libapache2-mod-nss-1.0.8/ 0000750 0000000 0000000 00000000000 11216465673 013574 5 ustar root root libapache2-mod-nss-1.0.8/NEWS 0000640 0000000 0000000 00000000000 11142413654 014250 0 ustar root root libapache2-mod-nss-1.0.8/nss_engine_kernel.c 0000640 0000000 0000000 00000073403 11142413652 017424 0 ustar root root /* Copyright 2001-2004 The Apache Software Foundation
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "mod_nss.h"
#include "secerr.h"
static void HandshakeDone(PRFileDesc *fd, void *doneflag);
/*
* Post Read Request Handler
*/
int nss_hook_ReadReq(request_rec *r)
{
SSLConnRec *sslconn = myConnConfig(r->connection);
PRFileDesc *ssl = sslconn ? sslconn->ssl : NULL;
if (!sslconn) {
return DECLINED;
}
if (sslconn->non_nss_request) {
const char *errmsg;
char *thisurl;
char *thisport = "";
int port = ap_get_server_port(r);
if (!ap_is_default_port(port, r)) {
thisport = apr_psprintf(r->pool, ":%u", port);
}
thisurl = ap_escape_html(r->pool,
apr_psprintf(r->pool, "https://%s%s/",
ap_get_server_name(r),
thisport));
errmsg = apr_psprintf(r->pool,
"Reason: You're speaking plain HTTP "
"to an SSL-enabled server port.
\n"
"Instead use the HTTPS scheme to access "
"this URL, please.
\n"
"
Hint: " "%s", thisurl, thisurl); apr_table_setn(r->notes, "error-notes", errmsg); /* Now that we have caught this error, forget it. we are done * with using SSL on this request. */ sslconn->non_nss_request = 0; return HTTP_BAD_REQUEST; } /* Get the SSL connection structure and perform the * delayed interlinking from SSL back to request_rec */ if (!ssl) { return DECLINED; } /* * Log information about incoming HTTPS requests */ if (r->server->loglevel >= APLOG_INFO && ap_is_initial_req(r)) { ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server, "%s HTTPS request received for child %ld (server %s)", (r->connection->keepalives <= 0 ? "Initial (No.1)" : apr_psprintf(r->pool, "Subsequent (No.%d)", r->connection->keepalives+1)), r->connection->id, nss_util_vhostid(r->pool, r->server)); } return DECLINED; } /* * Access Handler */ int nss_hook_Access(request_rec *r) { SSLDirConfigRec *dc = myDirConfig(r); SSLSrvConfigRec *sc = mySrvConfig(r->server); SSLConnRec *sslconn = myConnConfig(r->connection); PRFileDesc *ssl = sslconn ? sslconn->ssl : NULL; apr_array_header_t *requires; nss_require_t *nss_requires; char *cp; int ok, i; BOOL renegotiate = FALSE, renegotiate_quick = FALSE; CERTCertificate *cert; CERTCertificate *peercert; int verify_old, verify; extern cipher_properties ciphers_def[]; PRBool ciphers_old[ciphernum]; PRBool ciphers_new[ciphernum]; char * cipher = NULL; char * ciphers = NULL; PRBool cipher_in_list = PR_FALSE; /* * Support for SSLRequireSSL directive */ if (dc->bSSLRequired && !ssl) { ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "access to %s failed, reason: %s", r->filename, "SSL connection required"); /* remember forbidden access for strict require option */ apr_table_setn(r->notes, "ssl-access-forbidden", "1"); return HTTP_FORBIDDEN; } /* * Check to see if SSL protocol is enabled. If it's not then * no further access control checks are relevant. The test for * sc->enabled is probably strictly unnecessary */ if (!((sc->enabled == TRUE) || !ssl)) { return DECLINED; } /* * Support for per-directory reconfigured SSL connection parameters. * * This is implemented by forcing an SSL renegotiation with the * reconfigured parameter suite. But Apache's internal API processing * makes our life very hard here, because when internal sub-requests occur * we nevertheless should avoid multiple unnecessary SSL handshakes (they * require extra network I/O and especially time to perform). * * But the optimization for filtering out the unnecessary handshakes isn't * obvious and trivial. Especially because while Apache is in its * sub-request processing the client could force additional handshakes, * too. And these take place perhaps without our notice. So the only * possibility is to explicitly _ask_ OpenSSL whether the renegotiation * has to be performed or not. It has to performed when some parameters * which were previously known (by us) are not those we've now * reconfigured (as known by OpenSSL) or (in optimized way) at least when * the reconfigured parameter suite is stronger (more restrictions) than * the currently active one. */ /* * Override of NSSCipherSuite * * We provide two options here: * * o The paranoid and default approach where we force a renegotiation when * the cipher suite changed in _any_ way (which is straight-forward but * often forces renegotiations too often and is perhaps not what the * user actually wanted). * * o The optimized and still secure way where we force a renegotiation * only if the currently active cipher is no longer contained in the * reconfigured/new cipher suite. Any other changes are not important * because it's the servers choice to select a cipher from the ones the * client supports. So as long as the current cipher is still in the new * cipher suite we're happy. Because we can assume we would have * selected it again even when other (better) ciphers exists now in the * new cipher suite. This approach is fine because the user explicitly * has to enable this via ``NSSOptions +OptRenegotiate''. So we do no * implicit optimizations. */ if (dc->szCipherSuite) { /* remember old state */ for (i=0; i < ciphernum; i++) { SSL_CipherPrefGet(ssl, ciphers_def[i].num, &ciphers_old[i]); } if (dc->nOptions & SSL_OPT_OPTRENEGOTIATE) { int on, keySize, secretKeySize; char *issuer, *subject; SSL_SecurityStatus(ssl, &on, &cipher, &keySize, &secretKeySize, &issuer, &subject); } /* configure new state */ ciphers = strdup(dc->szCipherSuite); if (nss_parse_ciphers(r->server, ciphers, ciphers_new) < 0) { ap_log_error(APLOG_MARK, APLOG_WARNING, 0, r->server, "Unable to reconfigure (per-directory) " "permitted SSL ciphers"); nss_log_nss_error(APLOG_MARK, APLOG_ERR, r->server); free(ciphers); return HTTP_FORBIDDEN; } free(ciphers); /* Actually enable the selected ciphers. Also check to see if the existing cipher is in the new list for a possible optimization later. */ for (i=0; i
Option |
Description |
--with-nss=[PATH] |
The file system path to the NSS
installation. The assumption is that this has the layout of: PATH/lib,
PATH/include, etc. |
--with-nss-inc=PATH |
The file system path to the NSS
include directory (e.g. /usr/local/include/nss3) |
--with-nss-lib=PATH |
The file system path to the NSS
lib directory (e.g. /usr/local/lib) |
--with-nspr=[PATH] |
The file system path of the NSPR installation. The assumption is that this has the layout of: PATH/lib, PATH/include, etc. |
--with-nspr-inc=PATH |
The file system path to the NSPR
include directory (e.g. /usr/local/include/nspr4) |
--with-nspr-lib=PATH |
The file system path to the NSPR
lib directory (e.g. /usr/local/lib) |
--with-apxs=[PATH] |
The location of the apxs binary
of the Apache you want to install the module into. |
--with-apr-config=[PATH] | The location of apr-config which
tells us where the APR include files and libraries are located |
--enable-ssl2 |
SSLv2 is disabled by default. |
--enable-ecc |
Enable Elliptical Curve
Cryptography. Disabled by default. |
% ./configure --with-apxs=/path/to/apxs/
--with-nspr=/path/to/nspr/ --with-nss=/path/to/nss/
% gmake
nss.conf
.
By default
this is installed during the installation process.ssl.conf
to ssl.conf.old
.
The assumption is that mod_nss is replacing mod_ssl. They can co-exist
as long as they are listening on separate ports.nss.conf
, is copied into
the Apache
configuration directory (as reported by apxs). You may need to make a
manual change to httpd.conf to load this file. If you have a Red
Hat-style Apache installation with a conf.d just move nss.conf there.
It will be automatically loaded. Otherwise you will need to add the
following line to httpd.conf (location relative to httpd.conf):Include conf/nss.conf
nss.conf
.
It is here that you will setup your VirtualServer entries to and
configure your SSL servers.gencert
, is included to automatically
generate a self-signed CA plus one server certificate. This is fine for
testing purposes but it is strongly recommended that a real server
certificate be obtained from a real CA before moving a mod_nss server
into production. Users should be expected to cancel any request to a
secure server signed by an unknown issuer.gencert
takes one argument, the path to the location of
the certificate database. A fair amount of output is generated so you
can follow what is going on. For the most part most don't need to
bother with the details.# mkdir /etc/httpd/nss
# ./gencert /etc/httpd/nss
#####################################################################
Generating new server certificate and key database. The password
is httptest
#####################################################################
#####################################################################
Generating self-signed client CA certificate
#####################################################################
Generating key. This may take a few moments...
[ Lots of output removed ]
/etc/httpd/nss/cert8.db
/etc/httpd/nss/key3db
/etc/httpd/nss/secmod.db
<IfDefine SSL>
so you do not need to use the
startssl argument with apachectl
. % apachectl start
Please enter password for "internal" token:
%
modutil -dbdir /path/to/database/directory -changepw "NSS Certificate
DB"
migrate,pl
, is included to help migrate an
existing mod_ssl configuration to work with mod_nss. There is one
optional argument, -c, that will try to convert your existing server
and CA certificates plus any certificate revocation lists (CRLs) into
an NSS certificate database.NSSPassPhraseDialog builtin
NSSPassPhraseHelper /path/to/nss_pcache
NSSCertificateDatabase /etc/httpd/conf/nss
NSSDBPrefix my-prefix-
You would then need: my-prefix-cert8.db, my-prefix-key3.db and secmod.db
In order to work with files with a prefix using the NSS command-line
tools use the -P flag.
NSSSessionCacheSize 10000
NSSSessionCacheTimeout 100
NSSSession3CacheTimeout 86400
builtin:
Combines the current system time, the
current process id
and a randomly choosen 128-byte extract of the process stack. This is
not a particularly strong source of entropy.file:/path/to/source:
Reads from the specified file.
If the number of bytes to read is specified it just reads that amount.
Be aware that some operating systems block on /dev/random if not enough
entropy is available. This means that the server will wait until that
/data is available to continue startup. These systems generally offer a
non-blocking device as well, /dev/urandom.exec:/path/to/program: Executes the given program and takes
the stdout of it as the entryop. If the bytes argument is included it
reads that many bytes, otherwise it reads until the program exits.
NSSRandomSeed startup builtin
NSSRandomSeed startup /dev/urandom 512
NSSRandomSeed startup /usr/bin/makerandom
NSSEngine on
NSSFIPS on
NSSOCSP on
+
to enable or -
to disable.Cipher Name |
NSS Cipher
definition |
Protocol |
des |
SSL_EN_DES_64_CBC_WITH_MD5 |
SSLv2 |
desede3 |
SSL_EN_DES_192_EDE3_CBC_WITH_MD5 |
SSLv2 |
rc2 |
SSL_EN_RC2_128_CBC_WITH_MD5 |
SSLv2 |
rc2export |
SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5 |
SSLv2 |
rc4 |
SSL_EN_RC4_128_WITH_MD5 |
SSLv2 |
rc4export |
SSL_EN_RC4_128_EXPORT40_WITH_MD5 |
SSLv2 |
rsa_3des_sha |
SSL_RSA_WITH_3DES_EDE_CBC_SHA |
SSLv3/TLSv1 |
rsa_des_sha |
SSL_RSA_WITH_DES_CBC_SHA |
SSLv3/TLSv1 |
rsa_null_md5 |
SSL_RSA_WITH_NULL_MD5 |
SSLv3/TLSv1 |
rsa_null_sha |
SSL_RSA_WITH_NULL_SHA |
SSLv3/TLSv1 |
rsa_rc2_40_md5 | SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 |
SSLv3/TLSv1 |
rsa_rc4_128_md5 | SSL_RSA_WITH_RC4_128_MD5 |
SSLv3/TLSv1 |
rsa_rc4_128_sha | SSL_RSA_WITH_RC4_128_SHA |
SSLv3/TLSv1 |
rsa_rc4_40_md5 | SSL_RSA_EXPORT_WITH_RC4_40_MD5 |
SSLv3/TLSv1 |
fortezza |
SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA |
SSLv3/TLSv1 |
fortezza_rc4_128_sha |
SSL_FORTEZZA_DMS_WITH_RC4_128_SHA |
SSLv3/TLSv1 |
fortezza_null |
SSL_FORTEZZA_DMS_WITH_NULL_SHA |
SSLv3/TLSv1 |
fips_des_sha |
SSL_RSA_FIPS_WITH_DES_CBC_SHA |
SSLv3/TLSv1 |
fips_3des_sha |
SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA |
SSLv3/TLSv1 |
rsa_des_56_sha | TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA |
SSL3/TLSv1 |
rsa_rc4_56_sha | TLS_RSA_EXPORT1024_WITH_RC4_56_SHA |
SSLv3/TLSv1 |
rsa_aes_128_sha |
TLS_RSA_WITH_AES_128_CBC_SHA |
SSLv3/TLSv1 |
rsa_aes_256_sha |
TLS_RSA_WITH_AES_256_CBC_SHA |
SSLv3/TLSv1 |
Cipher Name |
NSS Cipher
Definition |
Protocol |
ecdh_ecdsa_null_sha | TLS_ECDH_ECDSA_WITH_NULL_SHA | TLSv1 |
ecdh_ecdsa_rc4_128_sha | TLS_ECDH_ECDSA_WITH_RC4_128_SHA | TLSv1 |
ecdh_ecdsa_3des_sha | TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA | TLSv1 |
ecdh_ecdsa_aes_128_sha | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA | TLSv1 |
ecdh_ecdsa_aes_256_sha | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA | TLSv1 |
ecdhe_ecdsa_null_sha | TLS_ECDHE_ECDSA_WITH_NULL_SHA | TLSv1 |
ecdhe_ecdsa_rc4_128_sha | TLS_ECDHE_ECDSA_WITH_RC4_128_SHA | TLSv1 |
ecdhe_ecdsa_3des_sha | TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA | TLSv1 |
ecdhe_ecdsa_aes_128_sha | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | TLSv1 |
ecdhe_ecdsa_aes_256_sha | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | TLSv1 |
ecdh_rsa_null_sha | TLS_ECDH_RSA_WITH_NULL_SHA | TLSv1 |
ecdh_rsa_128_sha | TLS_ECDH_RSA_WITH_RC4_128_SHA | TLSv1 |
ecdh_rsa_3des_sha | TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA | TLSv1 |
ecdh_rsa_aes_128_sha | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA | TLSv1 |
ecdh_rsa_aes_256_sha | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA | TLSv1 |
echde_rsa_null | TLS_ECDHE_RSA_WITH_NULL_SHA | TLSv1 |
ecdhe_rsa_rc4_128_sha | TLS_ECDHE_RSA_WITH_RC4_128_SHA | TLSv1 |
ecdhe_rsa_3des_sha | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA | TLSv1 |
ecdhe_rsa_aes_128_sha | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | TLSv1 |
ecdhe_rsa_aes_256_sha | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | TLSv1 |
ecdh_anon_null_sha | TLS_ECDH_anon_WITH_NULL_SHA | TLSv1 |
ecdh_anon_rc4_128sha | TLS_ECDH_anon_WITH_RC4_128_SHA | TLSv1 |
ecdh_anon_3des_sha | TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA | TLSv1 |
ecdh_anon_aes_128_sha | TLS_ECDH_anon_WITH_AES_128_CBC_SHA | TLSv1 |
ecdh_anon_aes_256_sha | TLS_ECDH_anon_WITH_AES_256_CBC_SHA | TLSv1 |
NSSCipherSuite
+rsa_3des_sha,-rsa_des_56_sha,+rsa_des_sha,-rsa_null_md5,-rsa_null_sha,-rsa_rc2_40_md5,+rsa_rc4_128_md5,-rsa_rc4_128_sha,
-rsa_rc4_40_md5,-rsa_rc4_56_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-fips_des_sha,
+fips_3des_sha,-rsa_aes_128_sha,-rsa_aes_256_sha
SSLv3
TLSv1
All
NSSProtocol SSLv3,TLSv1
NSSNickname Server-Cert
NSSNickname "This contains a space"
NOTE: There is nothing magical about the string "Server-Cert." A
nickname can be anything. Historically this was Server-Cert in the
Netscape server products that used NSS.
NSSECCNicknameNSSNickname Server-Cert-ECC
NSSEnforceValidCerts on
none
: no client certificate
is required or requestedrequire
: a valid client
certificate is required for the connection to continue.option_no_ca
is not supported.NSSVerifyDepth
directive. NSS always verifies
the entire certificate chain.NSSVerifyClient require
NSSUserName SSL_CLIENT_S_DN_UID
SSL_CLIENT_CERT
, SSL_CLIENT_CERT_CHAIN[0..n]
and
SSL_SERVER_CERT
. This provides additional
certificate information on the client and server to the environment,
plus every CA certificate in the client certificate.NSSOptions +FakeBasicAuth
<Files ~ "\.(cgi|shtml)$">
NSSOptions +StdEnvVars
<Files>
NSSRequireSSL
NSSRequire
NSSProxyEngine on
NSSProxyProtocol SSLv3
NSSProxyCipherSuite
+rsa_3des_sha,-rsa_null_md5,-rsa_null_sha,+rsa_rc4_128_md5
NSSProxyNickname beta
Name |
Description |
HTTPS |
Set to "on" if HTTPS is being
used |
Name |
Description |
SSL_VERSION_INTERFACE |
The version of mod_nss the
server is running |
SSL_VERSION_LIBRARY |
The version of NSS that mod_nss
was compiled against. |
SSL_PROTOCOL |
SSLv2, SSLv3 or TLSv1 |
SSL_CIPHER |
The cipher the connection is
using |
SSL_CIPHER_EXPORT |
true if the cipher is an export
cipher, false otherwise |
SSL_CIPHER_USEKEYSIZE |
Number if bits the cipher is
using |
SSL_CIPHER_ALGKEYSIZE |
Max number of bits possible in
the cipher |
SSL_CLIENT_VERIFY |
NONE if no client auth, SUCCESS
or FAILED if SSLVerifyCert is set |
SSL_CLIENT_V_START |
Client certificate validity
start time |
SSL_CLIENT_V_END |
Client certificate validity end time |
SSL_CLIENT_V_REMAIN |
Number of days that the
certificate is valid |
SSL_CLIENT_M_VERSION |
X.509 version of the client
certificiate |
SSL_CLIENT_M_SERIAL |
Serial number of the client
certificate |
SSL_CLIENT_A_KEY |
Algorithm used for client key |
SSL_CLIENT_A_SIG |
Algorithm used for the signature of the client key |
SSL_CLIENT_S_DN |
Distinguished Name (DN) of the client certificate |
SSL_CLIENT_S_DN_[C,ST,L,O,OU,CN,T,I,G,S,D,UID,Email] |
Components of the client
certificate. Only those that exist in the certificate are created. |
SSL_CLIENT_I_DN |
Distinguished Name (DN) of the
client certificate issuer |
SSL_CLIENT_I_DN_[C,ST,L,O,OU,CN,T,I,G,S,D,UID,Email] |
Components of the client issuer certificate. Only those that exist in the certificate are created |
SSL_SERVER_DN |
Distinguished Name (DN) of the
server certificate |
SSL_SERVER_DN_[C,ST,L,O,OU,CN,T,I,G,S,D,UID,Email] |
Components of the server certificate. Only those that exist in the certificate are created |
SSL_SERVER_I_DN_[C,ST,L,O,OU,CN,T,I,G,S,D,UID,Email] |
Components of the server issuer certificate. Only those that exist in the certificate are created |
SSL_SERVER_M_VERSION |
X.509 version of the server certificiate |
SSL_SERVER_M_SERIAL |
Serial number of the server certificate |
SSL_SERVER_V_START |
Server certificate validity start time |
SSL_SERVER_V_END |
Server certificate validity end time |
SSL_SERVER_A_KEY |
Algorithm used for server key |
SSL_SERVER_A_SIG |
Algorithm used for the signature of the server key |
SSL_SESSION_ID |
SSL Session ID |
Name |
Description |
SSL_SERVER_CERT |
The server certificate in PEM
format. |
SSL_CLIENT_CERT |
The client certificate in PEM
format (if available) |
SSL_CLIENT_CERT_CHAIN_[0..n] |
Each certificate in the client
certificate chain in PEM format (including the client certificate
itself). |
Tool |
Description |
certutil |
Generate Certificate Signing
Requests, install certificates and manage certificate trust flags. |
crlutil |
Manage certificate revocation lists (CRLs). |
modutil |
Manage the database of PKCS11 modules (secmod.db). Add modules and modify the properties of existing modules (such as whether a module is the default provider of some crypto service). |
pk12util | Import and export keys and certificates in PKCS12 format. |
Description |
Command |
Create a Database |
certutil -N -d [path] |
List all Certificates |
certutil -L -d [path] |
Extract a cert (Server-Cert) in
ASCII |
certutil -L -n Server-Cert -d
[path] -a |
Extract a cert and key
(Server-Cert) in PKCS#12 |
pk12util -o server.p12 -n
Server-Cert -d [path] |
Import a cert and key
(Import-Me) from PKCS#12 |
pk12util -i server.p12 -n
Import-Me -d [path] |
% openssl pkcs12 -export -in /path/to/certificate -inkey
/path/to/keyfile -out server.p12 -name "Server-Cert" -passout pass:foo
% pk12util -i server.p12 -d [path] -W foo
% certutil -A -n "myca" -t "CT,," -d [path] -a -i
/path/to/cacertificate
% openssl crl -in /path/to/crlfile -out /tmp/crl.tmp -inform PEM
-outform DER
% crlutil -I -t 1 -d [path] -i /tmp/crl.tmp
% certutil -V -n Server-Cert -u V -d .
certutil: certificate is valid
1038,1039c1038,1039
< APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_enable, (conn_rec *));
< APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *));
---
> APR_DECLARE_OPTIONAL_FN(int, nss_proxy_enable, (conn_rec *));
> APR_DECLARE_OPTIONAL_FN(int, nss_engine_disable, (conn_rec *));
1041,1042c1041,1042
< static APR_OPTIONAL_FN_TYPE(ssl_proxy_enable) *proxy_ssl_enable =
NULL;
< static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *proxy_ssl_disable
= NULL;
---
> static APR_OPTIONAL_FN_TYPE(nss_proxy_enable) *proxy_ssl_enable =
NULL;
> static APR_OPTIONAL_FN_TYPE(nss_engine_disable) *proxy_ssl_disable
= NULL;
1069,1070c1069,1070
< proxy_ssl_enable =
APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable);
< proxy_ssl_disable =
APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
---
> proxy_ssl_enable =
APR_RETRIEVE_OPTIONAL_FN(nss_proxy_enable);
> proxy_ssl_disable =
APR_RETRIEVE_OPTIONAL_FN(nss_engine_disable);