On 05 Aug 2026, at 07:53, Joe Orton <[email protected]> wrote: >> Minimising directives, which in turn minimises the ways things go wrong, is >> the primary goal. > > I really think that increasing the LoC in mod_ssl by 10% with 7 new > directives is not serving *that* goal well at all.
I think it serves the goal excellently. Clean separation between old behaviour and new, vast improvement in the lives of end users by doing useful work for them that up till now they have to do for themselves for no reason, isn't going to break existing users. > The CADN thing... who cares about using that with a STORE? Windows users. Why would a windows user, or someone who is picking up their certs from a cloud based HSM, etc etc, want to go through some manual process of exporting certs out of their preferred store to be saved as a file somewhere local to a server somewhere. The whole idea to be nice to people and encourage the deployment of secure services starts with removing the pointless make-work. OpenSSL's store mechanism does an excellent job of that and we must use it. >> CRLs are done here, but to be honest they could be folded into >> sslcacertificateuri >> <https://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslcacertificateuri> >> above and have trusted certs and CRLs covered by the same directive. > > +1 > > I would also be very happy to junk the awkward/ugly "SSLProxyMachine" > prefix here in a new directive for something more meaningful like > "SSLProxyClient". Not a bad idea to be fair. I think "SSLStoreURI / SSLTrustURI" and "SSLProxyStoreURI / SSLProxyTrustURI". The URIs refer to certs, keys, crls, etc so "Certificate" is a misnomer. Regards, Graham --
