Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <4F2D406D.6080407@opensslfoundation.com>
Date: Sat, 04 Feb 2012 14:27:57 +0000
From: Dr Stephen Henson <shenson@opensslfoundation.com>
Organization: The OpenSSL Foundation
User-Agent: Mozilla/5.0 (Windows NT 6.0;
 rv:10.0) Gecko/20120129 Thunderbird/10.0
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Certificate handling limitations in mod_ssl.
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

The way mod_ssl currently handles certificates and private keys is rather
restrictive and means some of OpenSSL's current and planned future features
can't be used automatically.

Currently mod_ssl hard codes algorithms and has a limitation of one certificate
per algorithm.

This has two consequences...

1. New algorithms (such as GOST and fixed DH) cannot be configured and need to
be added into the mod_ssl code.

2. Support for multiple certificates for a given algorithm is not supported. For
example future "full" use of ECC ciphersuites might have different certificates
for different curves the selection of which is determined by the curves the
client supports.

IMHO to avoid these problems it would be better if mod_ssl could send an
arbitrary number of certificates and keys to OpenSSL and leave it to OpenSSL to
process them in an appropriate manner.

If finer control over some operations (for example to detect configuration
errors) is required OpenSSL could be extended to support that.

Thoughts?

Steve.
-- 
Dr Stephen Henson. OpenSSL Software Foundation, Inc.
1829 Mount Ephraim Road
Adamstown, MD 21710
+1 877-673-6775
shenson@opensslfoundation.com