Bug#461917: Apache 2.2 TLS-SNI support

[Stefan Fritsch <sf@sfritsch.de>]

On Thursday 24 April 2008, Sam Morris wrote:
> On Wed, 2008-04-23 at 20:27 +0200, Stefan Fritsch wrote:
> > On Wednesday 23 April 2008, Raphaël Rigo wrote:
> > > is there any chance this feature would make it for lenny's
> > > final release ?
> >
> > The current version of the SNI patch has problems (including a
> > security issue).
>
> Details please? I haven't received anything from upstream's
> bugzilla...

SSLVerifyClient is not enforced correctly:

http://mail-archives.apache.org/mod_mbox/httpd-dev/200804.mbox/<20080422184144.GA4237%40redhat.com>