Merge ~paelzer/ubuntu/+source/apache2:eoan-bug-1830728-keys-from-pkcs into ubuntu/+source/apache2:ubuntu/eoan-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

This is WIP for now as we still need to find how to carry the doc changes properly into 2.4.x
Upstream changes XML files which are no more bundled (or not exiting in 2.4) in our tarball.
The HTML files in the tarball are the usual "do not edit this is generated" style so I'll need to check where to correctly add the doc changes.

But for now the PPA is enough for IBM to evaluate if this is even what they want (before spending more on the docs).

[Dimitri John Ledkov (xnox)]

What's the status of said evaluation?

Unmerged commits

0db4573... by Christian Ehrhardt  on 2019-07-29

changelog: support loading private keys via PKCS#11 token (LP: #1830728)

Signed-off-by: Christian Ehrhardt <email address hidden>

e93ffde... by Christian Ehrhardt  on 2019-07-29

d/p/ubuntu/lp-1830728-*: support loading private keys via PKCS#11 token (LP: #1830728)

Signed-off-by: Christian Ehrhardt <email address hidden>

5a4aa4d... by Dimitri John Ledkov on 2019-06-13

Import patches-unapplied version 2.4.38-3ubuntu2 to ubuntu/eoan-proposed

Imported using git-ubuntu import.

Changelog parent: e936130b355fd0cbf58c47c7cd36cf3a0d49a6fb

New changelog entries:
  * Cherrypick upstream test suite fix for buffer.

e936130... by Dimitri John Ledkov on 2019-06-10

Import patches-unapplied version 2.4.38-3ubuntu1 to ubuntu/eoan-proposed

Imported using git-ubuntu import.

Changelog parent: 6f896d33242900b08c8788338c9e90e23713055c

New changelog entries:
  * Merge from Debian unstable. Remaining changes:
    - Cherrypick upstream testsuite fix:
      + r1850941 Skip tests for TLSv1.3 (where there is no "renegotiation"
      as such).
    - Similarly use TLSv1.2 for pr12355 and pr43738.
    - debian/{control, apache2.install, apache2-utils.ufw.profile,
      apache2.dirs}: Add ufw profiles.
    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
    - debian/patches/086_svn_cross_compiles: Backport several cross
      fixes from upstream
      [Removed configure chunk, not needed since configure.in is being
       patched.]
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
      Debian with Ubuntu on default page.
      + d/source/include-binaries: add Ubuntu icon file
    - d/t/control, d/t/check-http2: add basic test for http2 support

6f896d3... by Stefan Fritsch on 2019-04-07

Import patches-unapplied version 2.4.38-3 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 847b2dd6c945b42d4b49bbc8fbb24a7dd4fc4897

New changelog entries:
  [ Marc Deslauriers ]
  * SECURITY UPDATE: read-after-free on a string compare in mod_http2
    - debian/patches/CVE-2019-0196.patch: disentangelment of stream and
      request method in modules/http2/h2_request.c.
    - CVE-2019-0196
  * SECURITY UPDATE: privilege escalation from modules' scripts
    - debian/patches/CVE-2019-0211.patch: bind the bucket number of each
      child to its slot number in include/scoreboard.h,
      server/mpm/event/event.c, server/mpm/prefork/prefork.c,
      server/mpm/worker/worker.c.
    - CVE-2019-0211
  * SECURITY UPDATE: mod_ssl access control bypass
    - debian/patches/CVE-2019-0215.patch: restore SSL verify state after
      PHA failure in TLSv1.3 in modules/ssl/ssl_engine_kernel.c.
    - CVE-2019-0215
  * SECURITY UPDATE: mod_auth_digest access control bypass
    - debian/patches/CVE-2019-0217.patch: fix a race condition in
      modules/aaa/mod_auth_digest.c.
    - CVE-2019-0217
  * SECURITY UPDATE: URL normalization inconsistincy
    - debian/patches/CVE-2019-0220-1.patch: merge consecutive slashes in
      the path in include/http_core.h, include/httpd.h, server/core.c,
      server/request.c, server/util.c.
    - debian/patches/CVE-2019-0220-2.patch: fix r->parsed_uri.path safety
      in server/request.c, server/util.c.
    - debian/patches/CVE-2019-0220-3.patch: maintainer mode fix in
      server/util.c.
    - CVE-2019-0220
  [ Stefan Fritsch ]
  * Pull security fixes from 2.4.39 via Ubuntu
  * CVE-2019-0197: mod_http2: Fix possible crash on late upgrade

847b2dd... by Xavier Guimard <email address hidden> on 2019-01-31

Import patches-unapplied version 2.4.38-2 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 9da9dfa1e43b5d69d2783d1a3e1a5b6dcde606c1

New changelog entries:
  * Disable "reset" test in allowmethods.t (Closes: #921024)

9da9dfa... by Xavier Guimard <email address hidden> on 2019-01-29

Import patches-unapplied version 2.4.38-1 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 7387d718ca26d92498f9ed1584fea8cbcb4f704e

New changelog entries:
  [ Jelmer Vernooij ]
  * Reverted for now: Transition to automatic debug package (from: apache2-dbg)
  * Trim trailing whitespace
  * Use secure copyright file specification URI
  [ Niels Thykier ]
  * Add Rules-Requires-Root: binary-targets
  [ Xavier Guimard ]
  * Convert signing-key.pgp into signing-key.asc
  * Add http2.conf (Closes: #880993)
  * Remove unnecessary greater-than versioned dependency to dpkg-dev,
    libbrotli-dev and libapache2-mod-md
  * Declare compliance with policy 4.2.1
  * Add spelling errors patch (reported)
  * Fix some spelling errors in debian files
  * Add myself to uploaders
  * Refresh patches
  * Bump debhelper compatibility level to 10
  * debian/rules:
    - Remove unnecessary dh argument --parallel
    - use /usr/share/dpkg/pkg-info.mk instead of dpkg-parsechangelog
  * Add upstream/metadata
  * Replace MIT by Expat in debian/copyright
  * debian/watch: use https url
  * Add documentation links in systemd service files
  * Team upload
  [ Cyrille Bollu ]
  * Put HTTP2 configuration within <IfModule !mpm_prefork></IfModule> tags as
    it gets automatically de-activated upon apache 'startup when using
    mpm_prefork.
  * Updated http2.conf to inform user that they may want to change their
    LogFormat directives.
  [ Xavier Guimard ]
  * New upstream version 2.4.38 (Closes: #920220, #920302, #920303)
  * Refresh patches
  * Remove setenvifexpr.diff patch now included in upstream
  * Replace libapache2-mod-proxy-uwsgi.{post*,prerm} by a maintscript
  * Add a "sleep" in debian/tests/htcacheclean and skip result if "stop" failed
  * Declare compliance with policy 4.3.0
  * Fix homepage to https
  * Update debian/copyright

7387d71... by Stefan Fritsch on 2018-11-03

Import patches-unapplied version 2.4.37-1 to debian/sid

Imported using git-ubuntu import.

Changelog parent: bf7f8f045ccf34c2c08f02ecdd0f46ef7a97ee46

New changelog entries:
  * New upstream version
    - mod_ssl: Add support for TLSv1.3
  * Add docs symlink for libapache2-mod-proxy-uwsgi. Closes: #910218
  * Update test-framework to r1845652
  * Fix test suite to actually run by creating a test user. It turns out
    the test suite refuses to run as root but returns true even in that
    case. It seems this has been broken since 2.4.27-4, where the test suite
    had been updated and the debci test duration dropped from 15min to
    3min. Also, don't rely on the exit status anymore but parse the test
    output.
  * Backport a fix from trunk for SetEnvIfExpr. This fixes a test failure.

bf7f8f0... by Stefan Fritsch on 2018-10-07

Import patches-unapplied version 2.4.35-1 to debian/sid

Imported using git-ubuntu import.

Changelog parent: ef5d2450201d96722e86ff11a816bf14e3b9cfca

New changelog entries:
  * New upstream version 2.4.35
    Security fix:
    - CVE-2018-11763: DoS for HTTP/2 connections by continuous SETTINGS
      Closes: #909591
  * Fix lintian warning: Don't force xz in builddeb override.

ef5d245... by Stefan Fritsch on 2018-07-27

Import patches-unapplied version 2.4.34-1 to debian/sid

Imported using git-ubuntu import.

Changelog parent: f9135dfca55cef91c3af3074fc3ba3826d3f95d8

New changelog entries:
  [ Ondřej Surý ]
  * New upstream version 2.4.34
    Security fixes:
    - CVE-2018-1333: Denial of service in mod_http2. Closes: #904106
    - CVE-2018-8011: Denial of service in mod_md. Closes: #904107
  * Refresh patches for Apache2 2.4.34 release
  * Update the suexec-custom.patch for 2.4.34 release
  [ Stefan Fritsch ]
  * Remove load order dependency introduced in mod_lbmethod_* in 2.4.34
  * Remove debian/gbp.conf. Closes: #904641
  * Fix typo in apache2_switch_mpm() in apache2-maintscript-helper.
    Closes: #904150

diff --git a/debian/changelog b/debian/changelog
index 24b7788..9c74c1b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+apache2 (2.4.38-3ubuntu3) eoan; urgency=medium
+
+  * d/p/ubuntu/lp-1830728-*: support loading private keys via PKCS#11
+    token (LP: #1830728)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 29 Jul 2019 08:52:19 +0200
+
 apache2 (2.4.38-3ubuntu2) eoan; urgency=medium
 
   * Cherrypick upstream test suite fix for buffer.
diff --git a/debian/patches/series b/debian/patches/series
index b570181..f11f226 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -20,3 +20,6 @@ CVE-2019-0197.patch
 
 # Patches added by Ubuntu
 086_svn_cross_compiles
+ubuntu/lp-1830728-mod_ssl-Add-support-for-loading-private-keys-from-EN.patch
+ubuntu/lp-1830728-mod_ssl-Add-support-for-loading-TLS-certificates-thr.patch
+ubuntu/lp-1830728-Hook-up-PKCS-11-PIN-entry-through-configured-passphr.patch
diff --git a/debian/patches/ubuntu/lp-1830728-Hook-up-PKCS-11-PIN-entry-through-configured-passphr.patch b/debian/patches/ubuntu/lp-1830728-Hook-up-PKCS-11-PIN-entry-through-configured-passphr.patch
 new file mode 100644
index 0000000..6d2117b
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1830728-Hook-up-PKCS-11-PIN-entry-through-configured-passphr.patch
@@ -0,0 +1,328 @@
+From ae480ad7738038e26063b67b545a8e1b85df5451 Mon Sep 17 00:00:00 2001
+From: Joe Orton <[e-mail]>
+Date: Fri, 6 Jul 2018 12:01:29 +0000
+Subject: [PATCH] Hook up PKCS#11 PIN entry through configured passphrase entry
+ method.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* modules/ssl/ssl_engine_pphrase.c: Add wrappers for OpenSSL UI * API
+  around passphrase entry.
+  (modssl_load_engine_keypair): Take vhost ID and use above rather than
+  default OpenSSL UI.
+
+* modules/ssl/ssl_engine_init.c (ssl_init_server_certs): Pass vhost ID.
+
+Submitted by: Anderson Sasaki<ansaski redhat.com>, jorton
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1835240 13f79535-47bb-0310-9956-ffa450edef68
+
+Origin: upstream, https://github.com/apache/httpd/commit/ae480ad7738038e26063b67b545a8e1b85df5451
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1830728
+Last-Update: 2019-07-29
+
+---
+ modules/ssl/ssl_engine_init.c    |   5 +-
+ modules/ssl/ssl_engine_pphrase.c | 235 ++++++++++++++++++++++++++++++-
+ modules/ssl/ssl_private.h        |   1 +
+ 3 files changed, 232 insertions(+), 9 deletions(-)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index c8a3365e0c..be4184ff86 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1293,8 +1293,9 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+ 
+             cert = NULL;
+             
+-            if ((rv = modssl_load_engine_keypair(s, ptemp, engine_certfile,
+-                                                 keyfile, &cert, &pkey))) {
++            if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id,
++                                                 engine_certfile, keyfile,
++                                                 &cert, &pkey))) {
+                 return rv;
+             }
+ 
+diff --git a/modules/ssl/ssl_engine_pphrase.c b/modules/ssl/ssl_engine_pphrase.c
+index 85982c80c1..7688b2425c 100644
+--- a/modules/ssl/ssl_engine_pphrase.c
++++ b/modules/ssl/ssl_engine_pphrase.c
+@@ -588,13 +588,239 @@ int ssl_pphrase_Handle_CB(char *buf, int bufsize, int verify, void *srv)
+ }
+ 
+ #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++
++/* OpenSSL UI implementation for passphrase entry; largely duplicated
++ * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
++ * worth trying to shift pphrase handling over to the UI API
++ * completely. */
++static int passphrase_ui_open(UI *ui)
++{
++    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
++    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
++
++    ppcb->nPassPhraseDialog++;
++    ppcb->nPassPhraseDialogCur++;
++
++    /*
++     * Builtin or Pipe dialog
++     */
++    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
++        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++        if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++            if (!readtty) {
++                ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s,
++                             APLOGNO()
++                             "Init: Creating pass phrase dialog pipe child "
++                             "'%s'", sc->server->pphrase_dialog_path);
++                if (ssl_pipe_child_create(ppcb->p,
++                            sc->server->pphrase_dialog_path)
++                        != APR_SUCCESS) {
++                    ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s,
++                                 APLOGNO()
++                                 "Init: Failed to create pass phrase pipe '%s'",
++                                 sc->server->pphrase_dialog_path);
++                    return 0;
++                }
++            }
++            ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO()
++                         "Init: Requesting pass phrase via piped dialog");
++        }
++        else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
++#ifdef WIN32
++            ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s, APLOGNO()
++                         "Init: Failed to create pass phrase pipe '%s'",
++                         sc->server->pphrase_dialog_path);
++            return 0;
++#else
++            /*
++             * stderr has already been redirected to the error_log.
++             * rather than attempting to temporarily rehook it to the terminal,
++             * we print the prompt to stdout before EVP_read_pw_string turns
++             * off tty echo
++             */
++            apr_file_open_stdout(&writetty, ppcb->p);
++
++            ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO()
++                         "Init: Requesting pass phrase via builtin terminal "
++                         "dialog");
++#endif
++        }
++
++        /*
++         * The first time display a header to inform the user about what
++         * program he actually speaks to, which module is responsible for
++         * this terminal dialog and why to the hell he has to enter
++         * something...
++         */
++        if (ppcb->nPassPhraseDialog == 1) {
++            apr_file_printf(writetty, "%s mod_ssl (Pass Phrase Dialog)\n",
++                            AP_SERVER_BASEVERSION);
++            apr_file_printf(writetty,
++                            "A pass phrase is required to access the private key.\n");
++        }
++        if (ppcb->bPassPhraseDialogOnce) {
++            ppcb->bPassPhraseDialogOnce = FALSE;
++            apr_file_printf(writetty, "\n");
++            apr_file_printf(writetty, "Private key %s (%s)\n",
++                            ppcb->key_id, ppcb->pkey_file);
++        }
++    }
++
++    return 1;
++}
++
++static int passphrase_ui_read(UI *ui, UI_STRING *uis)
++{
++    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
++    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
++    const char *prompt;
++    int i;
++    int bufsize;
++    int len;
++    char *buf;
++
++    prompt = UI_get0_output_string(uis);
++    if (prompt == NULL) {
++        prompt = "Enter pass phrase:";
++    }
++
++    /*
++     * Get the maximum expected size and allocate the buffer
++     */
++    bufsize = UI_get_result_maxsize(uis);
++    buf = apr_pcalloc(ppcb->p, bufsize);
++
++    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
++        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++        /*
++         * Get the pass phrase through a callback.
++         * Empty input is not accepted.
++         */
++        for (;;) {
++            if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++                i = pipe_get_passwd_cb(buf, bufsize, "", FALSE);
++            }
++            else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
++                i = EVP_read_pw_string(buf, bufsize, "", FALSE);
++            }
++            if (i != 0) {
++                OPENSSL_cleanse(buf, bufsize);
++                return 0;
++            }
++            len = strlen(buf);
++            if (len < 1){
++                apr_file_printf(writetty, "Apache:mod_ssl:Error: Pass phrase"
++                                "empty (needs to be at least 1 character).\n");
++                apr_file_puts(prompt, writetty);
++            }
++            else {
++                break;
++            }
++        }
++    }
++    /*
++     * Filter program
++     */
++    else if (sc->server->pphrase_dialog_type == SSL_PPTYPE_FILTER) {
++        const char *cmd = sc->server->pphrase_dialog_path;
++        const char **argv = apr_palloc(ppcb->p, sizeof(char *) * 3);
++        char *result;
++
++        ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO()
++                     "Init: Requesting pass phrase from dialog filter "
++                     "program (%s)", cmd);
++
++        argv[0] = cmd;
++        argv[1] = ppcb->key_id;
++        argv[2] = NULL;
++
++        result = ssl_util_readfilter(ppcb->s, ppcb->p, cmd, argv);
++        apr_cpystrn(buf, result, bufsize);
++        len = strlen(buf);
++    }
++
++    /*
++     * Ok, we now have the pass phrase, so give it back
++     */
++    ppcb->cpPassPhraseCur = apr_pstrdup(ppcb->p, buf);
++    UI_set_result(ui, uis, buf);
++
++    /* Clear sensitive data. */
++    OPENSSL_cleanse(buf, bufsize);
++    return 1;
++}
++
++static int passphrase_ui_write(UI *ui, UI_STRING *uis)
++{
++    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
++    SSLSrvConfigRec *sc;
++    const char *prompt;
++
++    sc = mySrvConfig(ppcb->s);
++
++    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
++        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++        prompt = UI_get0_output_string(uis);
++        apr_file_puts(prompt, writetty);
++    }
++
++    return 1;
++}
++
++static int passphrase_ui_close(UI *ui)
++{
++    /*
++     * Close the pipes if they were opened
++     */
++    if (readtty) {
++        apr_file_close(readtty);
++        apr_file_close(writetty);
++        readtty = writetty = NULL;
++    }
++    return 1;
++}
++
++static apr_status_t pp_ui_method_cleanup(void *uip)
++{
++    UI_METHOD *uim = uip;
++    
++    UI_destroy_method(uim);
++
++    return APR_SUCCESS;
++}
++
++static UI_METHOD *get_passphrase_ui(apr_pool_t *p)
++{
++    UI_METHOD *ui_method = UI_create_method("Passphrase UI");
++
++    UI_method_set_opener(ui_method, passphrase_ui_open);
++    UI_method_set_reader(ui_method, passphrase_ui_read);
++    UI_method_set_writer(ui_method, passphrase_ui_write);
++    UI_method_set_closer(ui_method, passphrase_ui_close);
++
++    apr_pool_cleanup_register(p, ui_method, pp_ui_method_cleanup,
++                              pp_ui_method_cleanup);
++    
++    return ui_method;
++}
++
++
+ apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
++                                        const char *vhostid,
+                                         const char *certid, const char *keyid,
+                                         X509 **pubkey, EVP_PKEY **privkey)
+ {
+     SSLModConfigRec *mc = myModConfig(s);
+     ENGINE *e;
+-    UI_METHOD *ui_method;
++    UI_METHOD *ui_method = get_passphrase_ui(p);
++    pphrase_cb_arg_t ppcb;
++
++    memset(&ppcb, 0, sizeof ppcb);
++    ppcb.s = s;
++    ppcb.p = p;
++    ppcb.bPassPhraseDialogOnce = TRUE;
++    ppcb.key_id = vhostid;
++    ppcb.pkey_file = keyid;
+ 
+     if (!mc->szCryptoDevice) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10131)
+@@ -603,11 +829,6 @@ apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
+         return ssl_die(s);
+     }
+ 
+-    /*
+-     * Using the builtin OpenSSL UI only, for now...
+-     */
+-    ui_method = UI_OpenSSL();
+-
+     if (!(e = ENGINE_by_id(mc->szCryptoDevice))) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10132)
+                      "Init: Failed to load Crypto Device API `%s'",
+@@ -636,7 +857,7 @@ apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
+         *pubkey = params.cert;
+     }
+ 
+-    *privkey = ENGINE_load_private_key(e, keyid, ui_method, NULL);
++    *privkey = ENGINE_load_private_key(e, keyid, ui_method, &ppcb);
+     if (*privkey == NULL) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10133)
+                      "Init: Unable to get the private key");
+diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
+index 1f629a46e3..8524c515ba 100644
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -994,6 +994,7 @@ apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int,
+  * key returned as *pkey.  certid can be NULL, in which case *pubkey
+  * is not altered.  Errors logged on failure. */
+ apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
++                                        const char *vhostid,
+                                         const char *certid, const char *keyid,
+                                         X509 **pubkey, EVP_PKEY **privkey);
+ 
+-- 
+2.22.0
+
diff --git a/debian/patches/ubuntu/lp-1830728-mod_ssl-Add-support-for-loading-TLS-certificates-thr.patch b/debian/patches/ubuntu/lp-1830728-mod_ssl-Add-support-for-loading-TLS-certificates-thr.patch
 new file mode 100644
index 0000000..a07d8b9
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1830728-mod_ssl-Add-support-for-loading-TLS-certificates-thr.patch
@@ -0,0 +1,207 @@
+From 9007b62ecc0ad59edb37ec5f267a08868064699c Mon Sep 17 00:00:00 2001
+From: Joe Orton <[e-mail]>
+Date: Tue, 8 May 2018 12:39:22 +0000
+Subject: [PATCH] mod_ssl: Add support for loading TLS certificates through the
+ PKCS#11 engine.
+
+* modules/ssl/ssl_util.c (modssl_is_engine_id): Renamed
+  from modssl_is_engine_key.
+
+* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLCertificateKeyFile):
+  Adjust accordingly.
+  (ssl_cmd_SSLCertificateFile): Also allow ENGINE cert ids.
+
+* modules/ssl/ssl_engine_pphrase.c (modssl_load_engine_keypair):
+  Rename from modssl_load_engine_key; load certificate if
+  cert id is passed.
+
+* modules/ssl/ssl_engine_init.c (ssl_init_server_certs): Optionally
+  load the certificate from the engine as well.
+
+* docs/manual/: Update manual.
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1831168 13f79535-47bb-0310-9956-ffa450edef68
+
+Origin: backport, https://github.com/apache/httpd/commit/9007b62ecc0ad59edb37ec5f267a08868064699c
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1830728
+Last-Update: 2019-07-29
+
+---
+ modules/ssl/ssl_engine_config.c   |  6 ++++--
+ modules/ssl/ssl_engine_init.c     | 26 +++++++++++++++++++++++---
+ modules/ssl/ssl_engine_pphrase.c  | 30 ++++++++++++++++++++++--------
+ modules/ssl/ssl_private.h         | 15 +++++++++------
+ modules/ssl/ssl_util.c            |  2 +-
+ 8 files changed, 85 insertions(+), 27 deletions(-)
+
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -1008,7 +1008,9 @@ const char *ssl_cmd_SSLCACertificateFile
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     const char *err;
+ 
+-    if ((err = ssl_cmd_check_file(cmd, &arg))) {
++    /* Only check for non-ENGINE based certs. */
++    if (!modssl_is_engine_id(arg)
++        && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+ 
+@@ -1044,7 +1046,7 @@ const char *ssl_cmd_SSLCADNRequestFile(c
+     const char *err;
+ 
+     /* Check keyfile exists for non-ENGINE keys. */
+-    if (!modssl_is_engine_key(arg)
++    if (!modssl_is_engine_id(arg)
+         && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1229,13 +1229,17 @@ static apr_status_t ssl_init_server_cert
+                                           const char *));
+          i++) {
+         EVP_PKEY *pkey;
++        const char *engine_certfile = NULL;
+ 
+         key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i);
+ 
+         ERR_clear_error();
+ 
+         /* first the certificate (public key) */
+-        if (mctx->cert_chain) {
++        if (modssl_is_engine_id(certfile)) {
++            engine_certfile = certfile;
++        }
++        else if (mctx->cert_chain) {
+             if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile,
+                                               SSL_FILETYPE_PEM) < 1)) {
+                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561)
+@@ -1264,12 +1268,28 @@ static apr_status_t ssl_init_server_cert
+ 
+         ERR_clear_error();
+ 
+-        if (modssl_is_engine_key(keyfile)) {
++        if (modssl_is_engine_id(keyfile)) {
+             apr_status_t rv;
+ 
+-            if ((rv = modssl_load_engine_pkey(s, ptemp, keyfile, &pkey))) {
++            cert = NULL;
++            
++            if ((rv = modssl_load_engine_keypair(s, ptemp, engine_certfile,
++                                                 keyfile, &cert, &pkey))) {
+                 return rv;
+             }
++
++            if (cert) {
++                if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) {
++                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO()
++                                 "Failed to configure engine certificate %s, check %s",
++                                 key_id, certfile);
++                    ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++                    return APR_EGENERAL;
++                }
++
++                /* SSL_CTX now owns the cert. */
++                X509_free(cert);
++            }                    
+             
+             if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) {
+                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130)
+--- a/modules/ssl/ssl_engine_pphrase.c
++++ b/modules/ssl/ssl_engine_pphrase.c
+@@ -616,11 +616,11 @@ int ssl_pphrase_Handle_CB(char *buf, int
+ }
+ 
+ #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+-apr_status_t modssl_load_engine_pkey(server_rec *s, apr_pool_t *p,
+-                                     const char *keyid, EVP_PKEY **ppkey)
++apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
++                                        const char *certid, const char *keyid,
++                                        X509 **pubkey, EVP_PKEY **privkey)
+ {
+     SSLModConfigRec *mc = myModConfig(s);
+-    EVP_PKEY *pPrivateKey = NULL;
+     ENGINE *e;
+     UI_METHOD *ui_method;
+ 
+@@ -647,17 +647,31 @@ apr_status_t modssl_load_engine_pkey(ser
+     if (APLOGdebug(s)) {
+         ENGINE_ctrl_cmd_string(e, "VERBOSE", NULL, 0);
+     }
+-    
+-    pPrivateKey = ENGINE_load_private_key(e, keyid, ui_method, NULL);
+-    if (pPrivateKey == NULL) {
++
++    if (certid) {
++        struct {
++            const char *cert_id;
++            X509 *cert;
++        } params = { certid, NULL };
++
++        if (!ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &params, NULL, 1)) {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10136)
++                         "Init: Unable to get the certificate");
++            ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++            return ssl_die(s);
++        }
++
++        *pubkey = params.cert;
++    }
++
++    *privkey = ENGINE_load_private_key(e, keyid, ui_method, NULL);
++    if (*privkey == NULL) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10133)
+                      "Init: Unable to get the private key");
+         ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+         return ssl_die(s);
+     }
+ 
+-    *ppkey = pPrivateKey;
+-
+     ENGINE_free(e);
+ 
+     return APR_SUCCESS;
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -1001,10 +1001,13 @@ BOOL         ssl_util_vhost_matches(cons
+ /**  Pass Phrase Support  */
+ apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int,
+                                      const char *, apr_array_header_t **);
+-/* Load private key from the configured ENGINE, returned as **pkey.
+- * Errors logged on failure. */
+-apr_status_t modssl_load_engine_pkey(server_rec *s, apr_pool_t *p,
+-                                     const char *keyid, EVP_PKEY **ppkey);
++
++/* Load public and/or private key from the configured ENGINE. Private
++ * key returned as *pkey.  certid can be NULL, in which case *pubkey
++ * is not altered.  Errors logged on failure. */
++apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
++                                        const char *certid, const char *keyid,
++                                        X509 **pubkey, EVP_PKEY **privkey);
+ 
+ /**  Diffie-Hellman Parameter Support  */
+ DH           *ssl_dh_GetParamFromFile(const char *);
+@@ -1111,8 +1114,8 @@ DH *modssl_get_dh_params(unsigned keylen
+ int modssl_request_is_tls(const request_rec *r, SSLConnRec **sslconn);
+ 
+ /* Returns non-zero if the cert/key filename should be handled through
+- * the configure ENGINE. */
+-int modssl_is_engine_key(const char *name);
++ * the configured ENGINE. */
++int modssl_is_engine_id(const char *name);
+ 
+ int ssl_is_challenge(conn_rec *c, const char *servername, 
+                      X509 **pcert, EVP_PKEY **pkey);
+--- a/modules/ssl/ssl_util.c
++++ b/modules/ssl/ssl_util.c
+@@ -481,7 +481,7 @@ void ssl_util_thread_id_setup(apr_pool_t
+ 
+ #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */
+ 
+-int modssl_is_engine_key(const char *name)
++int modssl_is_engine_id(const char *name)
+ {
+ #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+     /* ### Can handle any other special ENGINE key names here? */
diff --git a/debian/patches/ubuntu/lp-1830728-mod_ssl-Add-support-for-loading-private-keys-from-EN.patch b/debian/patches/ubuntu/lp-1830728-mod_ssl-Add-support-for-loading-private-keys-from-EN.patch
 new file mode 100644
index 0000000..8fbf151
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1830728-mod_ssl-Add-support-for-loading-private-keys-from-EN.patch
@@ -0,0 +1,185 @@
+From e71764a49d1276b8051b83e6ad346482f3e7bc06 Mon Sep 17 00:00:00 2001
+From: Joe Orton <[e-mail]>
+Date: Thu, 3 May 2018 13:06:46 +0000
+Subject: [PATCH] mod_ssl: Add support for loading private keys from ENGINEs. 
+ Support for PKCS#11 URIs only, and PIN entry is not threaded through
+ SSLPassPhraseDialog config yet.
+
+* modules/ssl/ssl_util.c (modssl_is_engine_key): New function.
+
+* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLCertificateKeyFile):
+  Use it, skip check for file existence for engine keys.
+
+* modules/ssl/ssl_engine_pphrase.c (modssl_load_engine_pkey):
+  New function.
+
+* modules/ssl/ssl_engine_init.c (ssl_init_server_certs):
+  For engine keys, load via modssl_load_engine_pkey.
+
+Submitted by: Anderson Sasaki <ansasaki redhat.com>, jorton
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1830819 13f79535-47bb-0310-9956-ffa450edef68
+
+Origin: backport, https://github.com/apache/httpd/commit/e71764a49d1276b8051b83e6ad346482f3e7bc06
+Last-Update: 2019-07-29
+
+---
+ modules/ssl/ssl_engine_config.c   |  4 ++-
+ modules/ssl/ssl_engine_init.c     | 26 ++++++++++++----
+ modules/ssl/ssl_engine_pphrase.c  | 49 +++++++++++++++++++++++++++++++
+ modules/ssl/ssl_private.h         |  8 +++++
+ modules/ssl/ssl_util.c            | 10 +++++++
+ 8 files changed, 112 insertions(+), 10 deletions(-)
+
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -1043,7 +1043,9 @@ const char *ssl_cmd_SSLCADNRequestFile(c
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     const char *err;
+ 
+-    if ((err = ssl_cmd_check_file(cmd, &arg))) {
++    /* Check keyfile exists for non-ENGINE keys. */
++    if (!modssl_is_engine_key(arg)
++        && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+ 
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1228,6 +1228,8 @@ static apr_status_t ssl_init_server_cert
+                 (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
+                                           const char *));
+          i++) {
++        EVP_PKEY *pkey;
++
+         key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i);
+ 
+         ERR_clear_error();
+@@ -1262,12 +1264,26 @@ static apr_status_t ssl_init_server_cert
+ 
+         ERR_clear_error();
+ 
+-        if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
+-                                         SSL_FILETYPE_PEM) < 1) &&
+-            (ERR_GET_FUNC(ERR_peek_last_error())
+-                != X509_F_X509_CHECK_PRIVATE_KEY)) {
++        if (modssl_is_engine_key(keyfile)) {
++            apr_status_t rv;
++
++            if ((rv = modssl_load_engine_pkey(s, ptemp, keyfile, &pkey))) {
++                return rv;
++            }
++            
++            if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) {
++                ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130)
++                             "Failed to configure private key %s from engine",
++                             keyfile);
++                ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++                return APR_EGENERAL;
++            }
++        }
++        else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
++                                              SSL_FILETYPE_PEM) < 1)
++                 && (ERR_GET_FUNC(ERR_peek_last_error())
++                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
+             ssl_asn1_t *asn1;
+-            EVP_PKEY *pkey;
+             const unsigned char *ptr;
+ 
+             ERR_clear_error();
+--- a/modules/ssl/ssl_engine_pphrase.c
++++ b/modules/ssl/ssl_engine_pphrase.c
+@@ -614,3 +614,52 @@ int ssl_pphrase_Handle_CB(char *buf, int
+      */
+     return (len);
+ }
++
++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++apr_status_t modssl_load_engine_pkey(server_rec *s, apr_pool_t *p,
++                                     const char *keyid, EVP_PKEY **ppkey)
++{
++    SSLModConfigRec *mc = myModConfig(s);
++    EVP_PKEY *pPrivateKey = NULL;
++    ENGINE *e;
++    UI_METHOD *ui_method;
++
++    if (!mc->szCryptoDevice) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10131)
++                     "Init: Cannot load private key `%s' without engine",
++                     keyid);
++        return ssl_die(s);
++    }
++
++    /*
++     * Using the builtin OpenSSL UI only, for now...
++     */
++    ui_method = UI_OpenSSL();
++
++    if (!(e = ENGINE_by_id(mc->szCryptoDevice))) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10132)
++                     "Init: Failed to load Crypto Device API `%s'",
++                     mc->szCryptoDevice);
++        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++        return ssl_die(s);
++    }
++
++    if (APLOGdebug(s)) {
++        ENGINE_ctrl_cmd_string(e, "VERBOSE", NULL, 0);
++    }
++    
++    pPrivateKey = ENGINE_load_private_key(e, keyid, ui_method, NULL);
++    if (pPrivateKey == NULL) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10133)
++                     "Init: Unable to get the private key");
++        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++        return ssl_die(s);
++    }
++
++    *ppkey = pPrivateKey;
++
++    ENGINE_free(e);
++
++    return APR_SUCCESS;
++}
++#endif
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -1001,6 +1001,10 @@ BOOL         ssl_util_vhost_matches(cons
+ /**  Pass Phrase Support  */
+ apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int,
+                                      const char *, apr_array_header_t **);
++/* Load private key from the configured ENGINE, returned as **pkey.
++ * Errors logged on failure. */
++apr_status_t modssl_load_engine_pkey(server_rec *s, apr_pool_t *p,
++                                     const char *keyid, EVP_PKEY **ppkey);
+ 
+ /**  Diffie-Hellman Parameter Support  */
+ DH           *ssl_dh_GetParamFromFile(const char *);
+@@ -1106,6 +1110,10 @@ DH *modssl_get_dh_params(unsigned keylen
+  * corresponding SSLConnRec structure for the connection. */
+ int modssl_request_is_tls(const request_rec *r, SSLConnRec **sslconn);
+ 
++/* Returns non-zero if the cert/key filename should be handled through
++ * the configure ENGINE. */
++int modssl_is_engine_key(const char *name);
++
+ int ssl_is_challenge(conn_rec *c, const char *servername, 
+                      X509 **pcert, EVP_PKEY **pkey);
+ 
+--- a/modules/ssl/ssl_util.c
++++ b/modules/ssl/ssl_util.c
+@@ -480,3 +480,13 @@ void ssl_util_thread_id_setup(apr_pool_t
+ }
+ 
+ #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */
++
++int modssl_is_engine_key(const char *name)
++{
++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++    /* ### Can handle any other special ENGINE key names here? */
++    return strncmp(name, "pkcs11:", 7) == 0;
++#else
++    return 0;
++#endif
++}