Apache httpd 2.4.70 has been added to the CodeIT repository, built with HTTP/2 (mod_http2), Brotli, TLS 1.3 and ALPN, against OpenSSL 4.0.3. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.
From 2.4.69 on, mod_ssl is built against the OpenSSL 3.0 API instead of 1.1.1 (OPENSSL_API_COMPAT raised from 1.1.1 to 3.0.0), because OpenSSL 4.0 removes features that were deprecated before 3.0. SRP (TLS-SRP, RFC 5054) goes with it: the SSLSRPVerifierFile and SSLSRPUnknownUserSeed directives no longer exist, so remove them from your configuration before upgrading or httpd will not start, and the SSL_SRP_USER and SSL_SRP_USERINFO variables are no longer set. The ENGINE API was already disabled in these packages.
mod_http2 in the RPM packages is now built from the httpd source tree, the way the DEB packages and Ubuntu’s own apache2 already do, instead of from the separate mod_h2 project. The package keeps its name, mod_http2, and now carries the httpd version, so dnf or yum upgrade from mod_http2 2.0.42 to it on their own: nothing has to be removed first, and an edited 10-h2.conf is kept.
HTTP/3 is available for this httpd through mod_http3, an experimental module packaged separately:
- RPM, EL8 and later: dnf install mod_http3
- RPM, EL7: yum install mod_http3
- DEB: apt install libapache2-mod-http3
The module is loaded as soon as it is installed; HTTP/3 itself is enabled per virtual host. Edit the example vhost the package installs (ServerName and certificate): on EL it is /etc/httpd/vhosts.d/http3-vhost.conf, which httpd.conf does not include by default, so add IncludeOptional vhosts.d/*.conf; on Ubuntu run a2ensite http3-vhost. Then reload httpd and open 443/udp in the firewall, since QUIC runs over UDP.
Major changes:
- mod_authnz_ldap: Fix crashes in 2.4.69 reported on Windows. PR 70261.
- mod_cgid: Increase limits for number and length of environment variables, URI and arguments. PR 70270.
- mod_substitute: Fix an integer overflow that can happen in very special setups. PR 66034
- mod_cache: Do not store a response whose “Vary: *” was set via “Header always”. PR 70289
- mod_dav_lock: Fix a heap buffer overflow in dav_size_indirect(), which under-reserved space for the stored key length field, written as apr_size_t but sized as int. PR 70298