From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Oct 2021 13:48:55 +0100
Subject: * modules/ssl/ssl_engine_init.c (ssl_init_ctx_callbacks,
   ssl_init_server_certs): Flip logic for enabling/disabling DH auto
   parameter selection for OpenSSL 1.1+ to be simpler and consistent   with
 auto ECDH curve selection.


Forwarded: yes, https://github.com/apache/httpd/pull/258
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
---
 modules/ssl/ssl_engine_init.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index 3986ba7..f440a37 100644
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -836,9 +836,9 @@ static void ssl_init_ctx_callbacks(server_rec *s,
     SSL_CTX *ctx = mctx->ssl_ctx;
 
 #if MODSSL_USE_OPENSSL_PRE_1_1_API
+    /* Note that for OpenSSL>=1.1, auto selection is enabled via
+     * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */
     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
-#else
-    SSL_CTX_set_dh_auto(ctx, 1);
 #endif
 
     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
@@ -1499,16 +1499,18 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
         /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey()
          * for OpenSSL 3.0+. */
         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
-#if !MODSSL_USE_OPENSSL_PRE_1_1_API
-        /* OpenSSL ignores manually configured DH params if automatic
-         * selection if enabled, so disable auto selection here. */
-        SSL_CTX_set_dh_auto(mctx->ssl_ctx, 0);
-#endif
         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
                      "Custom DH parameters (%d bits) for %s loaded from %s",
                      modssl_DH_bits(dh), vhost_id, certfile);
         DH_free(dh);
     }
+#if !MODSSL_USE_OPENSSL_PRE_1_1_API
+    else {
+        /* If no parameter is manually configured, enable auto
+         * selection. */
+        SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1);
+    }
+#endif
 
 #ifdef HAVE_ECC
     /*
