About:
mod_ssl provides provides strong cryptography for the Apache 1.3 webserver via the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1). It is based on the SSL/TLS toolkit OpenSSL and supports all SSL/TLS related functionality, including RSA and DSA/DH cipher support, X.509 CRL checking, etc. Additionally it provides special Apache related facilities like DBM and shared memory based inter-process SSL session caching. per-URL SSL session renegotiations, DSO support, etc.

Release focus: Minor security fixes

Changes:
Fixed a security bug caused by a format string vulnerability.

Author:
Ralf S. Engelschall [contact developer]

Rating:	reset 1 2 3 4 5 6 7 8 9 10
8.39/10.00 (12 votes)

Homepage:
http://www.modssl.org/
Tar/GZ:
http://www.modssl.org/source/
Changelog:
http://www.modssl.org/news/changelog.html
RPM package:
ftp://ftp.openpkg.org/current/SRC/
Mailing list archive:
http://marc.theaimsgroup.com/?l=apache-modssl

Trove categories: [change]

[Environment]		No Input/Output (Daemon)
[Intended Audience]		End Users/Desktop
[License]		OSI Approved :: BSD License (original)
[Topic]		Internet :: WWW/HTTP :: HTTP Servers

Dependencies: [change]
No dependencies filed

 Branches

Branch	Version	Last release	License	URLs
Default	2.8.29-1.3.39	13-Sep-2007	BSD License (original)

 Releases

Version	Focus	Date
2.8.29-1.3.39	Minor feature enhancements	13-Sep-2007 08:11
2.8.27-1.3.36	Minor bugfixes	18-Jul-2006 09:51
2.8.26-1.3.35	Minor bugfixes	08-May-2006 08:34
2.8.24-1.3.33	Minor security fixes	02-Sep-2005 21:46
2.8.23-1.3.33	Minor bugfixes	06-Jul-2005 14:10
2.8.22-1.3.33	Minor feature enhancements	30-Oct-2004 18:30
2.8.21-1.3.32	Minor feature enhancements	22-Oct-2004 14:29
2.8.19-1.3.31	Minor security fixes	17-Jul-2004 10:50
2.8.16-1.3.29	Minor bugfixes	02-Nov-2003 07:06
2.8.15-1.3.28	N/A	18-Jul-2003 20:55

 Articles referencing this project

Debian: New mod_ssl packages fix acl restriction bypass by Patrick Lenz , in Security Mon, Sep 12th 2005 07:51 SuSE: New apache2 packages fix remote DoS condition by Patrick Lenz , in Security Mon, Sep 6th 2004 07:54 Red Hat: Updated httpd packages fix mod_ssl security flaw by Patrick Lenz , in Security Thu, Sep 2nd 2004 02:32 Debian: New libapache-mod-ssl packages fix multiple vulnerabilities by Patrick Lenz , in Security Thu, Jul 22nd 2004 22:43 Red Hat: Updated httpd and mod_ssl packages fix minor Apache security vulnerabilities by Patrick Lenz , in Security Mon, Jun 14th 2004 14:29

Red Hat: Updated httpd packages fix mod_ssl security issue by Patrick Lenz , in Security Fri, Apr 30th 2004 08:08 Red Hat: Updated apache, httpd, and mod_ssl packages available by Patrick Lenz , in Security Thu, Dec 12th 2002 12:52 Debian: New mod_ssl packages fix cross site scripting by Patrick Lenz , in Security Wed, Oct 23rd 2002 00:53 SuSE: local privilege escalation in mod_ssl/mm by Patrick Lenz , in Security Thu, Aug 1st 2002 01:15 [more articles]

 Comments

[»] There is help for the weak of heart
by Steven Scott - Jan 31st 2001 06:24:33

apachetoolbox.com

[reply] [top]

[»] I don't feel that way
by Macdaddy - Jan 30th 2001 21:57:08

Unfortunately I don't share Matt's easy experience. I've found that installing mod_ssl to be a royal pain in the ass. You would think that after all this time, someone would make it easy to get apache up and running with SSL.

[reply] [top]

[»] I fully agree with you...
by Subhasis - Apr 2nd 2002 23:35:43


> Unfortunately I don't share Matt's easy
> experience. I've found that installing
> mod_ssl to be a royal pain in the ass.
> You would think that after all this
> time, someone would make it easy to get
> apache up and running with SSL.
Installing mod_ssl on Apache is a real pain and I share the pangs of the installation. God,,, for the last one week I am trying to do it without any success. It seems many people are having similar problem (as seen in Usenet) , but not many from Apache or modssl are willing to solve the problems.
Isn't there an easy way to do it?
Subhasis

--
Subhasis Gupta

[reply] [top]

---

[»] Mod_ssl is great!
by jouell - Nov 11th 2000 00:06:12

I spent *way* too long trying to setup apache+ssl, with its poor docs. I downloaded mod_ssl and was up and running in about 20 minutes. Excellent documentation as well as great code. Did I mention the documentation was excellent? It even looks nice with its cascading style sheets!

Grab it if you want an SSL enabled apache....

[reply] [top]

[»] mod_ssl is great!
by Boogie - Jul 14th 1999 14:24:49

I remember looking for a way to give SSL support to Apache about a year ago. I came upon Apache-SSL and SSLeay and decided to try those. Well after some frustration, I got the web server up and running with SSL support but not without several hiccups in the setup process. Then I heard about mod_ssl and OpenSSL and downloaded both. Wow! What a difference. Ralf S. Engelschall's great documentation made the entire setup process easy. Rather than spend hours setting up and configuring Apache to work with the SSL patches of Apache-SSL, I spent far less time setting up mod_ssl. I would recommend that everyone who wants to add SSL support to Apache use the combination of mod_ssl and OpenSSL!

[reply] [top]