From 42f014c49a3a5e4356c559d92dd763c64e3722b5 Mon Sep 17 00:00:00 2001 From: Jeff Trawick Date: Fri, 10 Oct 2014 00:19:08 +0000 Subject: [PATCH] xform git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1630626 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_ssl_ct.html.en | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/docs/manual/mod/mod_ssl_ct.html.en b/docs/manual/mod/mod_ssl_ct.html.en index 90416e88b1..838c3f0612 100644 --- a/docs/manual/mod/mod_ssl_ct.html.en +++ b/docs/manual/mod/mod_ssl_ct.html.en @@ -83,8 +83,8 @@ information does not have to also restart httpd to make it take effect.

This module is experimental for the following reasons: @@ -205,7 +205,10 @@ testing.

public key of the log
A proxy must have the public key of the log in order to check the - signature in SCTs it receives which were obtained from the log.
+ signature in SCTs it receives which were obtained from the log. +
+ A server must have the public key of the log in order to submit certificates + to it.
general trust/distrust setting
This is a mechanism to distrust or restore trust in a particular log, @@ -251,20 +254,21 @@ testing.

Experimental support for this is implemented in the ctauditscts - command (in the httpd source tree, not currently installed), which itself - relies on the verify_single_proof.py tool in the + command, which itself relies on the verify_single_proof.py tool in the certificate-transparency open source project. ctauditscts can parse data for off-line audit (enabled with the CTAuditStorage directive) and invoke verify_single_proof.py. - However, verify_single_proof.py is not complete currently and does - not provide a way to identify audit failures.

+

Here are rough notes for using ctauditscts:

    -
  • Set PYTHONPATH to include the src/python +
  • Create a virtualenv using the requirements.txt file + from the certificate-transparency project and run the following steps + with that virtualenv activated.
    • +
  • Set PYTHONPATH to include the python directory within the certificate-transparency tools.
    • -
  • Set PATH to include the src/python/ct/client/tools +
  • Set PATH to include the python/ct/client/tools directory.
  • Run ctauditscts, passing the value of the CTAuditStorage directive and, optionally, the path to @@ -273,7 +277,7 @@ testing.

The data saved for audit can also be used by other programs; refer to the - ctauditscts source code for details.

+ ctauditscts source code for details on processing the data.

top

CTAuditStorage Directive

@@ -312,7 +316,8 @@ testing.

Module:mod_ssl_ct

executable is the full path to the log client tool, which is - normally file src/client/ct within the source tree of the + normally file cpp/client/ct (or ct.exe) within the + source tree of the certificate-transparency open source project.

@@ -321,7 +326,7 @@ testing.

If this directive is not configured, server certificates cannot be submitted to logs in order to obtain SCTs; thus, only admin-managed - SCTs will be provided to clients.

+ SCTs or SCTs in certificate extensions will be provided to clients.

top
-- 2.40.0