Stefan Eissing in gmane.comp.apache.devel (Mon, 5 Aug 2019 11:01:32 +0200): >I suspect it is the change in mod_ssl interface to the other modules. I >have to write a test for it. > >It used to be that this chain file was ignored in mod_ssl 2.4.39 when it >retrieved certificates from mod_md. Now mod_md adds its certificate via >a hook and the chain file seems to remain in effect. > >I would say that 2.4.40 refuses a configuration that does not really >make sense. And 2.4.39 silently ignored it.
2.4.40 accepts the configuration when there is a valid MDomain certificate. Then the intermediate certificate is loaded twice: by mod_md's hook and by the SSLCertificateChainFile directive. 2.4.40 apparently only refuses a fallback certificate in combination with the ChainFile. -- Jan
