Hi all, Buried in the SSL tests is a VirtualHost config where the virtual host is called "default" but the certificate is called "localhost".
https://github.com/apache/httpd-tests/blob/trunk/t/conf/ssl/ssl.conf.in#L88 # any string other than _default_ causes an NVH set to be created <VirtualHost default:@ssl_module_name@> SSLEngine on This matters for the SSLStoreURI directive, because in this new world certificates are looked up from a trust store, they are no longer blindly accepted as the first cert in a file. In theory the fix is trivial: # any string other than _default_ causes an NVH set to be created - <VirtualHost default:@ssl_module_name@> + <VirtualHost localhost:@ssl_module_name@> SSLEngine on With the fix, things still work as before, for old directives and new. Is this the correct fix, if anything out there going to break? Remember we are not changing the behaviour of any of the existing SSLCertificate* directives, we are introducing new behaviour in SSLStoreURI and we want to test it. The proposed change looks like this: diff --git a/t/conf/ssl/ssl.conf.in b/t/conf/ssl/ssl.conf.in index 7c90141d..4fb46204 100644 --- a/t/conf/ssl/ssl.conf.in +++ b/t/conf/ssl/ssl.conf.in @@ -53,39 +53,70 @@ SSLPassPhraseDialog builtin </IfDefine> - <IfDefine TEST_SSL_DES3_KEY> - SSLCertificateFile @SSLCA@/asf/certs/server_des3.crt + <IfDefine TEST_SSL_STOREURI> + <IfDefine TEST_SSL_AES256_KEY> + <IfDefine TEST_SSL_ECDSA_CERT> + SSLStoreURI @SSLCA@/asf/certs/server_aes256_ecdsa.crt + SSLStoreURI @SSLCA@/asf/keys/server_aes256_ecdsa.pem + </IfDefine> + <IfDefine !TEST_SSL_ECDSA_CERT> + SSLStoreURI @SSLCA@/asf/certs/server_aes256.crt + SSLStoreURI @SSLCA@/asf/keys/server_aes256.pem + </IfDefine> + </IfDefine> + #else the default is an unencrypted key + <IfDefine !TEST_SSL_AES256_KEY> + <IfDefine TEST_SSL_ECDSA_CERT> + SSLStoreURI @SSLCA@/asf/certs/server_ecdsa.crt + SSLStoreURI @SSLCA@/asf/keys/server_ecdsa.pem + </IfDefine> + <IfDefine !TEST_SSL_ECDSA_CERT> + SSLStoreURI @SSLCA@/asf/certs/server.crt + SSLStoreURI @SSLCA@/asf/keys/server.pem + </IfDefine> + </IfDefine> + + SSLTrustURI @SSLCA@/asf/certs/ca.crt + SSLTrustURI @SSLCA@/asf/crl/ca-bundle.crl - SSLCertificateKeyFile @SSLCA@/asf/keys/server_des3.pem - -# SSLCertificateFile @SSLCA@/asf/certs/server_des3_dsa.crt - -# SSLCertificateKeyFile @SSLCA@/asf/keys/server_des3_dsa.pem </IfDefine> - #else the default is an unencrypted key - <IfDefine !TEST_SSL_DES3_KEY> - SSLCertificateFile @SSLCA@/asf/certs/server.crt - - SSLCertificateKeyFile @SSLCA@/asf/keys/server.pem -# SSLCertificateFile @SSLCA@/asf/certs/server_dsa.crt + <IfDefine !TEST_SSL_STOREURI> + <IfDefine TEST_SSL_AES256_KEY> + <IfDefine TEST_SSL_ECDSA_CERT> + SSLCertificateFile @SSLCA@/asf/certs/server_aes256_ecdsa.crt + SSLCertificateKeyFile @SSLCA@/asf/keys/server_aes256_ecdsa.pem + </IfDefine> + <IfDefine !TEST_SSL_ECDSA_CERT> + SSLCertificateFile @SSLCA@/asf/certs/server_aes256.crt + SSLCertificateKeyFile @SSLCA@/asf/keys/server_aes256.pem + </IfDefine> + </IfDefine> + #else the default is an unencrypted key + <IfDefine !TEST_SSL_AES256_KEY> + <IfDefine TEST_SSL_ECDSA_CERT> + SSLCertificateFile @SSLCA@/asf/certs/server_ecdsa.crt + SSLCertificateKeyFile @SSLCA@/asf/keys/server_ecdsa.pem + </IfDefine> + <IfDefine !TEST_SSL_ECDSA_CERT> + SSLCertificateFile @SSLCA@/asf/certs/server.crt + SSLCertificateKeyFile @SSLCA@/asf/keys/server.pem + </IfDefine> + </IfDefine> + + #SSLCertificateChainFile @SSLCA@/asf/certs/cachain.crt + SSLCACertificateFile @SSLCA@/asf/certs/ca.crt + SSLCACertificatePath @ServerRoot@/conf/ssl + SSLCARevocationFile @SSLCA@/asf/crl/ca-bundle.crl -# SSLCertificateKeyFile @SSLCA@/asf/keys/server_dsa.pem </IfDefine> - #SSLCertificateChainFile @SSLCA@/asf/certs/cachain.crt - - SSLCACertificateFile @SSLCA@/asf/certs/ca.crt - - SSLCACertificatePath @ServerRoot@/conf/ssl - - SSLCARevocationFile @SSLCA@/asf/crl/ca-bundle.crl <IfVersion >= 2.3.15> SSLCARevocationCheck chain </IfVersion> # any string other than _default_ causes an NVH set to be created - <VirtualHost default:@ssl_module_name@> + <VirtualHost localhost:@ssl_module_name@> SSLEngine on #t/ssl/verify.t Regards, Graham --
