(tomcat) branch main updated: Better SSLValve docs

[markt]

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/main by this push:
     new f7b93176e5 Better SSLValve docs
f7b93176e5 is described below

commit f7b93176e5bd8fd0a26ea190c502b273c0deec94
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Mon Jul 27 17:30:32 2026 +0100

    Better SSLValve docs
---
 webapps/docs/changelog.xml    |  5 +++++
 webapps/docs/config/valve.xml | 13 +++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 2a366927bd..b247e4cb97 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -447,6 +447,11 @@
         Tapestry attributes, used for locale session sorting. (remm)
       </update>
       <!-- Entries for backport and removal before 12.0.0-M1 below this line 
-->
+      <fix>
+        Documentation: Better sample httpd configuration for use with SSLValve
+        and add a note that the exact configuration required will depend on the
+        overall httpd configuration. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="jdbc-pool">
diff --git a/webapps/docs/config/valve.xml b/webapps/docs/config/valve.xml
index 895dfd94c5..52f1460458 100644
--- a/webapps/docs/config/valve.xml
+++ b/webapps/docs/config/valve.xml
@@ -1148,13 +1148,22 @@
     <p>Note: Ensure that the headers are always set by httpd for all requests 
to
     prevent a client spoofing SSL information by sending fake headers.</p>
 
-    <p>To configure httpd to set the necessary headers, add the following:</p>
+    <p>The exact configuration required in httpd will vary depending on the
+    details of the full httpd configuration but it is likely that the
+    configuration required will be similar to the following:</p>
 <source>&lt;IfModule ssl_module&gt;
   RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
   RequestHeader set SSL_CIPHER "%{SSL_CIPHER}s"
   RequestHeader set SSL_SESSION_ID "%{SSL_SESSION_ID}s"
   RequestHeader set SSL_CIPHER_USEKEYSIZE "%{SSL_CIPHER_USEKEYSIZE}s"
-&lt;/IfModule&gt;</source>
+&lt;/IfModule&gt;
+&lt;IfModule !ssl_module&gt;
+  RequestHeader unset SSL_CLIENT_CERT
+  RequestHeader unset SSL_CIPHER
+  RequestHeader unset SSL_SESSION_ID
+  RequestHeader unset SSL_CIPHER_USEKEYSIZE
+&lt;/IfModule&gt;
+RequestHeader unset SSL_CLIENT_ESCAPED_CERT</source>
 
   </subsection>
 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org