mod_http3 v0.0.71 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.
This update fixes security vulnerabilities. Upgrading is recommended.
Major changes:
- A host with “h3” in Protocols now serves HTTP/3 with the certificate mod_ssl resolved for it (SSLCertificateFile and mod_md alike), the way mod_http2 rides mod_ssl. H3CertificatePath and H3CertificateKeyPath are removed; drop them from existing configurations.
- Select the HTTP/3 certificate by SNI, so each virtual host on a shared port serves its own certificate instead of the first host’s.
- Give every virtual host its own mod_http3 configuration (AP_MODULE_FLAG_ALWAYS_MERGE). A host without H3 directives used to share the main server’s, so per-host settings such as H3AltSvc and H3AltSvcMaxAge were silently ignored and hosts could not carry their own certificate.
- Test suite: stop.conf now names the same pid file as httpd.conf, so “apachectl -k stop” actually stops the server on httpd builds whose default pid file lives in run/; before, every restart in the suite kept talking to the previous server.
Fixed vulnerabilities:
- SECURITY: Load the HTTP/3 certificate and key in post_config, while httpd still runs privileged, so a root-only key no longer fails in the unprivileged child and both mod_ssl and mod_http3 read the same files.