 265,277 ----
  
  int ap_proxy_http_canon(request_rec *r, char *url, const char *scheme,
  		     int def_port);
+ #ifdef MOD_SSL
  int ap_proxy_http_handler(request_rec *r, struct cache_req *c, char *url,
+ 		       const char *proxyhost, int proxyport, int use_ssl);
+ #else
+ int ap_proxy_http_handler(request_rec *r, struct cache_req *c, char *url,
  		       const char *proxyhost, int proxyport);
+ #endif
  
  /* proxy_util.c */
  

#  Then we recognize HTTPS and use this new flag when calling the 
#  combined HTTP/HTTPS handler.

Index: src/modules/proxy/mod_proxy.c
===================================================================
*** src/modules/proxy/mod_proxy.c	1998/07/21 18:47:52	1.1.1.2
--- src/modules/proxy/mod_proxy.c	1998/09/06 18:34:42	1.2
***************
*** 217,224 ****
--- 217,231 ----
      url = &r->filename[6];
  
  /* canonicalise each specific scheme */
+ #ifdef MOD_SSL
      if (strncasecmp(url, "http:", 5) == 0)
  	return ap_proxy_http_canon(r, url + 5, "http", DEFAULT_HTTP_PORT);
+     else if (strncasecmp(url, "https:", 6) == 0)
+ 	return ap_proxy_http_canon(r, url + 6, "https", DEFAULT_HTTPS_PORT);
+ #else
+     if (strncasecmp(url, "http:", 5) == 0)
+ 	return ap_proxy_http_canon(r, url + 5, "http", DEFAULT_HTTP_PORT);
+ #endif
      else if (strncasecmp(url, "ftp:", 4) == 0)
  	return ap_proxy_ftp_canon(r, url + 4);
  
***************
*** 350,359 ****
--- 357,376 ----
  		if (r->method_number == M_CONNECT)
  		    rc = ap_proxy_connect_handler(r, cr, url, ents[i].hostname,
  					       ents[i].port);
+ #ifdef MOD_SSL
+ /* we know how to handle communication to a proxy via http and https */
+ 		else if (strcasecmp(ents[i].protocol, "http") == 0)
+ 		    rc = ap_proxy_http_handler(r, cr, url, ents[i].hostname,
+ 					    ents[i].port, 0);
+ 		else if (strcasecmp(ents[i].protocol, "https") == 0)
+ 		    rc = ap_proxy_http_handler(r, cr, url, ents[i].hostname,
+ 					    ents[i].port, 1);
+ #else
  /* we only know how to handle communication to a proxy via http */
  		else if (strcasecmp(ents[i].protocol, "http") == 0)
  		    rc = ap_proxy_http_handler(r, cr, url, ents[i].hostname,
  					    ents[i].port);
+ #endif
  		else
  		    rc = DECLINED;
  
***************
*** 371,378 ****
--- 388,403 ----
      /* handle the scheme */
      if (r->method_number == M_CONNECT)
  	return ap_proxy_connect_handler(r, cr, url, NULL, 0);
+ #ifdef MOD_SSL
+     if (strcasecmp(scheme, "http") == 0)
+ 	return ap_proxy_http_handler(r, cr, url, NULL, 0, 0);
+     if (strcasecmp(scheme, "https") == 0)
+ 	return ap_proxy_http_handler(r, cr, url, NULL, 0, 1);
+ #else
      if (strcasecmp(scheme, "http") == 0)
  	return ap_proxy_http_handler(r, cr, url, NULL, 0);
+ #endif
+ 
      if (strcasecmp(scheme, "ftp") == 0)
  	return ap_proxy_ftp_handler(r, cr, url);
      else

#  And finally we have to add the SSL functionality to the
#  HTTP handler to let him speak HTTPS, too.

Index: src/modules/proxy/proxy_http.c
===================================================================
*** src/modules/proxy/proxy_http.c	1998/07/21 18:47:58	1.1.1.2
--- src/modules/proxy/proxy_http.c	1998/09/06 19:04:37	1.3
***************
*** 63,68 ****
--- 63,78 ----
  #include "http_core.h"
  #include "util_date.h"
  
+ #ifdef MOD_SSL
+ /* SSLeay headers */
+ #include <ssl.h>
+ #include <crypto.h>
+ #include <x509.h>
+ #include <pem.h>
+ #include <rsa.h>
+ #include <err.h>
+ #endif
+ 
  /*
   * Canonicalise http-like URLs.
   *  scheme is the scheme for the URL
***************
*** 156,161 ****
--- 166,182 ----
      ap_table_unset(headers, "Connection");
  }
  
+ #ifdef MOD_SSL
+ static void ap_proxy_http_handler_cleanup(void *_ssl)
+ {
+     SSL *ssl = _ssl;
+     if (ssl != NULL) {
+         SSL_set_shutdown(ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+         SSL_free(ssl);
+     }
+ }
+ #endif
+ 
  /*
   * This handles http:// URLs, and other URLs using a remote proxy over http
   * If proxyhost is NULL, then contact the server directly, otherwise
***************
*** 165,172 ****
--- 186,198 ----
   * we return DECLINED so that we can try another proxy. (Or the direct
   * route.)
   */
+ #ifdef MOD_SSL
+ int ap_proxy_http_handler(request_rec *r, struct cache_req *c, char *url,
+ 		       const char *proxyhost, int proxyport, int use_ssl)
+ #else
  int ap_proxy_http_handler(request_rec *r, struct cache_req *c, char *url,
  		       const char *proxyhost, int proxyport)
+ #endif
  {
      const char *strp;
      char *strp2;
***************
*** 193,198 ****
--- 219,230 ----
      struct nocache_entry *ncent = (struct nocache_entry *) conf->nocaches->elts;
      int nocache = 0;
  
+ #ifdef MOD_SSL
+     SSL_CTX *ssl_ctx  = NULL;
+     SSL *ssl_conn = NULL;
+     int rc; 
+ #endif
+ 
      memset(&server, '\0', sizeof(server));
      server.sin_family = AF_INET;
  
***************
*** 202,208 ****
      if (urlptr == NULL)
  	return HTTP_BAD_REQUEST;
      urlptr += 3;
!     destport = DEFAULT_HTTP_PORT;
      strp = strchr(urlptr, '/');
      if (strp == NULL) {
  	desthost = ap_pstrdup(p, urlptr);
--- 234,243 ----
      if (urlptr == NULL)
  	return HTTP_BAD_REQUEST;
      urlptr += 3;
!     if (use_ssl) 
! 	destport = DEFAULT_HTTPS_PORT;
!     else
! 	destport = DEFAULT_HTTP_PORT;
      strp = strchr(urlptr, '/');
      if (strp == NULL) {
  	desthost = ap_pstrdup(p, urlptr);
***************
*** 298,309 ****
--- 333,373 ----
      f = ap_bcreate(p, B_RDWR | B_SOCKET);
      ap_bpushfd(f, sock, sock);
  
+ #ifdef MOD_SSL
+     if (use_ssl) {
+         /* Create a SSL context and connection */
+         ssl_ctx = SSL_CTX_new(SSLv23_client_method());
+         ssl_conn = SSL_new(ssl_ctx);
+         SSL_clear(ssl_conn);
+         f->ssl = ssl_conn;
+         f->fd  = sock;
+         SSL_set_fd(ssl_conn, sock);
+         ap_register_cleanup(r->pool, (void *)ssl_conn, 
+                             ap_proxy_http_handler_cleanup, ap_proxy_http_handler_cleanup);
+ 
+         /* Establish the SSL connection */
+         if ((rc = SSL_connect(ssl_conn)) <= 0) {
+             char *errmsg = ap_pstrcat(r->pool, "SSL connect failed: ",
+                                       ERR_reason_error_string(ERR_get_error()), NULL);
+             SSL_free(ssl_conn);
+             return ap_proxyerror(r, errmsg);
+         }
+     }
+ #endif
+ 
      ap_hard_timeout("proxy send", r);
      ap_bvputs(f, r->method, " ", proxyhost ? url : urlptr, " HTTP/1.0" CRLF,
  	   NULL);
      ap_bvputs(f, "Host: ", desthost, NULL);
+ #if MOD_SSL
+     if (destportstr != NULL && use_ssl && destport != DEFAULT_HTTPS_PORT)
+ 	ap_bvputs(f, ":", destportstr, CRLF, NULL);
+     else if (destportstr != NULL && !use_ssl && destport != DEFAULT_HTTP_PORT)
+ 	ap_bvputs(f, ":", destportstr, CRLF, NULL);
+ #else
      if (destportstr != NULL && destport != DEFAULT_HTTP_PORT)
  	ap_bvputs(f, ":", destportstr, CRLF, NULL);
+ #endif
      else
  	ap_bputs(CRLF, f);
  

#  Now we provide an additional `startssl' command to supplement the
#  standard `start' command. The difference is just that `startssl' adds a
#  -DSSL define when starting httpd.

Index: src/support/apachectl
===================================================================
*** src/support/apachectl	1998/07/21 18:50:07	1.1.1.2
--- src/support/apachectl	1998/09/16 11:44:10	1.4
***************
*** 75,80 ****
--- 75,92 ----
  	    ERROR=3
  	fi
  	;;
+     startssl|sslstart|start-SSL)
+ 	if [ $RUNNING -eq 1 ]; then
+ 	    echo "$0 $ARG: httpd (pid $PID) already running"
+ 	    continue
+ 	fi
+ 	if $HTTPD -DSSL; then
+ 	    echo "$0 $ARG: httpd started"
+ 	else
+ 	    echo "$0 $ARG: httpd could not be started"
+ 	    ERROR=3
+ 	fi
+ 	;;
      stop)
  	if [ $RUNNING -eq 0 ]; then
  	    echo "$0 $ARG: $STATUS"
***************
*** 153,158 ****
--- 165,171 ----
  	cat <<EOF
  
  start      - start httpd
+ startssl   - start httpd with SSL enabled
  stop       - stop httpd
  restart    - restart httpd if running by sending a SIGHUP or start if 
               not running

#  Now we have to add support for the HTTPS scheme and the additional
#  SSL_XXXX environment variables mod_ssl provides to the CGI scripts.

Index: src/support/suexec.c
===================================================================
*** src/support/suexec.c	1998/07/21 18:50:27	1.1.1.2
--- src/support/suexec.c	1998/07/21 19:03:06	1.2
***************
*** 210,216 ****
--- 210,222 ----
      }
  
      for (ep = environ; *ep && cidx < AP_ENVBUF; ep++) {
+ #ifdef MOD_SSL
+     if (!strncmp(*ep, "HTTP_", 5) || 
+         !strncmp(*ep, "HTTPS", 5) ||
+         !strncmp(*ep, "SSL_", 4)) {
+ #else
  	if (!strncmp(*ep, "HTTP_", 5)) {
+ #endif
  	    cleanenv[cidx] = *ep;
  	    cidx++;
  	}

#  Now we add additional SSL configuration directives. Actually
#  a virtual server is configured for Port 443 which speaks SSL.

Index: conf/httpd.conf-dist
===================================================================
*** conf/httpd.conf-dist	1998/07/21 18:45:50	1.1.1.1
--- conf/httpd.conf-dist	1998/09/17 12:04:33	1.18
***************
*** 31,36 ****
--- 31,47 ----
  
  Port 80
  
+ ##
+ ##  SSL Support
+ ##
+ ##  When we also provide SSL we have to listen to the 
+ ##  standard HTTP port (see above) and to the HTTPS port
+ ##
+ <IfDefine SSL>
+ Listen 80
+ Listen 443
+ </IfDefine>
+ 
  # HostnameLookups: Log the names of clients or just their IP numbers
  #   e.g.   www.apache.org (on) or 204.62.129.132 (off)
  # The default is off because it'd be overall better for the net if people
***************
*** 243,246 ****
--- 254,388 ----
  #TransferLog logs/host.some_domain.com-access_log
  #</VirtualHost>
  
+ 
+ ##
+ ##  SSL Support
+ ##
+ ##  Note that all SSL options can apply to virtual hosts, which is
+ ##  where we are going to put them. Per default SSL is disabled
+ ##  globally and you have to enable it inside virtual hosts
+ ##  explicitly.
+ ##
+ 
+ <IfModule mod_ssl.c>
+ 
+ #   Configure the pass phrase gathering process. [RECOMMENDED]
+ #   The filtering dialog program (`builtin' is a internal
+ #   terminal dialog) has to provide the pass phrase on stdout.
+ SSLPassPhraseDialog   builtin
+ 
+ #   Configure the path to the mutial explusion lockfile the
+ #   SSL engine uses internally for syncronization. [RECOMMENDED]
+ SSLMutex  file:logs/ssl_mutex
+ 
+ #   Configure the SSL Session Cache: First either `none'
+ #   or `dbm:/path/to/file' for the mechanism to use and
+ #   second the expiring timeout (in seconds). [RECOMMENDED].
+ SSLSessionCache         dbm:logs/ssl_scache
+ SSLSessionCacheTimeout  300
+ 
+ #   The home of the dedicated SSL protocol logfile. Errors are
+ #   additionally duplicated in the general error log file.  Put
+ #   this somewhere where it cannot be used for symlink attacks on
+ #   a real server (i.e. somewhere where only root can write).
+ #   [RECOMMENDED]
+ #   Log levels are (ascending order: higher ones include lower ones):
+ #   none:  no dedicated SSL logging at all, but errors are still 
+ #          duplicated to the Apache error log.
+ #   error: log error messages (plus duplicate them to the error log)
+ #   warn:  log warning messages
+ #   info:  log information messages
+ #   debug: log debugging messages
+ SSLLog      logs/ssl_engine_log
+ SSLLogLevel info
+ 
+ <IfDefine SSL>
+ 
+ <VirtualHost _default_:443>
+ 
+ #   Setup the general virtual host configuration.
+ DocumentRoot @@ServerRoot@@/htdocs
+ ServerName new.host.name
+ ServerAdmin you@your.address
+ ErrorLog logs/error_log
+ TransferLog logs/access_log
+ 
+ #   Enable SSL for this virtual host.
+ SSLEngine on
+ 
+ #   Point SSLCertificateFile at a PEM encoded certificate.  If
+ #   the certificate is encrypted, then you will be prompted for a
+ #   pass phrase.  Note that a kill -HUP will prompt again. A test
+ #   certificate can be generated with `make certificate' under
+ #   built time. [RECOMMENDED]
+ SSLCertificateFile    @@ServerRoot@@/conf/ssl.crt/server.crt
+ 
+ #   If the key is not combined with the certificate, use this
+ #   directive to point at the key file. [OPTIONAL]
+ SSLCertificateKeyFile @@ServerRoot@@/conf/ssl.key/server.key
+ 
+ #   Set the CA certificate verification path where to find CA
+ #   certificates for client authentication or alternatively one
+ #   huge file containing all of them (file must be PEM encoded)
+ #   [OPTIONAL]
+ #   Note: Inside SSLCACertificatePath you need hash symlinks
+ #         to point to the certificate files. Use the provided
+ #         Makefile to update the hash symlinks after changes.
+ #SSLCACertificatePath  @@ServerRoot@@/conf/ssl.crt
+ #SSLCACertificateFile  @@ServerRoot@@/conf/ssl.crt/ca-bundle.crt
+ 
+ #   Set the file containing CA certificates which are sent to the
+ #   client on an `SSLv3 write certificate request A'. This is
+ #   used with SSLv3 certificate chaining where the client loads
+ #   intermediate certificates in the chain from the server to
+ #   speedup processing of the server authentication. This
+ #   defaults to SSLCACertificateFile but can be set to a
+ #   different file when you want to use a different set of
+ #   certificates you sent out to the client.
+ #SSLCACertificateReqFile @@ServerRoot@@/conf/ssl.crt/ca-bundle.crt
+ 
+ #   Set client verification level: [RECOMMENDED]
+ #   none:           no certificate is required
+ #   optional:       the client may  present a valid certificate
+ #   require:        the client must present a valid certificate
+ #   optional_no_ca: the client may  present a valid certificate 
+ #                   but it is not required to have a valid CA
+ SSLVerifyClient none
+ 
+ #   Set how deeply to verify the certificate issuer chain before
+ #   deciding the certificate is not valid. [OPTIONAL]
+ #SSLVerifyDepth 10
+ 
+ #   List the ciphers that the client is permitted to negotiate.
+ #   See the mod_ssl documentation for a complete list. [OPTIONAL]
+ #SSLCipherSuite RC4-MD5:RC4-SHA:IDEA-CBC-MD5:DES-CBC3-SHA
+ 
+ #   Translate the client X.509 into a Basic Authorisation.  This
+ #   means that the standard Auth/DBMAuth methods can be used for
+ #   access control. The user name is the `one line' version of
+ #   the client's X.509 certificate. Note that no password is
+ #   obtained from the user. Every entry in the user file needs
+ #   this password: `xxj31ZMTZzkVA'. [OPTIONAL]
+ #SSLFakeBasicAuth
+ 
+ #   With SSLRequire you can do access control based on
+ #   arbitrary complex boolean expressions containing
+ #   server variable checks and other lookup directives.
+ #   The syntax is a mixture between C and Perl. 
+ #   See the mod_ssl documentation for more details.
+ #SSLRequire %{SSL_CIPHER} !~ m/^EXP-.*/ and \
+ #           %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." and \
+ #           %{REMOTE_ADDR} =~ m/^1\.2\.3\.[0-9]+$/
+ 
+ #   The home of a custom SSL log file. [RECOMMENED]
+ #   (Use this when you want a compact non-error SSL logfile
+ #   on a virtual host basis)
+ CustomLog logs/ssl_request_log \
+           "%t %h %{version}c %{cipher}c %{subjectdn}c %{issuerdn}c \"%r\" %b"
+ 
+ </VirtualHost>                                  
+ 
+ </IfDefine>
+ 
+ </IfModule>
  

#  Now we adjust the default frontdoor webpage where we now indicate that
#  this is an SSL-aware Apache, give additional hyperlinks to mod_ssl and
#  provide the three new "powered by Apache", "secured by mod_ssl" and
#  "includes SSLeay" buttons.

Index: htdocs/index.html
===================================================================
*** htdocs/index.html	1998/07/21 18:45:50	1.1.1.1
--- htdocs/index.html	1998/08/20 12:30:58	1.2
***************
*** 1,7 ****
  <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
  <HTML>
   <HEAD>
!   <TITLE>Test Page for Apache Installation on Web Site</TITLE>
   </HEAD>
  <!-- Background white, links blue (unvisited), navy (visited), red (active) -->
   <BODY
--- 1,17 ----
  <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
  <HTML>
   <HEAD>
!   <TITLE>Test Page for the SSL-aware Apache Installation on Web Site</TITLE>
!   <STYLE TYPE="text/css">
!   H1 {
!       font-weight: bold;
!       font-size: 18pt;
!       line-height: 18pt;
!       font-family: arial,helvetica;
!       font-variant: normal;
!       font-style: normal;
!   }
!   </STYLE>
   </HEAD>
  <!-- Background white, links blue (unvisited), navy (visited), red (active) -->
   <BODY
***************
*** 11,51 ****
    VLINK="#000080"
    ALINK="#FF0000"
   >
!   <H1 ALIGN="CENTER">
!    It Worked!  The Apache Web Server is Installed on this Web Site!
    </H1>
    <P>
    If you can see this page, then the people who own this domain have just
    installed the <A HREF="http://www.apache.org/">Apache Web server</A>
!   software successfully.  They now have to add content to this directory
!   and replace this placeholder page, or else point the server at their real
!   content.
    </P>
-   <HR>
    <BLOCKQUOTE>
     If you are seeing this page instead of the site you expected, please
     <STRONG>contact the administrator of the site involved.</STRONG>
!    (Try sending mail to <SAMP>&lt;Webmaster@<EM>domain</EM>&gt;</SAMP>.)
     Although this site is
     running the Apache software it almost certainly has no other connection
     to the Apache Group, so please do not send mail about this site or its
     contents to the Apache authors.  If you do, your message will be
!    <STRONG><BIG>ignored</BIG></STRONG>.
    </BLOCKQUOTE>
-   <HR>
    <P>
    The Apache
    <A
     HREF="manual/index.html"
    >documentation</A>
!   has been included with this distribution.
    </P>
    <P>
!   The Webmaster of this site is free to use the image below on
!   an Apache-powered Web server.  Thanks for using Apache!
    </P>
    <DIV ALIGN="CENTER">
!    <IMG SRC="apache_pb.gif" ALT="">
    </DIV>
   </BODY>
  </HTML>
--- 21,82 ----
    VLINK="#000080"
    ALINK="#FF0000"
   >
!   <BLOCKQUOTE>
!   <BR>
!   <H1>
!   It Worked!<BR>
!   The SSL-aware Apache Web Server is Installed on this Web Site.
    </H1>
    <P>
+   <HR NOSHADE>
+   <P>
    If you can see this page, then the people who own this domain have just
    installed the <A HREF="http://www.apache.org/">Apache Web server</A>
!   software and <A HREF="http://www.engelschall.com/sw/mod_ssl/">Apache
!   Interface to SSLeay (mod_ssl)</A> successfully.  They now have to add
!   content to this directory and replace this placeholder page, or else point
!   the server at their real content.
    </P>
    <BLOCKQUOTE>
+    <STRONG>ATTENTION!</STRONG><BR>
     If you are seeing this page instead of the site you expected, please
     <STRONG>contact the administrator of the site involved.</STRONG>
!    (Try sending mail to <SAMP>&lt;webmaster@<EM>domain</EM>&gt;</SAMP>.)
     Although this site is
     running the Apache software it almost certainly has no other connection
     to the Apache Group, so please do not send mail about this site or its
     contents to the Apache authors.  If you do, your message will be
!    <STRONG>ignored</STRONG>.
    </BLOCKQUOTE>
    <P>
    The Apache
    <A
     HREF="manual/index.html"
    >documentation</A>
!   has been included with this distribution.<BR>
!   Especially read the 
!   <A
!    HREF="manual/mod/mod_ssl.html"
!   >SSL documentation</A>
!   carefully.
    </P>
    <P>
!   The Webmaster of this site is free to use the images below on
!   an SSL-aware Apache Web server. <BR>
!   Thanks for using Apache!
    </P>
+   <HR NOSHADE>
+   <P>
    <DIV ALIGN="CENTER">
!    <A HREF="http://www.apache.org/"
!    ><IMG SRC="manual/images/apache_pb.gif" ALT="Apache Webserver" BORDER=0></A>
!    &nbsp;
!    <A HREF="http://www.engelschall.com/sw/mod_ssl/"
!    ><IMG SRC="manual/images/mod_ssl_sb.gif" ALT="mod_ssl Interface" BORDER=0></A>
!    &nbsp;
!    <A HREF="http://www.ssleay.org/"
!    ><IMG SRC="manual/images/ssleay.gif" ALT="SSLeay Library" BORDER=0></A>
    </DIV>
+   </BLOCKQUOTE>
   </BODY>
  </HTML>

#  Now we just add a hyperlink to the mod_ssl.html document.

Index: htdocs/manual/mod/index.html
===================================================================
*** htdocs/manual/mod/index.html	1998/07/21 18:45:52	1.1.1.1
--- htdocs/manual/mod/index.html	1998/09/10 11:21:42	1.4
***************
*** 111,116 ****
--- 111,118 ----
  <DD>Experimental support for loading modules (DLLs on Windows) at runtime
  <DT><A HREF="mod_speling.html">mod_speling</A> Apache 1.3 and up
  <DD>Automatically correct minor typos in URLs
+ <DT><A HREF="mod_ssl.html">mod_ssl</A> Apache 1.3 with mod_ssl applied
+ <DD>Apache SSL interface to SSLeay
  <DT><A HREF="mod_status.html">mod_status</A>
  <DD>Server status display
  <DT><A HREF="mod_userdir.html">mod_userdir</A>

#  Now we just add hyperlinks for all directives which are
#  documented inside the mod_ssl.html document.

Index: htdocs/manual/mod/directives.html
===================================================================
*** htdocs/manual/mod/directives.html	1998/07/21 18:50:49	1.1.1.2
--- htdocs/manual/mod/directives.html	1998/09/10 11:21:42	1.8
***************
*** 201,206 ****
--- 201,224 ----
  <LI><A HREF="mod_setenvif.html#setenvif">SetEnvIf</A>
  <LI><A HREF="mod_setenvif.html#SetEnvIfNoCase">SetEnvIfNoCase</A>
  <LI><A HREF="mod_mime.html#sethandler">SetHandler</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLMutex">SSLMutex</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLPassPhraseDialog">SSLPassPhraseDialog</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLEngine">SSLEngine</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLCipherList">SSLCipherList</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLCertificateFile">SSLCertificateFile</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLCertificateKeyFile">SSLCertificateKeyFile</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLCACertificatePath">SSLCACertificatePath</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLCACertificateFile">SSLCACertificateFile</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLCACertificateReqFile">SSLCACertificateReqFile</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLVerifyClient">SSLVerifyClient</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLVerifyDepth">SSLVerifyDepth</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLSessionCacheStorage">SSLSessionCacheStorage</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLSessionCacheTimeout">SSLSessionCacheTimeout</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLFakeBasicAuth">SSLFakeBasicAuth</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLLog">SSLLog</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLLogLevel">SSLLogLevel</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLRequireSSL">SSLRequireSSL</A>
+ <LI><A HREF="mod_ssl_ref.html#SSLRequire">SSLRequire</A>
  <LI><A HREF="core.html#startservers">StartServers</A>
  <LI><A HREF="core.html#threadsperchild">ThreadsPerChild</A>
  <LI><A HREF="core.html#timeout">TimeOut</A>
