Makura no Soshi

I already love the new Apache httpd version 2.2.13 because its mod_ssl finally supports the TLS extension for Server Name Indication. In other words: it allows for every name based VirtualHost to use its own HTTPS certificate.

As a demonstration you can now access this site with https. The only drawback: Internet Explorer on WindowsXP and KDE’s Konqueror do not support the TLS extension but show a certificate error.

Another small but nice feature is the new piped log syntax to launch a process without invoking the shell. On a shared server with about twenty VHosts and all of them logging slightly differently to pipes and syslog this saves a few unnecessary processes.
Update to give an example: My httpd.conf now contains these lines for logging

CustomLog "||/usr/bin/logger -p local2.info -t apache" complete
ErrorLog "||/usr/bin/logger -p local3.info -t apache"

Just one note about updating: OpenSSL (and its FreeBSD port) does not use the TLS extension by default. — One has to configure it with option enable-tlsext (for the port: change the Makefile so it contains the line “EXTRACONFIGURE+= enable-camellia enable-tlsext”).

This entry was posted on Saturday, August 29th, 2009 at 15:06 and is filed under Admin, BSD, english, Web. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.