From: Joe Orton Date: Thu, 4 Feb 2010 14:32:28 +0000 (+0000) Subject: Update transformations. X-Git-Tag: 2.3.6~515 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=29d92ab59c558837aa553fe3d83f5366555b185d;p=apache Update transformations. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@906495 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index dd0e7ae866..f425a3f40c 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -90,6 +90,7 @@ to provide the cryptography engine.

top
@@ -178,6 +179,34 @@ provided. Information about this function is provided in the

+
top
+
+

Request Notes

+ +

mod_ssl sets "notes" for the request which can be +used in logging with the %{name}n format +string in mod_log_config.

+ +

The notes supported are as follows:

+ +
+
ssl-access-forbidden
+
This note is set to the value 1 if access was + denied due to an SSLRequire + or SSLRequireSSL directive.
+ +
ssl-secure-reneg
+
If mod_ssl is built against a version of + OpenSSL which supports the secure renegotiation extension, this note + is set to the value 1 if SSL is in used for the current + connection, and the client also supports the secure renegotiation + extension. If the client does not support the secure renegotiation + extension, the note is set to the value 0. + If mod_ssl is not built against a version of + OpenSSL which supports secure renegotiation, or if SSL is not in use + for the current connection, the note is not set.
+
+
top

SSLCACertificateFile Directive

@@ -661,6 +690,7 @@ SSLHonorCipherOrder on + @@ -678,16 +708,24 @@ vulnerability if supported by both client and server.

If mod_ssl is linked against OpenSSL version 1.0.0 Beta 5 or later, by default renegotiation is only supported with clients supporting the new protocol extension. If this directive is -enabled, renegotiation will be allowed with old (unpatched) clients. -SSL connections will be vulnerable to the prefix attack as described -above if this directive is enabled. The SSL_SECURE_RENEG -variable can be used to determine whether secure renegotiation is -supported for a given SSL connection.

+enabled, renegotiation will be allowed with old (unpatched) clients, +albeit insecurely.

+ +

Security warning

+

If this directive is enabled, SSL connections will be vulnerable to +the Man-in-the-Middle prefix attack as described +in CVE-2009-3555.

+

Example

SSLInsecureRenegotiation on

+

The SSL_SECURE_RENEG environment variable can be used +from an SSI or CGI script to determine whether secure renegotiation is +supported for a given SSL connection.

+ +
top

SSLOCSPDefaultResponder Directive

diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index c936ec8cc7..40ba225544 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -770,7 +770,7 @@ handshake
- +
Description:Option to enable support for insecure renegotiation
Syntax:SSLInsecureRenegotiation flag
Default:SSLInsecureRenegotiation off
Context:server config, virtual host
Status:Extension
Module:mod_ssl
SSLCryptoDevice engine builtin sE
Enable use of a cryptographic hardware accelerator
SSLEngine on|off|optional off svE
SSL Engine Operation Switch
SSLHonorCiperOrder flagsvE
Option to prefer the server's cipher preference order
SSLInsecureRenegotiation flagsvE
Option to enable support for insecure renegotiation
SSLInsecureRenegotiation flag off svE
Option to enable support for insecure renegotiation
SSLOCSDefaultResponder urisvE
Set the default responder URI for OCSP validation
SSLOCSPEnable flagsvE
Enable OCSP validation of the client certificate chain
SSLOCSPOverrideResponder flagsvE
Force use of the default responder URI for OCSP validation