component/apache: support ca-cert-dir and crl-dir in apache-backend.conf.in.

component/apache/apache-backend.conf.in

@@ -32,6 +32,15 @@
  #       #  empty)
  #       "crl": "<file_path>",
  #
+ #       #  The path given to "SSLCACertificatePath" (can be empty)
+ #       #  If this value is not empty, it enables client certificate check.
+ #       #  (Enabling "SSLVerifyClient require")
+ #       "ca-cert-dir": "<directory_path>",
+ #
+ #       #  The path given to "SSLCARevocationPath" (used if ca-cert-dir is not
+ #       #  empty)
+ #       "crl-dir": "<directory_path>",
+ #
  #       #  The path given to "ErrorLog"
  #       "error-log": "<file_path>",
  #
@@ -83,6 +92,10 @@
  #  For more details, refer to
  #  https://docs.zope.org/zope2/zope2book/VirtualHosting.html#using-virtualhostroot-and-virtualhostbase-together
 -#}
+{% set ca_cert = parameter_dict.get('ca-cert') -%}
+{% set ca_cert_dir = parameter_dict.get('ca-cert-dir') -%}
+{% set crl = parameter_dict.get('crl') -%}
+{% set crl_dir = parameter_dict.get('crl-dir') -%}
 LoadModule unixd_module modules/mod_unixd.so
 LoadModule access_compat_module modules/mod_access_compat.so
 LoadModule authz_core_module modules/mod_authz_core.so
@@ -133,16 +146,26 @@ SSLProxyEngine On
 
 # As backend is trusting Remote-User header unset it always
 RequestHeader unset Remote-User
-{% if parameter_dict['ca-cert'] -%}
+{% if ca_cert or ca_cert_dir -%}
 SSLVerifyClient optional
 RequestHeader set Remote-User %{SSL_CLIENT_S_DN_CN}s
 RequestHeader unset X-Forwarded-For "expr=%{SSL_CLIENT_VERIFY} != 'SUCCESS'"
-SSLCACertificateFile {{ parameter_dict['ca-cert'] }}
-{%   if parameter_dict['crl'] -%}
+{%   if ca_cert -%}
+SSLCACertificateFile {{ ca_cert }}
+{%   endif -%}
+{%   if ca_cert_dir -%}
+SSLCACertificatePath {{ ca_cert_dir }}
+{%   endif -%}
+{%   if crl or crl_dir -%}
 SSLCARevocationCheck chain
-SSLCARevocationFile {{ parameter_dict['crl'] }}
-{%-   endif %}
-{%- endif %}
+{%     if crl -%}
+SSLCARevocationFile {{ crl }}
+{%     endif -%}
+{%     if crl_dir -%}
+SSLCARevocationPath {{ crl_dir }}
+{%     endif -%}
+{%   endif -%}
+{% endif -%}
 
 ErrorLog "{{ parameter_dict['error-log'] }}"
 # Default apache log format with request time in microsecond at the end
@@ -162,11 +185,8 @@ Listen {{ ip }}:{{ port }}
 {%   endfor -%}
 <VirtualHost *:{{ port }}>
   SSLEngine on
-{% if enable_authentication and parameter_dict['ca-cert'] and parameter_dict['crl'] -%}
+{% if enable_authentication and (ca_cert or ca_cert_dir) and (crl or crl_dir) -%}
   SSLVerifyClient require
-  SSLCACertificateFile {{ parameter_dict['ca-cert'] }}
-  SSLCARevocationCheck chain
-  SSLCARevocationFile {{ parameter_dict['crl'] }}
 
   LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
 
@@ -184,11 +204,8 @@ Listen {{ ip }}:{{ port }}
 <VirtualHost {{ ip }}:{{ port }}>
   SSLEngine on
   Timeout 3600
-{%   if enable_authentication and parameter_dict['ca-cert'] and parameter_dict['crl'] -%}
+{%   if enable_authentication and (ca_cert or ca_cert_dir) and (crl or crl_dir) -%}
   SSLVerifyClient require
-  SSLCACertificateFile {{ parameter_dict['ca-cert'] }}
-  SSLCARevocationCheck chain
-  SSLCARevocationFile {{ parameter_dict['crl'] }}
 
   LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
 

component/apache/buildout.hash.cfg

@@ -14,5 +14,5 @@
 # not need these here).
 [template-apache-backend-conf]
 filename = apache-backend.conf.in
-md5sum = bb8c175a93336f0e1838fd47225426f9
+md5sum = 4a13ad45e38e14ca7027c17192c90205