Lighttpd

SSL_CLIENT_VERIFY has been implemented.

SSL_CLIENT_S_DN has not been implemented, and I am not quite convinced it is needed when there are other recommended solutions. According to X509_NAME_oneline() (https://linux.die.net/man/3/x509_name_oneline)

Notes

The functions X509_NAME_oneline() and X509_NAME_print() are legacy functions which produce a non standard output form, they don't handle multi character fields and have various quirks and inconsistencies. Their use is strongly discouraged in new applications.

As an alternative, lighttpd does provide SSL_CLIENT_S_DN_* components, which can be used with e.g.
ssl.verifyclient.username = "SSL_CLIENT_S_DN_UID"
or
ssl.verifyclient.username = "SSL_CLIENT_S_DN_emailAddress"

Is there still a desire to have lighttpd provide SSL_CLIENT_S_DN, given the limitations described above, as well as the alternatives available?

--- a/src/response.c
+++ b/src/response.c
@@ -180,6 +180,16 @@ static void https_add_ssl_client_entries(server *srv, connection *con) {
        }

        {
+               char *s_dn = X509_NAME_oneline(xn, NULL, 0);
+               if (NULL != s_dn) {
+                       array_set_key_value(con->environment,
+                                           CONST_STR_LEN("SSL_CLIENT_S_DN"),
+                                           s_dn, strlen(s_dn));
+                       OPENSSL_free(s_dn);
+               }
+       }
+
+       {
                ASN1_INTEGER *xsn = X509_get_serialNumber(xs);
                BIGNUM *serialBN = ASN1_INTEGER_to_BN(xsn, NULL);
                char *serialHex = BN_bn2hex(serialBN);

Applied in changeset fb87ae860481cd2ab3da9451faaaf7987ae8a645.