mod_ssl: Add support for OpenSSL providers

CHANGES

@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_ssl: Add support for OpenSSL providers across all certificates,
+     CA certificates, CRLs and keys. [Graham Leggett]
+
   *) mod_proxy_beacon: Back-end reverse proxy servers can announce
      themselves and be auto-added to their front-end proxy balancer.
      [Jim Jagielski]

modules/ssl/mod_ssl.c

@@ -110,6 +110,9 @@ static const command_rec ssl_config_cmds[] = {
     SSL_CMD_ALL(CipherSuite, TAKE12,
                 "Colon-delimited list of permitted SSL Ciphers, optional preceded "
                 "by protocol identifier ('XXX:...:XXX' - see manual)")
+    SSL_CMD_SRV(CertificateURI, TAKE1,
+                "SSL Server Certificate/Key uri "
+                "('file:', 'pkcs11:' - URI of certificate or key)")
     SSL_CMD_SRV(CertificateFile, TAKE1,
                 "SSL Server Certificate file "
                 "('/path/to/file' - PEM or DER encoded)")
@@ -129,6 +132,9 @@ static const command_rec ssl_config_cmds[] = {
                 "TLS ECH Key Directory"
                 "('/path/to/dir' - directory with ECH key pairs)")
 #endif
+    SSL_CMD_SRV(CACertificateURI, TAKE1,
+                "SSL CA Certificate uri "
+                "('file:', 'pkcs11:' - URI of CA certificates)")
     SSL_CMD_ALL(CACertificatePath, TAKE1,
                 "SSL CA Certificate path "
                 "('/path/to/dir' - contains PEM encoded files)")
@@ -141,6 +147,9 @@ static const command_rec ssl_config_cmds[] = {
     SSL_CMD_SRV(CADNRequestFile, TAKE1,
                 "SSL CA Distinguished Name file "
                 "('/path/to/file' - PEM encoded to derive acceptable CA names to request)")
+    SSL_CMD_SRV(CARevocationURI, TAKE1,
+                "SSL CA Certificate Revocation List (CRL) uri "
+                "('file:', 'pkcs11:' - URI of CRLs)")
     SSL_CMD_SRV(CARevocationPath, TAKE1,
                 "SSL CA Certificate Revocation List (CRL) path "
                 "('/path/to/dir' - contains PEM encoded files)")
@@ -216,12 +225,18 @@ static const command_rec ssl_config_cmds[] = {
     SSL_CMD_PXY(ProxyVerifyDepth, TAKE1,
                "SSL Proxy: maximum certificate verification depth "
                "('N' - number of intermediate certificates)")
+    SSL_CMD_PXY(ProxyCACertificateURI, TAKE1,
+                "SSL Proxy: uri referring to server certificates "
+                "('file:', 'pkcs11:' - URI of CA certificates)")
     SSL_CMD_PXY(ProxyCACertificateFile, TAKE1,
                "SSL Proxy: file containing server certificates "
                "('/path/to/file' - PEM encoded certificates)")
     SSL_CMD_PXY(ProxyCACertificatePath, TAKE1,
                "SSL Proxy: directory containing server certificates "
                "('/path/to/dir' - contains PEM encoded certificates)")
+    SSL_CMD_PXY(ProxyCARevocationURI, TAKE1,
+                "SSL Proxy: CA Certificate Revocation List (CRL) uri "
+                "('file:', 'pkcs11:' - URI of CRLs)")
     SSL_CMD_PXY(ProxyCARevocationPath, TAKE1,
                 "SSL Proxy: CA Certificate Revocation List (CRL) path "
                 "('/path/to/dir' - contains PEM encoded files)")
@@ -230,6 +245,9 @@ static const command_rec ssl_config_cmds[] = {
                 "('/path/to/file' - PEM encoded)")
     SSL_CMD_PXY(ProxyCARevocationCheck, RAW_ARGS,
                 "SSL Proxy: CA Certificate Revocation List (CRL) checking mode")
+    SSL_CMD_PXY(ProxyMachineCertificateURI, TAKE1,
+                "SSL Proxy: uri referring to client certificates "
+                "('file:', 'pkcs11:' - URI of certificate or key)")
     SSL_CMD_PXY(ProxyMachineCertificateFile, TAKE1,
                "SSL Proxy: file containing client certificates "
                "('/path/to/file' - PEM encoded certificates)")

modules/ssl/mod_ssl_openssl.h

@@ -33,6 +33,8 @@
 #include <openssl/opensslv.h>
 #if OPENSSL_VERSION_NUMBER >= 0x30000000
 #include <openssl/macros.h> /* for OPENSSL_API_LEVEL */
+#include <openssl/store.h> /* for OSSL_STORE_open_ex */
+#include <openssl/ui.h> /* for UI_null */
 #endif
 #if OPENSSL_VERSION_NUMBER >= 0x10001000
 /* must be defined before including ssl.h */