SSL cert inheritance from mod_ssl and SNI - #11
Open
xl32 wants to merge 2 commits into
Open
Conversation
A host with "h3" in Protocols now serves HTTP/3 with the certificate mod_ssl already resolved for it (SSLCertificateFile and mod_md alike), the way mod_http2 rides mod_ssl. The certificate and key are loaded in the ap_ssl_add_cert_files hook, during startup while httpd still runs privileged, so a key readable only by root loads for QUIC as it does for mod_ssl instead of failing in the unprivileged child. H3CertificatePath and H3CertificateKeyPath are removed; drop them from existing configurations. Author: Alexander Gerasimov <codeguard gmail.com>
Each virtual host on a shared port now presents its own certificate over HTTP/3, chosen by the client SNI (ServerName and exact ServerAlias names); an unmatched name gets the listener default. A cert_cb on the listener context applies the matched host certificate, key and chain to the connection: SSL_set_SSL_CTX does not switch the certificate of a QUIC connection. Landing it exposed that the module ran with AP_MODULE_FLAG_NONE, so a host without H3 directives shared the main server configuration; per-host H3AltSvc and H3AltSvcMaxAge were silently ignored. Set ALWAYS_MERGE. Test suite: stop.conf never named a pid file, so on builds whose default is run/httpd.pid "apachectl -k stop" stopped nothing and every restart talked to the previous server. With that fixed the suite runs in under two minutes: 122 passed, 2 failed (test_028, the 2.4.68 ErrorDocument crash), 5 skipped. Author: Alexander Gerasimov <codeguard gmail.com>
xl32
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@machine-moon, I believe these updates/fixes are super important for CodeIT repo users and your work also. This allow admins to use mod_http3 nearly the same super easy way they use HTTP/2. No more special files ownership on key and extra directives.
mod_http3 now takes its certificates from mod_ssl (Protocols h3 on an SSLEngine on host is the whole configuration) and loads them before httpd drops privileges, so a root-only key works over QUIC exactly as it does over TCP and the separate H3CertificateXXXPath directives — a second source of truth that drifted on renewal — are gone. On top of that, each virtual host presents its own certificate by SNI, and two latent bugs found along the way are fixed: hosts without H3* directives silently shared the main server's config (per-host H3AltSvc* were ignored), and the test suite's stop.conf never actually stopped the server, which had been masking results.