HttpServer访问日志无法捕获SSL_PROTOCOL，配置后未生效求解决

云上老周

2026-5-26

Troubleshooting Missing SSL_PROTOCOL in Apache Logs

Got it, let's walk through why you're not capturing the SSL_PROTOCOL value in your Apache logs and how to fix it, plus some alternatives if needed.

Required Preconditions

Before the %{SSL_PROTOCOL}e variable will work, you need to make sure these foundational steps are in place:

mod_ssl must be loaded and enabled
The SSL_PROTOCOL environment variable is provided by Apache's mod_ssl module—without it, there's no source for that data. Check your httpd.conf (or relevant conf.d files) for this line:
```
LoadModule ssl_module modules/mod_ssl.so
```
The path to mod_ssl.so might vary by OS (e.g., /usr/lib64/httpd/modules/mod_ssl.so on RHEL/CentOS, /usr/lib/apache2/modules/mod_ssl.so on Ubuntu). For Debian/Ubuntu systems, you'll also need to enable the module explicitly with:
```
a2enmod ssl
```
Your VirtualHost must be configured for HTTPS
SSL_PROTOCOL only exists for HTTPS connections. Make sure you have a <VirtualHost *:443> block with valid SSL certificate configurations, like:
```
<VirtualHost *:443>
    ServerName yourdomain.com
    SSLCertificateFile /path/to/your/cert.crt
    SSLCertificateKeyFile /path/to/your/private.key
    # Other SSL settings (like SSLCipherSuite) go here
</VirtualHost>
```
HTTP connections (port 80) will never populate this variable, so testing with https:// is mandatory.
Your custom LogFormat must be linked to the SSL VirtualHost
Defining the LogFormat isn't enough—you need to tell Apache to use it for your HTTPS traffic. Add this line inside your <VirtualHost *:443> block:
```
CustomLog logs/ssl_access.log common
```
Replace logs/ssl_access.log with your preferred log file path. If you're using the default HTTP CustomLog for port 80, it won't pick up SSL variables.

If you've checked all the preconditions and still don't see SSL_PROTOCOL in logs, try these workarounds:

Inline the log format directly in CustomLog
Sometimes referencing a named LogFormat can cause issues (e.g., if the format is defined before mod_ssl loads). Skip the named format and write the full string in your SSL VirtualHost:
```
CustomLog logs/ssl_access.log "%h %l %u %t %T\"%r\" %>s %b \"%{SSL_PROTOCOL}e\" "
```
Verify the variable with a test script
Create a simple PHP or CGI script to dump all environment variables, then access it over HTTPS. For a PHP script:
```
<?php phpinfo(INFO_ENVIRONMENT); ?>
```
Look for SSL_PROTOCOL in the output—if it's missing here, the issue is with mod_ssl or your SSL configuration, not the log format.
Use %{SSL_PROTOCOL}x (rare cases)
In some older Apache versions or non-standard configurations, using the %{VAR}x format (which retrieves notes set by modules) might work instead of %{VAR}e. Give this a try in your LogFormat:
```
LogFormat "%h %l %u %t %T\"%r\" %>s %b \"%{SSL_PROTOCOL}x\" " common
```

After making any configuration changes, always restart Apache to apply them:

# RHEL/CentOS/Fedora
systemctl restart httpd

# Debian/Ubuntu
systemctl restart apache2

Test your HTTPS endpoint again, then check your log file—you should see the SSL protocol version (like TLSv1.3 or TLSv1.2) in the quoted field.

内容的提问来源于stack exchange，提问作者Sundar