diff --git a/CHANGES b/CHANGES
index 17860a0d9d..95630f7d21 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,6 +10,10 @@ Changes with Apache 2.3.3
      mod_proxy_ftp: NULL pointer dereference on error paths.
      [Stefan Fritsch <sf fritsch.de>, Joe Orton]
 
+  *) mod_ssl: Reintroduce SSL_CLIENT_S_DN, SSL_CLIENT_I_DN, SSL_SERVER_S_DN,
+     SSL_SERVER_I_DN back to the environment variables to be set by mod_ssl.
+     [Peter Sylvester <peter.sylvester edelweb.fr>]
+
   *) mod_cache: don't cache incomplete responses, per RFC 2616, 13.8.
      PR15866.  [Dan Poirier]
 
diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index 2675b8f3d4..9e5df7a5bb 100644
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -1038,12 +1038,16 @@ static const char *ssl_hook_Fixup_vars[] = {
     "SSL_CLIENT_V_START",
     "SSL_CLIENT_V_END",
     "SSL_CLIENT_V_REMAIN",
+    "SSL_CLIENT_S_DN",
+    "SSL_CLIENT_I_DN",
     "SSL_CLIENT_A_KEY",
     "SSL_CLIENT_A_SIG",
     "SSL_SERVER_M_VERSION",
     "SSL_SERVER_M_SERIAL",
     "SSL_SERVER_V_START",
     "SSL_SERVER_V_END",
+    "SSL_SERVER_S_DN",
+    "SSL_SERVER_I_DN",
     "SSL_SERVER_A_KEY",
     "SSL_SERVER_A_SIG",
     "SSL_SESSION_ID",