mod_ssl 2.5.x supports RFC5929 - Channel Bindings for TLS, https://www.mail-archive.com/dev@httpd.apache.org/msg60421.html

See:
https://tools.ietf.org/html/rfc5929
https://tools.ietf.org/html/rfc5056

Simo had looked at this for mod_nss as well but wasn't able to get it to work since NSS doesn't allow access to the internals of the handshake.

I think the SERVER_END_POINT types can be supported since we have access to the certs at most any time past the handshake.

The mod_auth_gssapi test branch can be found at https://github.com/simo5/mod_auth_gssapi/tree/rfc5929

Information on how Microsoft uses this can be found at https://blogs.msdn.microsoft.com/openspecification/2013/03/26/ntlm-and-channel-binding-hash-aka-extended-protection-for-authentication/