The mod_ssl package was created in April 1998 by Ralf S. Engelschall and was originally derived from the Apache-SSL package developed by Ben Laurie. It stays under a BSD-style license which is equivalent to the license used by The Apache Group for the Apache webserver itself. This means, in short, that you are free to use it both for commercial and non-commercial purposes as long as you retain the authors' copyright notices and give the proper credit.
LegaleseAlthough the above conditions also apply to Apache and OpenSSL in general (both are freely available and useable software packages), you should be aware that especially the cryptographic algorithms used inside OpenSSL stay under certain patents and perhaps import/export/use restrictions in some countries of the world. So whether you can actually use the combination Apache+mod_ssl+OpenSSL in your country depends mainly on your local state laws. The authors of neither Apache nor mod_ssl nor OpenSSL are liable for any violations you make here.
If you're not sure what law details apply to your country you're strongly advised to first determine them by consulting an attorney before using this module. A lot of hints you can find in the International Law Crypto Survey which is a really comprehensive resource on this topic. At least two countries with heavy cryptography restrictions are well known: In the United States (USA) first it's not allowed to (re-)export mod_ssl or OpenSSL and second it's not allowed to use Apache+mod_ssl+OpenSSL (because of patent issues on the RSA and RC4 algorithms) unless OpenSSL is built with RSA DSI's RSAref package and used for non-commercial purposes only. And inside France it's not allowed to use any cryptography at all when keys with more than 40 bits are used.
Module ArchitectureThe mod_ssl package consists of the SSL module (part 1 in Figure 1) and a set of source patches for Apache adding the Extended API (EAPI) (part 2 in Figure 1) which is an essential prerequisite in order to use mod_ssl. In other words: you can only use the mod_ssl module when Apache's core code contains the Extended API. But because when applying mod_ssl to the Apache source tree the Extended API is also automatically added you usually don't have to think about this. It's mainly important for package vendors who want to build separate packages for Apache and mod_ssl. For more details on how to apply mod_ssl to the Apache source tree please follow the
Module BuildingThe SSL module (mod_ssl) resides under the
or by manually editing the$ cd apache_1.3.x/ $ SSL_BASE=/path/to/openssl ./configure ... --enable-module=ssl
for configuring. Additionally you can enable the Dynamic Shared Object (DSO) support for mod_ssl by either adding the$ cd apache_1.3.x/src $ ./Configure
line inAddModule ssl_module modules/ssl/libssl.a
Building mod_ssl as a DSO is especially interesting to achieve more run-time flexibility, i.e. you can decide whether to use SSL or not at run-time instead of build-time. But notice that building mod_ssl as a DSO requires that your OS/compiler supports building DSOs in the first place, and additionally that they support linking of a DSO against a static library (libssl.a, libcrypo.a). Not all platform support this.SharedModule ssl_module modules/ssl/libssl.so