From: Joe Orton Date: Thu, 29 Nov 2007 13:58:53 +0000 (+0000) Subject: - regenerate for mod_ssl OCSP directives X-Git-Tag: 2.3.0~1206 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=efa84a4e61f63354fade7ddfb2e1faec8fef5448;p=apache - regenerate for mod_ssl OCSP directives git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@599446 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/directives.html.en b/docs/manual/mod/directives.html.en index 8605714c73..beb0b70ee3 100644 --- a/docs/manual/mod/directives.html.en +++ b/docs/manual/mod/directives.html.en @@ -398,6 +398,9 @@
  • SSLEngine
  • SSLHonorCipherOrder
  • SSLMutex
    • +
  • SSLOCSPDefaultResponder
    • +
  • SSLOCSPEnable
    • +
  • SSLOCSPOverrideResponder
  • SSLOptions
  • SSLPassPhraseDialog
  • SSLProtocol
    • diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 58d45784dc..3611b33c55 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -56,6 +56,9 @@ to provide the cryptography engine.

  • SSLEngine
  • SSLHonorCipherOrder
  • SSLMutex
    • +
  • SSLOCSPDefaultResponder
    • +
  • SSLOCSPEnable
    • +
  • SSLOCSPOverrideResponder
  • SSLOptions
  • SSLPassPhraseDialog
  • SSLProtocol
    • @@ -728,6 +731,65 @@ The following Mutex types are available:

    SSLMutex file:/usr/local/apache/logs/ssl_mutex

    + +
    top
    +

    SSLOCSPDefaultResponder Directive

    + + + + + + + +
    Description:Set the default responder URI for OCSP validation
    Syntax:SSLOCSDefaultResponder uri
    Context:server config, virtual host
    Status:Extension
    Module:mod_ssl
    Compatibility:Available in httpd 2.3 and later, if using OpenSSL 0.9.7 or later
    +

    This option sets the default OCSP responder to use. If SSLOCSPOverrideResponder is not enabled, +the URI given will be used only if no responder URI is specified in +the certificate being verified.

    + +
    +
    top
    +

    SSLOCSPEnable Directive

    + + + + + + + +
    Description:Enable OCSP validation of the client certificate chain
    Syntax:SSLOCSPEnable flag
    Context:server config, virtual host
    Status:Extension
    Module:mod_ssl
    Compatibility:Available in httpd 2.3 and later, if using OpenSSL 0.9.7 or later
    +

    This option enables OCSP validation of the client certificate +chain. If this option is enabled, certificates in the client's +certificate chain will be validated against an OCSP responder after +normal verification (including CRL checks) have taken place.

    + +

    The OCSP responder used is either extracted from the certificate +itself, or derived by configuration; see the +SSLOCSPDefaultResponder and +SSLOCSPOverrideResponder +directives.

    + +

    Example

    +SSLVerifyClient on
    +SSLOCSPEnable on
    +SSLOCSPDefaultResponder http://responder.example.com:8888/responder
    +SSLOCSPOverrideResponder on +

    + +
    +
    top
    +

    SSLOCSPOverrideResponder Directive

    + + + + + + + +
    Description:Force use of the default responder URI for OCSP validation
    Syntax:SSLOCSPOverrideResponder flag
    Context:server config, virtual host
    Status:Extension
    Module:mod_ssl
    Compatibility:Available in httpd 2.3 and later, if using OpenSSL 0.9.7 or later
    +

    This option forces the configured default OCSP responder to be used +during OCSP certificate validation, regardless of whether the +certificate being validated references an OCSP responder.

    +
    top

    SSLOptions Directive

    diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index 45f73ed924..4f4bd229fd 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -713,80 +713,83 @@ handshake SSLHonorCiperOrder flagsvEOption to prefer the server's cipher preference order SSLMutex type none sESemaphore for internal mutual exclusion of operations -SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLOCSDefaultResponder urisvESet the default responder URI for OCSP validation +SSLOCSPEnable flagsvEEnable OCSP validation of the client certificate chain +SSLOCSPOverrideResponder flagsvEForce use of the default responder URI for OCSP validation +SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLProtocol [+|-]protocol ... all svEConfigure usable SSL protocol versions -SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSLProtocol [+|-]protocol ... all svEConfigure usable SSL protocol versions +SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for +SSLProxyCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for +SSLProxyCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCipherSuite cipher-spec ALL:!ADH:RC4+RSA:+H +svdhECipher Suite available for negotiation in SSL +SSLProxyCipherSuite cipher-spec ALL:!ADH:RC4+RSA:+H +svdhECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateFile filenamesEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directorysEDirectory of PEM-encoded client certificates and keys to be used by the proxy -SSLProxyProtocol [+|-]protocol ... all svEConfigure usable SSL protocol flavors for proxy usage -SSLProxyVerify level none svdhEType of remote server Certificate verification -SSLProxyVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Remote Server +SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateFile filenamesEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyProtocol [+|-]protocol ... all svEConfigure usable SSL protocol flavors for proxy usage +SSLProxyVerify level none svdhEType of remote server Certificate verification +SSLProxyVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Remote Server Certificate verification -SSLRandomSeed context source -[bytes]sEPseudo Random Number Generator (PRNG) seeding +SSLRandomSeed context source +[bytes]sEPseudo Random Number Generator (PRNG) seeding source -SSLRequire expressiondhEAllow access only when an arbitrarily complex +SSLRequire expressiondhEAllow access only when an arbitrarily complex boolean expression is true -SSLRequireSSLdhEDeny access when SSL is not used for the +SSLRequireSSLdhEDeny access when SSL is not used for the HTTP request -SSLSessionCache type none sEType of the global/inter-process SSL Session +SSLSessionCache type none sEType of the global/inter-process SSL Session Cache -SSLSessionCacheTimeout seconds 300 svENumber of seconds before an SSL session expires +SSLSessionCacheTimeout seconds 300 svENumber of seconds before an SSL session expires in the Session Cache -SSLUserName varnamesdhEVariable name to determine user name -SSLVerifyClient level none svdhEType of Client Certificate verification -SSLVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Client +SSLUserName varnamesdhEVariable name to determine user name +SSLVerifyClient level none svdhEType of Client Certificate verification +SSLVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Client Certificate verification -StartServers numbersMNumber of child server processes created at startup -StartThreads numbersMNumber of threads created on startup -Substitute s/pattern/substitution/[inf]dhXPattern to filter the response content -SuexecUserGroup User GroupsvEUser and group permissions for CGI programs -ThreadLimit numbersMSets the upper limit on the configurable number of threads +StartServers numbersMNumber of child server processes created at startup +StartThreads numbersMNumber of threads created on startup +Substitute s/pattern/substitution/[inf]dhXPattern to filter the response content +SuexecUserGroup User GroupsvEUser and group permissions for CGI programs +ThreadLimit numbersMSets the upper limit on the configurable number of threads per child process -ThreadsPerChild numbersMNumber of threads created by each child process -ThreadStackSize sizesMThe size in bytes of the stack used by threads handling +ThreadsPerChild numbersMNumber of threads created by each child process +ThreadStackSize sizesMThe size in bytes of the stack used by threads handling client connections -TimeOut seconds 300 svCAmount of time the server will wait for +TimeOut seconds 300 svCAmount of time the server will wait for certain events before failing a request -TraceEnable [on|off|extended] on sCDetermines the behaviour on TRACE +TraceEnable [on|off|extended] on sCDetermines the behaviour on TRACE requests -TransferLog file|pipesvBSpecify location of a log file -TypesConfig file-path conf/mime.types sBThe location of the mime.types file -UnsetEnv env-variable [env-variable] -...svdhBRemoves variables from the environment -UseCanonicalName On|Off|DNS Off svdCConfigures how the server determines its own name and +TransferLog file|pipesvBSpecify location of a log file +TypesConfig file-path conf/mime.types sBThe location of the mime.types file +UnsetEnv env-variable [env-variable] +...svdhBRemoves variables from the environment +UseCanonicalName On|Off|DNS Off svdCConfigures how the server determines its own name and port -UseCanonicalPhysicalPort On|Off Off svdCConfigures how the server determines its own name and +UseCanonicalPhysicalPort On|Off Off svdCConfigures how the server determines its own name and port -User unix-userid #-1 sMThe userid under which the server will answer +User unix-userid #-1 sMThe userid under which the server will answer requests -UserDir directory-filenamesvBLocation of the user-specific directories -VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root +UserDir directory-filenamesvBLocation of the user-specific directories +VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host -VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root +VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host -<VirtualHost +<VirtualHost addr[:port] [addr[:port]] - ...> ... </VirtualHost>sCContains directives that apply only to a specific + ...> ... </VirtualHost>sCContains directives that apply only to a specific hostname or IP address -VirtualScriptAlias interpolated-directory|none none svEDynamically configure the location of the CGI directory for +VirtualScriptAlias interpolated-directory|none none svEDynamically configure the location of the CGI directory for a given virtual host -VirtualScriptAliasIP interpolated-directory|none none svEDynamically configure the location of the cgi directory for +VirtualScriptAliasIP interpolated-directory|none none svEDynamically configure the location of the cgi directory for a given virtual host -Win32DisableAcceptExsMUse accept() rather than AcceptEx() to accept network connections -XBitHack on|off|full off svdhBParse SSI directives in files with the execute bit +Win32DisableAcceptExsMUse accept() rather than AcceptEx() to accept network connections +XBitHack on|off|full off svdhBParse SSI directives in files with the execute bit set