mod_ssl: Compatibility

mod_ssl |
Reference | F.A.Q. List
ere we talk about backward compatibility to other SSL solutions. As you perhaps know mod_ssl is not the only existing SSL solution for Apache. Actually there are four additional products available: Ben Laurie's freely available Apache-SSL (from where mod_ssl were originally derived), RedHat's commercial Secure Web Server (which is based on mod_ssl), Covalent's commercial Raven SSL Module (also based on Apache-SSL) and finally C2Net's commercial product Stronghold (based on a different evolution branch named Sioux). |  |
Table Of Contents
Configuration Directives Environment Variables Custom Log Functions
The idea in mod_ssl is mainly the following: because mod_ssl provides mostly a superset of the functionality of all other solutions we can easily provide backward compatibility for most of the cases. Actually there are three compatibility areas we currently address: configuration directives, environment variables and custom log functions. ## Configuration Directives For backward compatibility to the configuration directives of other SSL solutions we do an on-the-fly mapping: directives which have a direct counterpart in mod_ssl are mapped silently while other directives lead to a warning message in the logfiles. The currently implemented directive mapping is listed in Table 1.
Table 1: Configuration Directive Mapping
Old Directive | mod_ssl Directive | Comment
Apache-SSL | `SSLEnable` | `SSLEngine on` | compactified
Apache-SSL | `SSLDisable` | `SSLEngine off` | compactified
Apache-SSL | `SSLCacheServerPath` dir | - | functionality removed
Apache-SSL | `SSLCacheServerPort` integer | - | functionality removed
Apache-SSL | `SSLRequiredCiphers` arg | `SSLCipherList` arg | renamed
Sioux | `SSL_CertFile` file | `SSLCertificateFile` file | renamed
Sioux | `SSL_KeyFile` file | `SSLCertificateKeyFile` file | renamed
Sioux | `SSL_CertFileType` arg | - | functionality not supported
Sioux | `SSL_KeyFileType` arg | - | functionality not supported
Sioux | `SSL_CipherSuite` arg | `SSLCipherList` arg | renamed
Sioux | `SSL_FetchKeyPhraseFrom` arg | - | not directly mappable
Sioux | `SSL_X509VerifyDir` arg | `SSLCACertificatePath` arg | renamed
Sioux | `SSL_X509VerifyPolicy` arg | - | functionality not supported
Sioux | `SSL_Log` file | `SSLLogFile` file | renamed
Sioux | `SSL_LogX509Attributes` arg | - | functionality not supported
Sioux | `SSL_SessionDir` dir | `SSLSessionCacheStorage` dir`/ssl_scache` | renamed
Sioux | `SSL_Connect` flag | `SSLEngine` flag | renamed
Sioux | `SSL_ClientAuth` arg | `SSLVerifyClient` arg | renamed
Sioux | `SSL_X509VerifyDepth` arg | `SSLVerifyDepth` arg | renamed
## Environment Variables ... ## Custom Log Functions
Variable Name: | Description:
`%...{version}c` | SSL protocol version

    %...{version}c:    SSL protocol version
    %...{cipher}c:     SSL cipher
    %...{subjectdn}c:  Client Certificate subject distinguished name
    %...{issuerdn}c:   Client Certificate issuer  distinguished name
    %...{errcode}c:    X509 verify error code
    %...{errstr}c:     X509 verify error string

Use these with the `CustomLog` directive to create a custom SSL logfile:

Reference | F.A.Q. List
mod_ssl 2.1, User Manual The Apache Interface to SSLeay | Copyright © 1998 Ralf S. Engelschall All Rights Reserved