Permalink
Browse files

Remove obsolete TODOs for mod_ssl:

No, we don't - it was removed in r90511.

DH keys are changed for every connection, SSL_OP_SINGLE_DH_USE
is applied since mod_ssl's initial commit (r88988).

We no longer have our own CRL callback (delegated to OpenSSL
as of r1165056), so this is effectively moot.

ssl_engine_pphrase.c needs to be simplified, not blown up further
(see also https://issues.apache.org/bugzilla/show_bug.cgi?id=24031,
which few [if any] people really seem to miss)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1546690 13f79535-47bb-0310-9956-ffa450edef68
  • Loading branch information...
1 parent f0fef42 commit a053f47d8e55b178133a41a51513ae79451c5d8f Kaspar Brand committed Nov 30, 2013
Showing with 0 additions and 12 deletions.
  1. +0 −12 STATUS
View
@@ -323,22 +323,10 @@ RELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:
TODO ISSUES REMAINING IN MOD_SSL:
- * Do we need SSL_set_read_ahead()?
-
* SSLRequire directive (parsing of) leaks memory
- * Diffie-Hellman-Parameters for temporary keys are hardcoded in
- ssl_engine_dh.c, while the comment in ssl_engine_kernel.c says:
- "it is suggested that keys be changed daily or every 500
- transactions, and more often if possible."
-
* ssl_var_lookup could be rewritten to be MUCH faster
- * CRL callback should be pluggable
-
- * ssl_engine_pphrase.c needs to be reworked so it is generic enough
- to also decrypt proxy keys
-
WISH LIST
* mod_proxy: Ability to run SSL over proxy gateway connections,
encrypting (or reencrypting) at the proxy.

0 comments on commit a053f47

Please sign in to comment.