From: Kaspar Brand Date: Fri, 18 Nov 2011 17:37:36 +0000 (+0000) Subject: update transformations X-Git-Tag: 2.5.0-alpha~7862 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c0d91dd1a972e645015c1c7b9cb3a5434ca51af5;p=apache update transformations git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1203761 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index d0950d3be1..8d31e719c0 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -130,7 +130,7 @@ compatibility variables.

Description: HTTPS flag HTTPS is being used. -SSL_PROTOCOL string The SSL protocol version (SSLv2, SSLv3, TLSv1) +SSL_PROTOCOL string The SSL protocol version (SSLv3, TLSv1) SSL_SESSION_ID string The hex-encoded SSL session id SSL_SESSION_RESUMED string Initial or Resumed SSL Session. Note: multiple requests may be served over the same (Initial or Resumed) SSL session if HTTP KeepAlive is in use SSL_SECURE_RENEG string true if secure renegotiation is supported, else false @@ -1184,7 +1184,7 @@ SSLPassPhraseDialog exec:/usr/local/apache/sbin/pp-filter
top

SSLProtocol Directive

- + @@ -1192,17 +1192,11 @@ SSLPassPhraseDialog exec:/usr/local/apache/sbin/pp-filter
Description:Configure usable SSL protocol versions
Description:Configure usable SSL/TLS protocol versions
Syntax:SSLProtocol [+|-]protocol ...
Default:SSLProtocol all
Context:server config, virtual host
Module:mod_ssl

-This directive can be used to control which versions of the SSL protocol +This directive can be used to control which versions of the SSL/TLS protocol will be accepted in new connections.

The available (case-insensitive) protocols are:

Example

-# enable SSLv3 and TLSv1, but not SSLv2
-SSLProtocol all -SSLv2 +SSLProtocol TLSv1

diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index 7425e6b18c..b82ada03b0 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -886,7 +886,7 @@ handshake SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLProtocol [+|-]protocol ... all svEConfigure usable SSL protocol versions +SSLProtocol [+|-]protocol ... all svEConfigure usable SSL/TLS protocol versions SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for diff --git a/docs/manual/ssl/ssl_howto.html.en b/docs/manual/ssl/ssl_howto.html.en index 1c40482aab..fc4be6d5df 100644 --- a/docs/manual/ssl/ssl_howto.html.en +++ b/docs/manual/ssl/ssl_howto.html.en @@ -68,21 +68,18 @@ only?

The following enables only the strongest ciphers:

httpd.conf

- SSLProtocol all -SSLv2
- SSLCipherSuite HIGH:!aNULL:!EXP:!MD5:!NULL
+ SSLCipherSuite HIGH:!aNULL:!MD5

-

While with the following configuration you enable two ciphers - which are resonably secure, and fast:

+

While with the following configuration you specify a preference + for specific speed-optimized ciphers (which will be selected by + mod_ssl, provided that they are supported by the client):

httpd.conf

- SSLProtocol all -SSLv2
- SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!EXP:!MD5:!NULL
+ SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5
SSLHonorCipherOrder on

-

This strongly reflects the default value of SSLCipherSuite and is the recommanded way to configure it.

-

How can I create an SSL server which accepts all types of ciphers in general, but requires a strong ciphers for access to a particular @@ -101,7 +98,7 @@ URL?

<Location /strong/area>
# but https://hostname/strong/area/ and below
# requires strong ciphers
- SSLCipherSuite HIGH:!aNULL:!EXP:!MD5:!NULL
+ SSLCipherSuite HIGH:!aNULL:!MD5
</Location>

diff --git a/docs/manual/upgrading.html.en b/docs/manual/upgrading.html.en index 268f52f174..56b7383c62 100644 --- a/docs/manual/upgrading.html.en +++ b/docs/manual/upgrading.html.en @@ -277,7 +277,8 @@
  • mod_ssl: The default format of the *_DN variables has changed. The old format can still be used with the new - LegacyDNStringFormat argument to SSLOptions.
    • + LegacyDNStringFormat argument to SSLOptions. The SSLv2 protocol is + no longer supported.
  • htpasswd now uses MD5 hash by default on all platforms.