https://bz.apache.org/bugzilla/show_bug.cgi?id=70284
--- Comment #1 from abernal <[email protected]> --- Root cause confirmed: ssl_authz_verify_client_check() in modules/ssl/ssl_engine_kernel.c looks up the SSLConnRec on r->connection directly, with no fallback to r->connection->master. On an HTTP/2 secondary connection that object never has one -- the handshake state lives on the master connection -- so the check always denies, even though SSL_CLIENT_VERIFY itself already reads SUCCESS for the same request. Every other mod_ssl hook touching a request already falls back to the master connection in this situation (ssl_hook_Access(), modssl_request_is_tls()); this one didn't. Reproduced against a real build (mod_ssl + mod_http2, real TLS handshake, real client certificate): the same certificate on the same connection logs "authorization result of Require ssl-verify-client : granted" over HTTP/1.1 and ": denied" over HTTP/2. Fix and a regression test are available as a pull request: https://github.com/apache/httpd/pull/913 -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
