From 483864045c36ca1e49834144f9ac9544f15ea999 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 8 May 2018 12:51:38 +0000 Subject: [PATCH] Transforms. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1831175 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_ssl.html.en | 24 +++++++++++++++++++----- docs/manual/mod/mod_ssl.xml.es | 2 +- docs/manual/mod/mod_ssl.xml.fr | 2 +- docs/manual/mod/mod_ssl.xml.meta | 2 +- docs/manual/mod/quickreference.html.en | 2 +- 5 files changed, 23 insertions(+), 9 deletions(-) diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 4c0ed33e42..2330fab9fc 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -611,15 +611,16 @@ confused in this situation.

top

SSLCertificateFile Directive

- - + + +
Description:Server PEM-encoded X.509 certificate data file
Syntax:SSLCertificateFile file-path
Description:Server PEM-encoded X.509 certificate data file or token identifier
Syntax:SSLCertificateFile file-path|certid
Context:server config, virtual host
Status:Extension
Module:mod_ssl
Compatibility:certid available in 2.5.1 and later.

-This directive points to a file with certificate data in PEM format. -At a minimum, the file must include an end-entity (leaf) certificate. +This directive points to a file with certificate data in PEM format, or the certificate identifier through a configured cryptographic token. +If using a PEM file, at minimum, the file must include an end-entity (leaf) certificate. The directive can be used multiple times (referencing different filenames) to support multiple algorithms for server authentication - typically RSA, DSA, and ECC. The number of supported algorithms depends on the @@ -660,6 +661,14 @@ after the certificates using a separate key file. If the private key is encrypted, the pass phrase dialog is forced at startup time.

+

As an alternative to storing certificates and private keys in +files, a certificate identifier can be used to identify a certificate +stored in a token. Currently, only PKCS#11 URIs are +recognized as certificate identifiers, and can be used in conjunction +with the OpenSSL pkcs11 engine configured with SSLCryptoDevice. If SSLCertificateKeyFile is omitted, the +certificate and private key can be loaded through the single +identifier specified with SSLCertificateFile.

+

DH parameter interoperability with primes > 1024 bit

@@ -703,7 +712,12 @@ thus using a custom/suitable length.

-

Example

SSLCertificateFile "/usr/local/apache2/conf/ssl.crt/server.crt"
+

Example

# Example using a PEM-encoded file.
+SSLCertificateFile "/usr/local/apache2/conf/ssl.crt/server.crt"
+# Example use of a certificate and private key from a PKCS#11 token:
+SSLCryptoDevice pkcs11
+...
+SSLCertificateFile "pkcs11:token=My%20Token%20Name;id=45"
diff --git a/docs/manual/mod/mod_ssl.xml.es b/docs/manual/mod/mod_ssl.xml.es index 44b5a8ee80..bf468120c0 100644 --- a/docs/manual/mod/mod_ssl.xml.es +++ b/docs/manual/mod/mod_ssl.xml.es @@ -1,7 +1,7 @@ - + + diff --git a/docs/manual/mod/mod_ssl.xml.meta b/docs/manual/mod/mod_ssl.xml.meta index d50eb9de39..194507ef07 100644 --- a/docs/manual/mod/mod_ssl.xml.meta +++ b/docs/manual/mod/mod_ssl.xml.meta @@ -9,6 +9,6 @@ en es - fr + fr diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index 5c1896bc36..712080adb1 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -1081,7 +1081,7 @@ Client Auth SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Client Auth SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates -SSLCertificateFile file-pathsvEServer PEM-encoded X.509 certificate data file +SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL handshake -- 2.40.0