OpenSSL 4.0 is in experimental. This package fails to build against it:

| ssl_engine_ocsp.c: In function 'extract_responder_uri':
| ssl_engine_ocsp.c:42:86: error: invalid use of incomplete typedef 'ASN1_IA5STRING' {aka 'struct asn1_string_st'}
|    42 |                                  (char *)value->location->d.uniformResourceIdentifier->data);
|       |                                                                                      ^~
| make[6]: *** [/build/reproducible-path/apache2-2.4.66/build/rules.mk:212: ssl_engine_ocsp.slo] Error 1
| make[6]: *** Waiting for unfinished jobs....
| ssl_util_ssl.c: In function 'modssl_X509_NAME_ENTRY_to_string':
| ssl_util_ssl.c:226:43: warning: passing argument 2 of 'asn1_string_convert' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   226 |     char *result = asn1_string_convert(p, X509_NAME_ENTRY_get_data(xsne), raw);
|       |                                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| ssl_util_ssl.c:205:62: note: expected 'ASN1_STRING *' {aka 'struct asn1_string_st *'} but argument is of type 'const ASN1_STRING *' {aka 'const struct asn1_string_st *'}
|   205 | static char *asn1_string_convert(apr_pool_t *p, ASN1_STRING *asn1str, int raw)
|       |                                                 ~~~~~~~~~~~~~^~~~~~~
| ssl_util_ssl.c: In function 'getIDs':
| ssl_util_ssl.c:376:10: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   376 |     subj = X509_get_subject_name(x509);
|       |          ^
| ssl_util_ssl.c:379:49: warning: passing argument 2 of 'modssl_X509_NAME_ENTRY_to_string' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   379 |             modssl_X509_NAME_ENTRY_to_string(p, X509_NAME_get_entry(subj, i), 0);
|       |                                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
| ssl_util_ssl.c:223:72: note: expected 'X509_NAME_ENTRY *' {aka 'struct X509_name_entry_st *'} but argument is of type 'const X509_NAME_ENTRY *' {aka 'const struct X509_name_entry_st *'}
|   223 | char *modssl_X509_NAME_ENTRY_to_string(apr_pool_t *p, X509_NAME_ENTRY *xsne,

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/apache2_2.4.66-8_amd64-2026-04-19T08:03:53Z

Sebastian

control: tags -1 + patch

Patch attached.

Sebastian

Hello,

Bug #1137387 in apache2 reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/apache-team/apache2/-/commit/b341688f018010b97b8a8ddc448999da24c3c3e4
------------------------------------------------------------------------
Add fix for openssl 4.0

Closes: #1137387
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1137387

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1137387@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 31 Aug 2026 12:45:34 +0200
Source: apache2
Architecture: source
Version: 2.4.68-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1137387
Changes:
 apache2 (2.4.68-2) unstable; urgency=medium
 .
   [ Bastien Roucariès ]
   * Improve wording of NEWS
 .
   [ Xavier Guimard ]
   * Optimize signing-key.asc
 .
   [ Sebastian Andrzej Siewior ]
   * Add fix for openssl 4.0 (Closes: #1137387)
Checksums-Sha1:
 61d4bdc0dbaabbba68144fff16a3f1c17082028b 3585 apache2_2.4.68-2.dsc
 bd39b6a8f211ff5e70752166e84d52a069a5fb3a 823928 apache2_2.4.68-2.debian.tar.xz
Checksums-Sha256:
 19f6f15b97e5865db55ad33c439a057ecc058f42d36b584287e9fc3d706ec376 3585 apache2_2.4.68-2.dsc
 6dc17277f5b3055c8dc2580fdafb449792f812956af046d721081cf23403fcd1 823928 apache2_2.4.68-2.debian.tar.xz
Files:
 10656d345184ad5df9806dcd3283d4fc 3585 httpd optional apache2_2.4.68-2.dsc
 5d97107d15e79fd24e5ce14af492ba94 823928 httpd optional apache2_2.4.68-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqVXAkACgkQ9tdMp8mZ
7ukpnw/+N0gq8q+iyc3m2AxkKvWF+/HJrBnJA7yPWL7ZFerZ6s7mR98MpOEOOYFm
cEGQrkptonqWTCD3OAV2NsFH/KzSHYdb+6jZhib6wkYyOzbSUtb0jB9mZVsVxU1Y
kIWXc03WxMdtLv/DZTidyjX3UhePZYdciirPgvIhNS6buEnwVnbzmZgPcsknfXlu
IKpg3F8J53NdD3tbkmEg0DZl2bIafz8z52GCGCdb30PX0iK6mWDnEOmK4C8rqfhS
f1JiDyqAG0BVIwi66NTAiYtpfefcHMxDRTzTpWVrKayvfaAjW82IOQ8iBy2CY6lS
F/wtmzDMw420L5qgFfvFhq+pSQYmKuc8anHeizRHXpXr8lOlCkQdU46t3+mzV3Ua
kF0w/fcRkz6P6QklocIG9GrzjWIdZV6QyaD0zkeqxOmzisybpAjGSP4S02WdxXaT
UWK6NhMZU4rikks9He1+DrebTlw/e+iZ5TNcClS2yMi9dnnfUhmUMBkeesI70Unp
9DkhcXF8UuFUPTW6skYVimml/XgAVb3Wkmw4Yg9tUEXdqURRZDOcKsRfgfEWKOAI
eL+4lpJ9CTW7G5JqdEGHHXZxB7U81ip8XFkL8gKF3A5Q7SKIm+AZ2AhsWdEMjhF/
028JKCHj0XPyfLmdcH0S4xcww2MO8sYkgRzoacnmmKCzF6X6auw=
=7qI9
-----END PGP SIGNATURE-----