Bug 57207 - [mod_ssl] Add a way to retrieve email in alternative names
Summary: [mod_ssl] Add a way to retrieve email in alternative names
Status: RESOLVED FIXED
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_ssl (show other bugs)
Version: 2.5-HEAD
Hardware: All All
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords: FixedInTrunk
Depends on:
Blocks:
 
Reported: 2014-11-13 14:09 UTC by alexandre.martins
Modified: 2015-06-27 07:15 UTC (History)
0 users


Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description alexandre.martins 2014-11-13 14:09:57 UTC 
According to RFC 5280, email address in the subject in certificates is deprecated in favor of alternative name in the certificate extension.

http://tools.ietf.org/html/rfc5280#section-4.1.2.6

However, there is no way to get the mail address of the certificate in that way.

Also, OpenSSL has change its default configuration to not put the mail adress into the subject.

Can you add a way to retrieve that information in mod_ssl ?

Many thanks
Comment 1 Kaspar Brand 2015-01-07 12:30:20 UTC 
The deprecation of the PKCS#9 emailAddress attribute in the subject DN is actually due to RFCs 2632/3850/5750 (not 5280), but anyway, in r1650047, I have now implemented what I proposed in this thread on httpd-dev in May last year:

https://mail-archives.apache.org/mod_mbox/httpd-dev/201405.mbox/%3C6F7A525D-9B6B-479D-B1B3-5AC3FFF48AD9%40sharp.fm%3E

Specifically, you can get at the e-mail address(es) in the client certificate via SSL_CLIENT_SAN_Email_0 etc.

The patch from r1650047 also applies to 2.4.x, so feel free to give it a try with 2.4.10. I'll wait a few days for review feedback and will then propose for backport to 2.4.x.
Comment 2 alexandre.martins 2015-01-07 16:38:38 UTC 
Thank you !

I will make some usability tests to check if this solution works for us.
Comment 3 Kaspar Brand 2015-02-01 08:08:58 UTC 
Proposed for backport to 2.4.x with r1656268.
Comment 4 Kaspar Brand 2015-04-26 07:27:26 UTC 
Backported to 2.4.x in r1676087. To appear in 2.4.13.