SSL/TLS Strong Encryption: Compatibility

This page covers backwards compatibility between modssl and other SSL solutions. modssl is not the only SSL solution for Apache; four additional products are (or were) also available: Ben Laurie's freely available Apache-SSL (from where modssl were originally derived in 1998), Red Hat's commercial Secure Web Server (which was based on modssl), Covalent's commercial Raven SSL Module (also based on modssl) and finally C2Net's (now Red Hat's) commercial product Stronghold (based on a different evolution branch, named Sioux up to Stronghold 2.x, and based on modssl since Stronghold 3.x).

modssl mostly provides a superset of the functionality of all the other solutions, so it's simple to migrate from one of the older modules to modssl. The configuration directives and environment variable names used by the older SSL solutions vary from those used in modssl; mapping tables are included here to give the equivalents used by modssl.

| Old Directive | modssl Directive | Comment | |---|---|---| | Apache-SSL 1.x & modssl 2.0.x compatibility: | || SSLEnable | SSLEngine on | compactified | SSLDisable | SSLEngine off | compactified | SSLLogFile file | | Use per-module setting instead. | SSLRequiredCiphers spec | SSLCipherSuite spec | renamed | SSLRequireCipher c1 ... | SSLRequire %{SSLCIPHER} in {" c1 ", ...} | generalized | SSLBanCipher c1 ... | SSLRequire not (%{SSLCIPHER} in {" c1 ", ...}) | generalized | SSLFakeBasicAuth | SSLOptions +FakeBasicAuth | merged | SSLCacheServerPath dir | - | functionality removed | SSLCacheServerPort integer | - | functionality removed | | Apache-SSL 1.x compatibility: | || SSLExportClientCertificates | SSLOptions +ExportCertData | merged | SSLCacheServerRunDir dir | - | functionality not supported | | Sioux 1.x compatibility: | || SSLCertFile file | SSLCertificateFile file | renamed | SSLKeyFile file | SSLCertificateKeyFile file | renamed | SSLCipherSuite arg | SSLCipherSuite arg | renamed | SSLX509VerifyDir arg | SSLCACertificatePath arg | renamed | SSLLog file | - | Use per-module setting instead. | SSLConnect flag | SSLEngine flag | renamed | SSLClientAuth arg | SSLVerifyClient arg | renamed | SSLX509VerifyDepth arg | SSLVerifyDepth arg | renamed | SSLFetchKeyPhraseFrom arg | - | not directly mappable; use SSLPassPhraseDialog | SSLSessionDir dir | - | not directly mappable; use SSLSessionCache | SSLRequire expr | - | not directly mappable; use SSLRequire | SSLCertFileType arg | - | functionality not supported | SSLKeyFileType arg | - | functionality not supported | SSLX509VerifyPolicy arg | - | functionality not supported | SSLLogX509Attributes arg | - | functionality not supported | | Stronghold 2.x compatibility: | || StrongholdAccelerator engine | SSLCryptoDevice engine | renamed | StrongholdKey dir | - | functionality not needed | StrongholdLicenseFile dir | - | functionality not needed | SSLFlag flag | SSLEngine flag | renamed | SSLSessionLockFile file | SSLMutex file | renamed | SSLCipherList spec | SSLCipherSuite spec | renamed | RequireSSL | SSLRequireSSL | renamed | SSLErrorFile file | - | functionality not supported | SSLRoot dir | - | functionality not supported | SSLCertificateLogDir dir | - | functionality not supported | AuthCertDir dir | - | functionality not supported | SSL_Group name | - | functionality not supported | SSLProxyMachineCertPath dir | SSLProxyMachineCertificatePath dir | renamed | SSLProxyMachineCertFile file | SSLProxyMachineCertificateFile file | renamed | SSLProxyCipherList spec | SSLProxyCipherSpec spec | renamed |

| Old Variable | modssl Variable | Comment | |---|---|---| SSLPROTOCOLVERSION | SSLPROTOCOL | renamed | SSLEAYVERSION | SSLVERSIONLIBRARY | renamed | HTTPSSECRETKEYSIZE | SSLCIPHERUSEKEYSIZE | renamed | HTTPSKEYSIZE | SSLCIPHERALGKEYSIZE | renamed | HTTPSCIPHER | SSLCIPHER | renamed | HTTPSEXPORT | SSLCIPHEREXPORT | renamed | SSLSERVERKEYSIZE | SSLCIPHERALGKEYSIZE | renamed | SSLSERVERCERTIFICATE | SSLSERVERCERT | renamed | SSLSERVERCERTSTART | SSLSERVERVSTART | renamed | SSLSERVERCERTEND | SSLSERVERVEND | renamed | SSLSERVERCERTSERIAL | SSLSERVERMSERIAL | renamed | SSLSERVERSIGNATUREALGORITHM | SSLSERVERASIG | renamed | SSLSERVERDN | SSLSERVERSDN | renamed | SSLSERVERCN | SSLSERVERSDNCN | renamed | SSLSERVEREMAIL | SSLSERVERSDNEmail | renamed | SSLSERVERO | SSLSERVERSDNO | renamed | SSLSERVEROU | SSLSERVERSDNOU | renamed | SSLSERVERC | SSLSERVERSDNC | renamed | SSLSERVERSP | SSLSERVERSDNSP | renamed | SSLSERVERL | SSLSERVERSDNL | renamed | SSLSERVERIDN | SSLSERVERIDN | renamed | SSLSERVERICN | SSLSERVERIDNCN | renamed | SSLSERVERIEMAIL | SSLSERVERIDNEmail | renamed | SSLSERVERIO | SSLSERVERIDNO | renamed | SSLSERVERIOU | SSLSERVERIDNOU | renamed | SSLSERVERIC | SSLSERVERIDNC | renamed | SSLSERVERISP | SSLSERVERIDNSP | renamed | SSLSERVERIL | SSLSERVERIDNL | renamed | SSLCLIENTCERTIFICATE | SSLCLIENTCERT | renamed | SSLCLIENTCERTSTART | SSLCLIENTVSTART | renamed | SSLCLIENTCERTEND | SSLCLIENTVEND | renamed | SSLCLIENTCERTSERIAL | SSLCLIENTMSERIAL | renamed | SSLCLIENTSIGNATUREALGORITHM | SSLCLIENTASIG | renamed | SSLCLIENTDN | SSLCLIENTSDN | renamed | SSLCLIENTCN | SSLCLIENTSDNCN | renamed | SSLCLIENTEMAIL | SSLCLIENTSDNEmail | renamed | SSLCLIENTO | SSLCLIENTSDNO | renamed | SSLCLIENTOU | SSLCLIENTSDNOU | renamed | SSLCLIENTC | SSLCLIENTSDNC | renamed | SSLCLIENTSP | SSLCLIENTSDNSP | renamed | SSLCLIENTL | SSLCLIENTSDNL | renamed | SSLCLIENTIDN | SSLCLIENTIDN | renamed | SSLCLIENTICN | SSLCLIENTIDNCN | renamed | SSLCLIENTIEMAIL | SSLCLIENTIDNEmail | renamed | SSLCLIENTIO | SSLCLIENTIDNO | renamed | SSLCLIENTIOU | SSLCLIENTIDNOU | renamed | SSLCLIENTIC | SSLCLIENTIDNC | renamed | SSLCLIENTISP | SSLCLIENTIDNSP | renamed | SSLCLIENTIL | SSLCLIENTIDNL | renamed | SSLEXPORT | SSLCIPHEREXPORT | renamed | SSLKEYSIZE | SSLCIPHERALGKEYSIZE | renamed | SSLSECKEYSIZE | SSLCIPHERUSEKEYSIZE | renamed | SSLSSLEAYVERSION | SSLVERSIONLIBRARY | renamed | SSLSTRONGCRYPTO | - | Not supported by modssl | SSLSERVERKEYEXP | - | Not supported by modssl | SSLSERVERKEYALGORITHM | - | Not supported by modssl | SSLSERVERKEYSIZE | - | Not supported by modssl | SSLSERVERSESSIONDIR | - | Not supported by modssl | SSLSERVERCERTIFICATELOGDIR | - | Not supported by modssl | SSLSERVERCERTFILE | - | Not supported by modssl | SSLSERVERKEYFILE | - | Not supported by modssl | SSLSERVERKEYFILETYPE | - | Not supported by modssl | SSLCLIENTKEYEXP | - | Not supported by modssl | SSLCLIENTKEYALGORITHM | - | Not supported by modssl | SSLCLIENTKEYSIZE | - | Not supported by modssl |

'' cryptography format function exists for backward compatibility. The currently implemented function calls are listed in Table 3.

| Function Call | Description | |---|---| %...{version}c | SSL protocol version | %...{cipher}c | SSL cipher | %...{subjectdn}c | Client Certificate Subject Distinguished Name | %...{issuerdn}c | Client Certificate Issuer Distinguished Name | %...{errcode}c | Certificate Verification Error (numerical) | %...{errstr}c | Certificate Verification Error (string) |

Modules | Directives | FAQ | Glossary | Sitemap

Apache HTTP Server Version 2.4