Bug 55593 - Add "SSLServerInfoFile" directive for Certificate Transparency, TACK, etc. (with OpenSSL 1.0.2)
Summary: Add "SSLServerInfoFile" directive for Certificate Transparency, TACK, etc. (w...
Status: RESOLVED WONTFIX
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_ssl (show other bugs)
Version: 2.5-HEAD
Hardware: All All
: P2 enhancement (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords: PatchAvailable
Depends on:
Blocks:
 
Reported: 2013-09-25 01:58 UTC by Trevor Perrin
Modified: 2015-10-26 05:37 UTC (History)
1 user (show)


Attachments
Diff to github trunk's of Sep 24 2013 454409553 (3.58 KB, text/plain)
2013-09-25 01:58 UTC, Trevor Perrin 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Trevor Perrin 2013-09-25 01:58:17 UTC 
Created attachment 30879 [details]
Diff to github trunk's of Sep 24 2013 454409553

Hi,

OpenSSL 1.0.2 will have a new command, "SSL_CTX_use_serverinfo_file(filename)".  This specifies a file of PEM blocks containing TLS ServerHello extension data.  The extension data items will be returned if the client sends a corresponding ClientHello.

This allows support of Certificate Transparency (RFC 6962 SignedCertificateTimestampList) and TACK (draft-perrin-tls-tack-02 TackExtension).

It also allows easy experimentation with stapling other revocation or authorization data into the TLS handshake (OCSP, DNSSEC, etc.).

We'd like to expose this file in Apache via a "SSLServerInfoFile" directive.
Comment 1 Kaspar Brand 2013-12-01 12:13:17 UTC 
Given that OpenSSL 1.0.2 will include support for the "Certificate" command via SSLOpenSSLConfCmd (https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=044f8ca87d0cb3c4c8eded86f793a47108614f1f), also allowing to set per-cert options (http://mail-archives.apache.org/mod_mbox/httpd-dev/201310.mbox/%3C526521D6.9060506%40opensslfoundation.com%3E), I'm resolving this as WONTFIX.
Comment 2 Ralf Hauser 2015-10-26 05:37:17 UTC 
for Tomcat, see Bug 58548

see also http://www.certificate-transparency.org/resources-for-site-owners/apache