Skip to content

2.4.x: drop SSLKEYLOGFILE for OpenSSL 3.5 where appropriate #538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

2.4.x: drop SSLKEYLOGFILE for OpenSSL 3.5 where appropriate #538

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6ccb941
* modules/ssl/ssl_private.h: For OpenSSL >= 3.5.0 drop $SSLKEYLOGFILE
notroj Jun 25, 2025
9d9372f
* modules/ssl/ssl_private.h: Fix logic in r1926720 HAVE_OPENSSL_KEYLO…
notroj Jun 25, 2025
0a8a3fa
Describe change.
notroj Jun 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions changes-entries/ssl-less-keylog.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
*) mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
builds which enable it in libssl natively. [Joe Orton]

12 changes: 10 additions & 2 deletions modules/ssl/ssl_private.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,8 +290,16 @@ void free_bio_methods(void);
#define X509_get_notAfter X509_getm_notAfter
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
#define HAVE_OPENSSL_KEYLOG
/* The SSL_CTX_set_keylog_callback() API is present in 1.1.1+.
*
* OpenSSL 3.5+ also provides optional native handling of
* $SSLKEYLOGFILE inside libssl, which duplicates the mod_ssl support.
* The mod_ssl support is hence disabled for 3.5+, unless that OpenSSL
* feature is itself disabled (and OPENSSL_NO_SSLKEYLOG is defined).
*/
#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) \
&& (OPENSSL_VERSION_NUMBER <= 0x30500000L || defined(OPENSSL_NO_SSLKEYLOG))
#define HAVE_OPENSSL_KEYLOG
#endif

#ifdef HAVE_FIPS
Expand Down