You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2008/08/23 13:53:44 UTC
DO NOT REPLY [Bug 45677] New: Location and LocationMatch directive
is defect when used with SSLCACertificateFile
https://issues.apache.org/bugzilla/show_bug.cgi?id=45677
Summary: Location and LocationMatch directive is defect when used
with SSLCACertificateFile
Product: Apache httpd-2
Version: 2.2.3
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_ssl
AssignedTo: bugs@httpd.apache.org
ReportedBy: etirk@hotmail.com
When trying to apply different certificates through SSLCACertificateFile under
different <Location> directives in ssl.conf, apache2 applies the last of the
<Location>-directives instead of the one actually matching.
In the example below the last certificate, certificate3, is always served to
the browser, if any of the above <Location>-directives match. Thus entering
http://my.domain.se/path1 will prompt you with certificate3, as will
http://my.domain.se/path2, and of course the last url will also give the third
cirtificate. LocationMatch and tons of different matching patterns has been
tested without any luck. LocationMatch is showing the exact same behaviour.
ssl.conf:
LoadModule ssl_module modules/mod_ssl.so
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout 300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
<VirtualHost _default_:443>
ServerName my.domain.se:443
JkMount /* loadbalancer
SSLCertificateFile
/etc/pki/tls/certs/my_domain_se_VeriSign_Class_Extended_Validation_SSL_SGC_CA.pem
SSLCACertificateFile /etc/pki/tls/certs/intermediate.crt
<LocationMatch /path1>
SSLVerifyClient require
SSLVerifyDepth 2
SSLCACertificateFile /etc/pki/tls/certs/certificate1.cer
</LocationMatch>
<LocationMatch /path2>
SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile /etc/pki/tls/certs/certificate2.cer
</LocationMatch>
<LocationMatch /path/that/should/not/match>
SSLVerifyClient require
SSLVerifyDepth 2
SSLCACertificateFile /etc/pki/tls/certs/certificate3.cer
</LocationMatch>
#... log stuff here
</VirtualHost>
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45677] Location and LocationMatch directive is
defect when used with SSLCACertificateFile
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45677
Nick Kew <ni...@webthing.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|normal |trivial
--- Comment #1 from Nick Kew <ni...@webthing.com> 2008-08-23 06:55:52 PST ---
Please note SSLCACertificate file is documented as working in server config or
virtual host. The fact that it doesn't throw a syntax error in <Location> is
incidental; it doesn't mean it's valid there.
I'll leave this report open to nudge myself or anyone else who has the spare
time to make your configuration throw a syntax error.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45677] Location and LocationMatch directive is
defect when used with SSLCACertificateFile
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45677
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
--- Comment #2 from Joe Orton <jo...@redhat.com> 2009-06-23 07:43:44 PST ---
That was done in r757380, as it happens.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org