You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2023/11/14 11:58:04 UTC

[Bug 68143] New: Global ECC certificate takes precedence on local RSA certificate

https://bz.apache.org/bugzilla/show_bug.cgi?id=68143

            Bug ID: 68143
           Summary: Global ECC certificate takes precedence on local RSA
                    certificate
           Product: Apache httpd-2
           Version: 2.4.54
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_ssl
          Assignee: bugs@httpd.apache.org
          Reporter: marc.stern@approach.be
  Target Milestone: ---

SSLCertificateFile      conf/ssl/default.pem
SSLCertificateKeyFile   conf/ssl/default.pem
<Location />
 SSLCertificateFile      conf/ssl/specific.pem
 SSLCertificateKeyFile   conf/ssl/specific.pem
</Location>

We expect specific.pem to be used.
If both certificates are RSA or ECC, that's what happens.
If default.pem is ECC and specific.pem is RSA, default.pem wins!

This is abnormal and very perturbating when trying to figure out what happens.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 68143] Global ECC certificate takes precedence on local RSA certificate

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68143

Joe Orton <jo...@redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #1 from Joe Orton <jo...@redhat.com> ---
I assume you meant <VirtualHost> there rather than <Location> which obviously
doesn't work. The behaviour here is carefully preserved for backwards
compatibility, see bug 56306 and bug 56353. It's possible we could accept an
RFE to allow resetting the array in vhost context if someone wrote a patch.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org