(tomcat) branch 11.0.x updated: Better SSLValve docs

[markt]

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/11.0.x by this push:
     new e5e7f134b8 Better SSLValve docs
e5e7f134b8 is described below

commit e5e7f134b8260239c730703277d8799bb266207c
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Mon Jul 27 17:30:32 2026 +0100

    Better SSLValve docs
---
 webapps/docs/changelog.xml    |  5 +++++
 webapps/docs/config/valve.xml | 13 +++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index f4ab87191f..0d80512c43 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -236,6 +236,11 @@
         <bug>70160</bug>: Correct various references to the Servlet
         specification to use version 6.1. (markt)
       </fix>
+      <fix>
+        Documentation: Better sample httpd configuration for use with SSLValve
+        and add a note that the exact configuration required will depend on the
+        overall httpd configuration. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Other">
diff --git a/webapps/docs/config/valve.xml b/webapps/docs/config/valve.xml
index 60f9eeee0d..6f4e1e4b3a 100644
--- a/webapps/docs/config/valve.xml
+++ b/webapps/docs/config/valve.xml
@@ -1308,13 +1308,22 @@
     <p>Note: Ensure that the headers are always set by httpd for all requests 
to
     prevent a client spoofing SSL information by sending fake headers.</p>
 
-    <p>To configure httpd to set the necessary headers, add the following:</p>
+    <p>The exact configuration required in httpd will vary depending on the
+    details of the full httpd configuration but it is likely that the
+    configuration required will be similar to the following:</p>
 <source>&lt;IfModule ssl_module&gt;
   RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
   RequestHeader set SSL_CIPHER "%{SSL_CIPHER}s"
   RequestHeader set SSL_SESSION_ID "%{SSL_SESSION_ID}s"
   RequestHeader set SSL_CIPHER_USEKEYSIZE "%{SSL_CIPHER_USEKEYSIZE}s"
-&lt;/IfModule&gt;</source>
+&lt;/IfModule&gt;
+&lt;IfModule !ssl_module&gt;
+  RequestHeader unset SSL_CLIENT_CERT
+  RequestHeader unset SSL_CIPHER
+  RequestHeader unset SSL_SESSION_ID
+  RequestHeader unset SSL_CIPHER_USEKEYSIZE
+&lt;/IfModule&gt;
+RequestHeader unset SSL_CLIENT_ESCAPED_CERT</source>
 
   </subsection>
 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org