mod_ssl Chapter 4
previous page
Reference
next page
HowTo

Compatibility
All PCs are compatible. But some of them are more compatible than others.
Unknown

H ere we talk about backward compatibility to other SSL solutions. As you perhaps know, mod_ssl is not the only existing SSL solution for Apache. Actually there are four additional major products available on the market: Ben Laurie's freely available Apache-SSL (from where mod_ssl were originally derived in 1998), RedHat's commercial Secure Web Server (which is based on mod_ssl), Covalent's commercial Raven SSL Module (also based on mod_ssl) and finally C2Net's commercial product Stronghold (based on a different evolution branch named Sioux up to Stronghold 2.x and based on mod_ssl since Stronghold 3.x).   
Table Of Contents
        Configuration Directives
        Environment Variables
        Custom Log Functions

The idea in mod_ssl is mainly the following: because mod_ssl provides mostly a superset of the functionality of all other solutions we can easily provide backward compatibility for most of the cases. Actually there are three compatibility areas we currently address: configuration directives, environment variables and custom log functions.

Configuration Directives

  • el
  • pt
  • For backward compatibility to the configuration directives of other SSL solutions we do an on-the-fly mapping: directives which have a direct counterpart in mod_ssl are mapped silently while other directives lead to a warning message in the logfiles. The currently implemented directive mapping is listed in Table 1. Currently full backward compatibilty is provided only for Apache-SSL 1.x and mod_ssl 2.0.x. Compatibility to Sioux 1.x and Stronghold 2.x is only partial because of special functionality in these interfaces which mod_ssl (still) doesn't provide.

    Table 1: Configuration Directive Mapping
    Old Directive mod_ssl Directive Comment
    Apache-SSL 1.x & mod_ssl 2.0.x compatibility:
    SSLEnableSSLEngine oncompactified
    SSLDisableSSLEngine offcompactified
    SSLLogFile fileSSLLog filecompactified
    SSLRequiredCiphers specSSLCipherSuite specrenamed
    SSLRequireCipher c1 ...SSLRequire %{SSL_CIPHER} in {"c1", ...}generalized
    SSLBanCipher c1 ...SSLRequire not (%{SSL_CIPHER} in {"c1", ...})generalized
    SSLFakeBasicAuthSSLOptions +FakeBasicAuthmerged
    SSLCacheServerPath dir-functionality removed
    SSLCacheServerPort integer-functionality removed
    Apache-SSL 1.x compatibility:
    SSLExportClientCertificatesSSLOptions +ExportCertDatamerged
    SSLCacheServerRunDir dir-functionality not supported
    Sioux 1.x compatibility:
    SSL_CertFile fileSSLCertificateFile filerenamed
    SSL_KeyFile fileSSLCertificateKeyFile filerenamed
    SSL_CipherSuite argSSLCipherSuite argrenamed
    SSL_X509VerifyDir argSSLCACertificatePath argrenamed
    SSL_Log fileSSLLogFile filerenamed
    SSL_Connect flagSSLEngine flagrenamed
    SSL_ClientAuth argSSLVerifyClient argrenamed
    SSL_X509VerifyDepth argSSLVerifyDepth argrenamed
    SSL_FetchKeyPhraseFrom arg-not directly mappable; use SSLPassPhraseDialog
    SSL_SessionDir dir-not directly mappable; use SSLSessionCache
    SSL_Require expr-not directly mappable; use SSLRequire
    SSL_CertFileType arg-functionality not supported
    SSL_KeyFileType arg-functionality not supported
    SSL_X509VerifyPolicy arg-functionality not supported
    SSL_LogX509Attributes arg-functionality not supported
    Stronghold 2.x compatibility:
    StrongholdAccelerator dir-functionality not supported
    StrongholdKey dir-functionality not supported
    StrongholdLicenseFile dir-functionality not supported
    SSLFlag flagSSLEngine flagrenamed
    SSLSessionLockFile fileSSLMutex filerenamed
    SSLCipherList specSSLCipherSuite specrenamed
    RequireSSLSSLRequireSSLrenamed
    SSLErrorFile file-functionality not supported
    SSLRoot dir-functionality not supported
    SSL_CertificateLogDir dir-functionality not supported
    AuthCertDir dir-functionality not supported
    SSL_Group name-functionality not supported
    SSLProxyMachineCertPath dir-functionality not supported
    SSLProxyMachineCertFile file-functionality not supported
    SSLProxyCACertificatePath dir-functionality not supported
    SSLProxyCACertificateFile file-functionality not supported
    SSLProxyVerifyDepth number-functionality not supported
    SSLProxyCipherList spec-functionality not supported


    Environment Variables

    When you use ``SSLOptions +CompatEnvVars'' additional environment variables are generated. They all correspond to existing official mod_ssl variables. The currently implemented variable derivation is listed in Table 2.

    Table 2: Environment Variable Derivation
    Old Variable mod_ssl Variable Comment
    SSL_PROTOCOL_VERSIONSSL_PROTOCOLrenamed
    SSLEAY_VERSIONSSL_VERSION_LIBRARYrenamed
    HTTPS_SECRETKEYSIZESSL_CIPHER_USEKEYSIZErenamed
    HTTPS_KEYSIZESSL_CIPHER_ALGKEYSIZErenamed
    HTTPS_CIPHERSSL_CIPHERrenamed
    HTTPS_EXPORTSSL_CIPHER_EXPORTrenamed
    SSL_SERVER_KEY_SIZESSL_CIPHER_ALGKEYSIZErenamed
    SSL_SERVER_CERTIFICATESSL_SERVER_CERTrenamed
    SSL_SERVER_CERT_STARTSSL_SERVER_V_STARTrenamed
    SSL_SERVER_CERT_ENDSSL_SERVER_V_ENDrenamed
    SSL_SERVER_CERT_SERIALSSL_SERVER_M_SERIALrenamed
    SSL_SERVER_SIGNATURE_ALGORITHMSSL_SERVER_A_SIGrenamed
    SSL_SERVER_DNSSL_SERVER_S_DNrenamed
    SSL_SERVER_CNSSL_SERVER_S_DN_CNrenamed
    SSL_SERVER_EMAILSSL_SERVER_S_DN_Emailrenamed
    SSL_SERVER_OSSL_SERVER_S_DN_Orenamed
    SSL_SERVER_OUSSL_SERVER_S_DN_OUrenamed
    SSL_SERVER_CSSL_SERVER_S_DN_Crenamed
    SSL_SERVER_SPSSL_SERVER_S_DN_SPrenamed
    SSL_SERVER_LSSL_SERVER_S_DN_Lrenamed
    SSL_SERVER_IDNSSL_SERVER_I_DNrenamed
    SSL_SERVER_ICNSSL_SERVER_I_DN_CNrenamed
    SSL_SERVER_IEMAILSSL_SERVER_I_DN_Emailrenamed
    SSL_SERVER_IOSSL_SERVER_I_DN_Orenamed
    SSL_SERVER_IOUSSL_SERVER_I_DN_OUrenamed
    SSL_SERVER_ICSSL_SERVER_I_DN_Crenamed
    SSL_SERVER_ISPSSL_SERVER_I_DN_SPrenamed
    SSL_SERVER_ILSSL_SERVER_I_DN_Lrenamed
    SSL_CLIENT_CERTIFICATESSL_CLIENT_CERTrenamed
    SSL_CLIENT_CERT_STARTSSL_CLIENT_V_STARTrenamed
    SSL_CLIENT_CERT_ENDSSL_CLIENT_V_ENDrenamed
    SSL_CLIENT_CERT_SERIALSSL_CLIENT_M_SERIALrenamed
    SSL_CLIENT_SIGNATURE_ALGORITHMSSL_CLIENT_A_SIGrenamed
    SSL_CLIENT_DNSSL_CLIENT_S_DNrenamed
    SSL_CLIENT_CNSSL_CLIENT_S_DN_CNrenamed
    SSL_CLIENT_EMAILSSL_CLIENT_S_DN_Emailrenamed
    SSL_CLIENT_OSSL_CLIENT_S_DN_Orenamed
    SSL_CLIENT_OUSSL_CLIENT_S_DN_OUrenamed
    SSL_CLIENT_CSSL_CLIENT_S_DN_Crenamed
    SSL_CLIENT_SPSSL_CLIENT_S_DN_SPrenamed
    SSL_CLIENT_LSSL_CLIENT_S_DN_Lrenamed
    SSL_CLIENT_IDNSSL_CLIENT_I_DNrenamed
    SSL_CLIENT_ICNSSL_CLIENT_I_DN_CNrenamed
    SSL_CLIENT_IEMAILSSL_CLIENT_I_DN_Emailrenamed
    SSL_CLIENT_IOSSL_CLIENT_I_DN_Orenamed
    SSL_CLIENT_IOUSSL_CLIENT_I_DN_OUrenamed
    SSL_CLIENT_ICSSL_CLIENT_I_DN_Crenamed
    SSL_CLIENT_ISPSSL_CLIENT_I_DN_SPrenamed
    SSL_CLIENT_ILSSL_CLIENT_I_DN_Lrenamed
    SSL_EXPORTSSL_CIPHER_EXPORTrenamed
    SSL_KEYSIZESSL_CIPHER_ALGKEYSIZErenamed
    SSL_SECKEYSIZESSL_CIPHER_USEKEYSIZErenamed
    SSL_SSLEAY_VERSIONSSL_VERSION_LIBRARYrenamed
    SSL_STRONG_CRYPTO-Not supported by mod_ssl
    SSL_SERVER_KEY_EXP-Not supported by mod_ssl
    SSL_SERVER_KEY_ALGORITHM-Not supported by mod_ssl
    SSL_SERVER_KEY_SIZE-Not supported by mod_ssl
    SSL_SERVER_SESSIONDIR-Not supported by mod_ssl
    SSL_SERVER_CERTIFICATELOGDIR-Not supported by mod_ssl
    SSL_SERVER_CERTFILE-Not supported by mod_ssl
    SSL_SERVER_KEYFILE-Not supported by mod_ssl
    SSL_SERVER_KEYFILETYPE-Not supported by mod_ssl
    SSL_CLIENT_KEY_EXP-Not supported by mod_ssl
    SSL_CLIENT_KEY_ALGORITHM-Not supported by mod_ssl
    SSL_CLIENT_KEY_SIZE-Not supported by mod_ssl


    Custom Log Functions

    When mod_ssl is built into Apache or at least loaded (under DSO situation) additional functions exist for the Custom Log Format of mod_log_config as documented in the Reference Chapter. Beside the ``%{varname}x'' eXtension format function which can be used to expand any variables provided by any module, an additional Cryptography ``%{name}c'' cryptography format function exists for backward compatibility. The currently implemented function calls are listed in Table 3.

    Table 3: Custom Log Cryptography Function
    Function Call Description
    %...{version}c SSL protocol version
    %...{cipher}c SSL cipher
    %...{subjectdn}c Client Certificate Subject Distinguished Name
    %...{issuerdn}c Client Certificate Issuer Distinguished Name
    %...{errcode}c Certificate Verification Error (numerical)
    %...{errstr}c Certificate Verification Error (string)


    previous page
    Reference
    next page
    HowTo
    mod_ssl 2.8, User Manual
    The Apache Interface to OpenSSL
    Copyright © 1998-2001 Ralf S. Engelschall
    All Rights Reserved