* docs/manual/mod/mod_ssl.xml: Warn more clearly about

the security impact of SSLInsecureRenegotiation.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@906454 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml
index 6eee29ca058509096ca87891942ebfacbcda1960..05967a0a69887ce0fb2a45c75cf444aa382663cd 100644 (file)
--- a/docs/manual/mod/mod_ssl.xml
+++ b/docs/manual/mod/mod_ssl.xml
@@ -1781,6 +1781,7 @@ certificate being validated references an OCSP responder.</p>
 <contextlist><context>server config</context>
 <context>virtual host</context></contextlist>
 <compatibility>Available in httpd 2.3 and later, if using OpenSSL 1.0.0 Beta 5 or later</compatibility>
+<default>SSLInsecureRenegotiation off</default>
 
 <usage>
 <p>As originally specified, all versions of the SSL and TLS protocols
@@ -1795,15 +1796,23 @@ vulnerability if supported by both client and server.</p>
 <p>If <module>mod_ssl</module> is linked against OpenSSL version 1.0.0
 Beta 5 or later, by default renegotiation is only supported with
 clients supporting the new protocol extension.  If this directive is
-enabled, renegotiation will be allowed with old (unpatched) clients.
-SSL connections will be vulnerable to the prefix attack as described
-above if this directive is enabled.  The <code>SSL_SECURE_RENEG</code>
-variable can be used to determine whether secure renegotiation is
-supported for a given SSL connection.</p>
+enabled, renegotiation will be allowed with old (unpatched) clients,
+albeit insecurely.</p>
+
+<note type="warning"><title>Security warning</title>
+<p>If this directive is enabled, SSL connections will be vulnerable to
+the Man-in-the-Middle prefix attack as described
+in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555">CVE-2009-3555</a>.</p>
+</note>
 
 <example><title>Example</title>
 SSLInsecureRenegotiation on
 </example>
+
+<p>The <code>SSL_SECURE_RENEG</code> environment variable can be used
+from an SSI or CGI script to determine whether secure renegotiation is
+supported for a given SSL connection.</p>
+
 </usage>
 </directivesynopsis>