You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by sa...@flextronicssoftware.com on 2005/12/21 06:21:20 UTC
Code update to handle apache dynamic configuration updates to httpd.conf.
Hi All,
My requirement is adding/configuring ssl virtual hosts dynamically to
apache web server at runtime without apache restart.
Details:
I need to handle multiple virtual hosts ( IP based virtual host
configuration) with ssl support for each virtual host.
Each virtual host has its own certificates and key (maintained in files).
And I need to generate fresh keys and certificates and update these
certificates for a particular virtual host at runtime. I am able to do this
change in httpd.conf. This updates take into effect only after I restart
the apache.
But my requirement is that I shouln't restart the apache web server while
updating the certificates. As there are many other requests to other
virtual hosts are being processed.
1) So would like to know is there any way where I can make apache read the
cirticates details freshly without restart of apache.
2) Is there any configuration which would make re-read of the httpd.conf.
Note: I am open to fallow other methods of storing keys and certificates.
e.g storing LDAP if needed.
Pls let me know what source code updates would help me to get to this
functionality.
Pls reply back ASAP.
Thanks & Regards,
Prathama.
*********************** FSS-Unclassified ***********************
*********************** FSS-Unclassified ***********************
"DISCLAIMER: This message is proprietary to Hughes Software Systems Limited
(HSS) and is intended solely for the use of the individual to whom it is
addressed. It may contain privileged or confidential information and
should not be circulated or used for any purpose other than for what it is
intended. If you have received this message in error, please notify the
originator immediately. If you are not the intended recipient, you are
notified that you are strictly prohibited from using, copying, altering, or
disclosing the contents of this message. HSS accepts no responsibility for
loss or damage arising from the use of the information transmitted by this
email including damage from virus."
Re: Code update to handle apache dynamic configuration updates
to httpd.conf.
Posted by Greg Marr <gr...@alum.wpi.edu>.
Prathama first wrote:
>But my requirement is that I shouln't restart the apache web server
>while
>updating the certificates. As there are many other requests to other
>virtual hosts are being processed.
Prathama then wrote:
>But the requirement for my project itself is to be able to update
>the configuration (update SSL certificates/key of a virtual host)
>dynamically without restart.
I think if you reworded your requirements a bit, then you would have
a better chance at finding a solution that will work for you.
"My requirement is that I update the certificate without losing the
many other requests to other virtual hosts that are being processed."
Re: Code update to handle apache dynamic configuration updates to
httpd.conf.
Posted by Paul Querna <ch...@force-elite.com>.
sanganakal.Kote@flextronicssoftware.com wrote:
>
>
>
> Hi Paul,
>
> I appreciate u'r response. Thank you.
>
> Could u pls elaborate more on the "2) Dynamic loading of SSL Certificates.
> ".
> I would like to give a try on this. How can I proceed on this. Where all I
> have to do the modifications?
>
> And one more thing is I can keep the passphrase same in old and new
> certificate/key.
>
> Pls reply back.
Dynamic SSL Certificates is worthless until you do the first part,
dynamic server_rec*.
-Paul
Re: Code update to handle apache dynamic configuration updates to
httpd.conf.
Posted by sa...@flextronicssoftware.com.
Hi Paul,
I appreciate u'r response. Thank you.
Could u pls elaborate more on the "2) Dynamic loading of SSL Certificates.
".
I would like to give a try on this. How can I proceed on this. Where all I
have to do the modifications?
And one more thing is I can keep the passphrase same in old and new
certificate/key.
Pls reply back.
Thanks & Regards,
Prathama.
Paul Querna
<chip@force-elite
.com> To
dev@httpd.apache.org
12/21/2005 11:11 cc
AM
Subject
Re: Code update to handle apache
Please respond to dynamic configuration updates to
dev@httpd.apache. httpd.conf.
org
sanganakal.Kote@flextronicssoftware.com wrote:
>
>
>
> Yes I do understand the issues. But the project requires this to be done.
> You said "There are also issues with loading SSLCerts without a full
> restart...."
>
> Do you mean there is a way to load SSLCerts without a restart?
> Pls let me know.
I will start over.
There are many issues to this problem. Here are the biggest:
1) Dynamic creation of server_recs. There is currently no way to add a
server_rec, to the core, and to the listening interfaces, without at
least a graceful restart. This is a VERY complicated issue. It would
require a major rewrite of many core functions, and the addition of
locking, and perhaps even a garbage collection or reference counting
system, to handle the deletion of sever_recs.
2) Dynamic loading of SSL Certificates. Easier, but still hard. Will
require large modifications to mod_ssl, and documentation that things
like ssl passphrase can't work. Will also require large modifications
to dynamically load certs from LDAP.
These are both very large and difficult problems. They both might be
better addressed in the long run, by a complete rewrite of the
configuration system. It would be an interesting exercise, but I have
better fish to fry.
-Paul
*********************** FSS-Unclassified ***********************
*********************** FSS-Unclassified ***********************
"DISCLAIMER: This message is proprietary to Hughes Software Systems Limited
(HSS) and is intended solely for the use of the individual to whom it is
addressed. It may contain privileged or confidential information and
should not be circulated or used for any purpose other than for what it is
intended. If you have received this message in error, please notify the
originator immediately. If you are not the intended recipient, you are
notified that you are strictly prohibited from using, copying, altering, or
disclosing the contents of this message. HSS accepts no responsibility for
loss or damage arising from the use of the information transmitted by this
email including damage from virus."
Re: Code update to handle apache dynamic configuration updates to
httpd.conf.
Posted by Paul Querna <ch...@force-elite.com>.
sanganakal.Kote@flextronicssoftware.com wrote:
>
>
>
> Yes I do understand the issues. But the project requires this to be done.
> You said "There are also issues with loading SSLCerts without a full
> restart...."
>
> Do you mean there is a way to load SSLCerts without a restart?
> Pls let me know.
I will start over.
There are many issues to this problem. Here are the biggest:
1) Dynamic creation of server_recs. There is currently no way to add a
server_rec, to the core, and to the listening interfaces, without at
least a graceful restart. This is a VERY complicated issue. It would
require a major rewrite of many core functions, and the addition of
locking, and perhaps even a garbage collection or reference counting
system, to handle the deletion of sever_recs.
2) Dynamic loading of SSL Certificates. Easier, but still hard. Will
require large modifications to mod_ssl, and documentation that things
like ssl passphrase can't work. Will also require large modifications
to dynamically load certs from LDAP.
These are both very large and difficult problems. They both might be
better addressed in the long run, by a complete rewrite of the
configuration system. It would be an interesting exercise, but I have
better fish to fry.
-Paul
Re: Code update to handle apache dynamic configuration updates to
httpd.conf.
Posted by sa...@flextronicssoftware.com.
Yes I do understand the issues. But the project requires this to be done.
You said "There are also issues with loading SSLCerts without a full
restart...."
Do you mean there is a way to load SSLCerts without a restart?
Pls let me know.
Thanks & Regards,
Prathama.
Paul Querna
<chip@force-elite
.com> To
dev@httpd.apache.org
12/21/2005 10:58 cc
AM
Subject
Re: Code update to handle apache
Please respond to dynamic configuration updates to
dev@httpd.apache. httpd.conf.
org
Philip M. Gollucci wrote:
>> Hi All,
>>
>> My requirement is adding/configuring ssl virtual hosts dynamically to
>> apache web server at runtime without apache restart.
> why not just do a graceful restart.
>
> http://httpd.apache.org/docs/trunk/stopping.html#graceful
Its actually quite slow if you have lots of vhosts, and change them often.
There are also issues with loading SSLCerts without a full restart....
-Paul
*********************** FSS-Unclassified ***********************
"DISCLAIMER: This message is proprietary to Hughes Software Systems Limited
(HSS) and is intended solely for the use of the individual to whom it is
addressed. It may contain privileged or confidential information and
should not be circulated or used for any purpose other than for what it is
intended. If you have received this message in error, please notify the
originator immediately. If you are not the intended recipient, you are
notified that you are strictly prohibited from using, copying, altering, or
disclosing the contents of this message. HSS accepts no responsibility for
loss or damage arising from the use of the information transmitted by this
email including damage from virus."
Re: Code update to handle apache dynamic configuration updates to
httpd.conf.
Posted by Paul Querna <ch...@force-elite.com>.
Philip M. Gollucci wrote:
>> Hi All,
>>
>> My requirement is adding/configuring ssl virtual hosts dynamically to
>> apache web server at runtime without apache restart.
> why not just do a graceful restart.
>
> http://httpd.apache.org/docs/trunk/stopping.html#graceful
Its actually quite slow if you have lots of vhosts, and change them often.
There are also issues with loading SSLCerts without a full restart....
-Paul
Re: Code update to handle apache dynamic configuration updates to
httpd.conf.
Posted by sa...@flextronicssoftware.com.
Hi Philip,
Thank you for response.
But the requirement for my project itself is to be able to update the
configuration (update SSL certificates/key of a virtual host) dynamically
without restart.
Thanks & Regards,
Prathama.
"Philip M.
Gollucci"
<pgollucci@p6m7g8 To
.com> dev@httpd.apache.org
cc
12/21/2005 10:52
AM Subject
Re: Code update to handle apache
dynamic configuration updates to
Please respond to httpd.conf.
dev@httpd.apache.
org
> Hi All,
>
> My requirement is adding/configuring ssl virtual hosts dynamically to
> apache web server at runtime without apache restart.
why not just do a graceful restart.
http://httpd.apache.org/docs/trunk/stopping.html#graceful
*********************** FSS-Unclassified ***********************
*********************** FSS-Unclassified ***********************
"DISCLAIMER: This message is proprietary to Hughes Software Systems Limited
(HSS) and is intended solely for the use of the individual to whom it is
addressed. It may contain privileged or confidential information and
should not be circulated or used for any purpose other than for what it is
intended. If you have received this message in error, please notify the
originator immediately. If you are not the intended recipient, you are
notified that you are strictly prohibited from using, copying, altering, or
disclosing the contents of this message. HSS accepts no responsibility for
loss or damage arising from the use of the information transmitted by this
email including damage from virus."
Re: Code update to handle apache dynamic configuration updates to
httpd.conf.
Posted by "Philip M. Gollucci" <pg...@p6m7g8.com>.
> Hi All,
>
> My requirement is adding/configuring ssl virtual hosts dynamically to
> apache web server at runtime without apache restart.
why not just do a graceful restart.
http://httpd.apache.org/docs/trunk/stopping.html#graceful