(tomcat) branch 9.0.x updated: Better SSLValve docs

[markt]

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/9.0.x by this push:
     new 8a10e94d1d Better SSLValve docs
8a10e94d1d is described below

commit 8a10e94d1d456720e618e29eda788f0c93c35723
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Mon Jul 27 17:30:32 2026 +0100

    Better SSLValve docs
---
 webapps/docs/changelog.xml    |  9 +++++++++
 webapps/docs/config/valve.xml | 13 +++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 11c61a2deb..2182a40bfa 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -230,6 +230,15 @@
       </fix>
     </changelog>
   </subsection>
+  <subsection name="Web applications">
+    <changelog>
+      <fix>
+        Documentation: Better sample httpd configuration for use with SSLValve
+        and add a note that the exact configuration required will depend on the
+        overall httpd configuration. (markt)
+      </fix>
+    </changelog>
+  </subsection>
   <subsection name="Other">
     <changelog>
       <update>
diff --git a/webapps/docs/config/valve.xml b/webapps/docs/config/valve.xml
index f2860b31d2..ef9a9e76fd 100644
--- a/webapps/docs/config/valve.xml
+++ b/webapps/docs/config/valve.xml
@@ -1297,13 +1297,22 @@
     <p>Note: Ensure that the headers are always set by httpd for all requests 
to
     prevent a client spoofing SSL information by sending fake headers.</p>
 
-    <p>To configure httpd to set the necessary headers, add the following:</p>
+    <p>The exact configuration required in httpd will vary depending on the
+    details of the full httpd configuration but it is likely that the
+    configuration required will be similar to the following:</p>
 <source>&lt;IfModule ssl_module&gt;
   RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
   RequestHeader set SSL_CIPHER "%{SSL_CIPHER}s"
   RequestHeader set SSL_SESSION_ID "%{SSL_SESSION_ID}s"
   RequestHeader set SSL_CIPHER_USEKEYSIZE "%{SSL_CIPHER_USEKEYSIZE}s"
-&lt;/IfModule&gt;</source>
+&lt;/IfModule&gt;
+&lt;IfModule !ssl_module&gt;
+  RequestHeader unset SSL_CLIENT_CERT
+  RequestHeader unset SSL_CIPHER
+  RequestHeader unset SSL_SESSION_ID
+  RequestHeader unset SSL_CIPHER_USEKEYSIZE
+&lt;/IfModule&gt;
+RequestHeader unset SSL_CLIENT_ESCAPED_CERT</source>
 
   </subsection>
 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org