From 049a185dd1bcd90a890b0ad6cd66ae91616e66d0 Mon Sep 17 00:00:00 2001 From: Kaspar Brand Date: Fri, 18 Nov 2011 17:38:53 +0000 Subject: [PATCH] update transformations git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1203762 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_ssl.html.en | 28 +++++++++----------------- docs/manual/mod/quickreference.html.en | 2 +- docs/manual/ssl/ssl_howto.html.en | 15 ++++++-------- docs/manual/upgrading.html.en | 3 ++- 4 files changed, 19 insertions(+), 29 deletions(-) diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 2e874f75d9..8550913ab0 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -130,7 +130,7 @@ compatibility variables.

Description: HTTPS flag HTTPS is being used. -SSL_PROTOCOL string The SSL protocol version (SSLv2, SSLv3, TLSv1) +SSL_PROTOCOL string The SSL protocol version (SSLv3, TLSv1) SSL_SESSION_ID string The hex-encoded SSL session id SSL_SESSION_RESUMED string Initial or Resumed SSL Session. Note: multiple requests may be served over the same (Initial or Resumed) SSL session if HTTP KeepAlive is in use SSL_SECURE_RENEG string true if secure renegotiation is supported, else false @@ -1184,7 +1184,7 @@ SSLPassPhraseDialog exec:/usr/local/apache/sbin/pp-filter
top

SSLProtocol Directive

- + @@ -1192,17 +1192,11 @@ SSLPassPhraseDialog exec:/usr/local/apache/sbin/pp-filter
Description:Configure usable SSL protocol versions
Description:Configure usable SSL/TLS protocol versions
Syntax:SSLProtocol [+|-]protocol ...
Default:SSLProtocol all
Context:server config, virtual host
Module:mod_ssl

-This directive can be used to control which versions of the SSL protocol +This directive can be used to control which versions of the SSL/TLS protocol will be accepted in new connections.

The available (case-insensitive) protocols are:

Example

-# enable SSLv3 and TLSv1, but not SSLv2
-SSLProtocol all -SSLv2 +SSLProtocol TLSv1

diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index b438bdb07c..3aae444174 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -886,7 +886,7 @@ handshake SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLProtocol [+|-]protocol ... all svEConfigure usable SSL protocol versions +SSLProtocol [+|-]protocol ... all svEConfigure usable SSL/TLS protocol versions SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for diff --git a/docs/manual/ssl/ssl_howto.html.en b/docs/manual/ssl/ssl_howto.html.en index bb3d2134f9..d625be2435 100644 --- a/docs/manual/ssl/ssl_howto.html.en +++ b/docs/manual/ssl/ssl_howto.html.en @@ -68,21 +68,18 @@ only?

The following enables only the strongest ciphers:

httpd.conf

- SSLProtocol all -SSLv2
- SSLCipherSuite HIGH:!aNULL:!EXP:!MD5:!NULL
+ SSLCipherSuite HIGH:!aNULL:!MD5

-

While with the following configuration you enable two ciphers - which are resonably secure, and fast:

+

While with the following configuration you specify a preference + for specific speed-optimized ciphers (which will be selected by + mod_ssl, provided that they are supported by the client):

httpd.conf

- SSLProtocol all -SSLv2
- SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!EXP:!MD5:!NULL
+ SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5
SSLHonorCipherOrder on

-

This strongly reflects the default value of SSLCipherSuite and is the recommanded way to configure it.

-

How can I create an SSL server which accepts all types of ciphers in general, but requires a strong ciphers for access to a particular @@ -101,7 +98,7 @@ URL?

<Location /strong/area>
# but https://hostname/strong/area/ and below
# requires strong ciphers
- SSLCipherSuite HIGH:!aNULL:!EXP:!MD5:!NULL
+ SSLCipherSuite HIGH:!aNULL:!MD5
</Location>

diff --git a/docs/manual/upgrading.html.en b/docs/manual/upgrading.html.en index f8ffc1769b..a66e632452 100644 --- a/docs/manual/upgrading.html.en +++ b/docs/manual/upgrading.html.en @@ -276,7 +276,8 @@
  • mod_ssl: The default format of the *_DN variables has changed. The old format can still be used with the new - LegacyDNStringFormat argument to SSLOptions.
    • + LegacyDNStringFormat argument to SSLOptions. The SSLv2 protocol is + no longer supported.
  • htpasswd now uses MD5 hash by default on all platforms.
    • -- 2.40.0