** Description changed: Feature Freeze Exception (FFe): ------------------------------- - Since this may take a little longer now and noble's FF is coming up soon, - I'm pro-actively transferring this request into a feature freeze exception (FFe). + Since the work on this request may take a little longer and noble's FF is + today, this request got transferred into a feature freeze exception (FFe). - The main reason for this request is a new functionality and the use case that one wants to protect the private key of a httpd server by using a PKCS#11 based (HSM based) private key for the server instead of using a clear key. - Which would subsequently open business opportunity esp. on the s390x platform. + The driver for this is the need to update mod_ssl in Apache2 to support + openssl 3.x providers, since engines are deprecated in openssl 3.x. + + This new functionality (openssl provider support) is required for the + use case that one wants to protect the private key of a httpd server + by using a PKCS#11 based (HSM based) private key for the server + instead of using a clear key. + + This would subsequently open business opportunity esp. on the s390x + platform. The diff/delta in the 2.5.x/trunk CHANGES file (https://github.com/apache/httpd/blob/trunk/CHANGES) is: " - *) mod_ssl: Support loading certificates and private keys from the - PKCS#11 OpenSSL engine. [Anderson Sasaki <ansasaki redhat.com>, - Joe Orton] + *) mod_ssl: Support loading certificates and private keys from the + PKCS#11 OpenSSL engine. [Anderson Sasaki <ansasaki redhat.com>, + Joe Orton] " - In addition a reference to Revision 1914365 seems to be useful, that provides further details: + In addition the reference to Revision 1914365 seems to be useful reference, + that provides further details: https://svn.apache.org/viewvc?view=revision&revision=1914365 Once backports for 2.4.x are available: - a test build in PPA will be done (and a build log can be provided) - install and upgrade tests will be done (and an install log can be provided) The new package should not break any other packages that depend on it, since there are no changes in the dependencies (or package meta data in general) expected. A description of a sample setup, incl. all affected components, can be taken from here: https://www.ibm.com/docs/en/linux-on-z?topic=linuxone-libp11-engine (The sample is based on RHEL, but except the patches discussed here, - this generally applies to other distributions as well). + this generally applies to other distributions as well). 'Figure - 1' provides a graphical representation of the overall use case setup. The above sample setup does incl. test steps; look for 'Testing' --> 'Test with Apache web server' (Test uses "httpd -X" and "openssl s_client".) Once an Ubuntu based Apache 2.4.x test build for noble is available, and the logs (see above are available) the 'ubuntu-release' team can finally be subscribed. __________ Enable an E2E use case that allows to configure an Apache webserver to protect its private keys with an HSM that is addressable via an PKCS #11 (signing) provider configured for an openSSL 3.0 library. Accepted for httpd > 2.4.58, see https://svn.apache.org/viewvc?view=revision&revision=1914365
** Tags added: noble -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2050017 Title: [FFe] [24.04 FEAT] [SEC2339] HSM protected signing support for Apache httpd for openSSL 3.0 with PKCS #11 provider To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-z-systems/+bug/2050017/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
