From 7e96d1ca877c94dc0d8f5c6cdf9d02c332adbff8 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 3 Jun 2004 15:43:09 +0000 Subject: [PATCH] Update transformations. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103839 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/directives.html.en | 2 + docs/manual/mod/mod_ssl.html.en | 66 ++++++++++++++++++++------ docs/manual/mod/quickreference.html.en | 4 +- 3 files changed, 57 insertions(+), 15 deletions(-) diff --git a/docs/manual/mod/directives.html.en b/docs/manual/mod/directives.html.en index 9309b86dda..9db0425d06 100644 --- a/docs/manual/mod/directives.html.en +++ b/docs/manual/mod/directives.html.en @@ -353,7 +353,9 @@
  • SSLCertificateFile
  • SSLCertificateKeyFile
  • SSLCipherSuite
    • +
  • SSLCryptoDevice
  • SSLEngine
    • +
  • SSLHonorCipherOrder
  • SSLMutex
  • SSLOptions
  • SSLPassPhraseDialog
    • diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 881af738ef..8ec5f52f77 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -50,7 +50,9 @@ to provide the cryptography engine.

  • SSLCertificateFile
  • SSLCertificateKeyFile
  • SSLCipherSuite
    • +
  • SSLCryptoDevice
  • SSLEngine
    • +
  • SSLHonorCipherOrder
  • SSLMutex
  • SSLOptions
  • SSLPassPhraseDialog
    • @@ -156,9 +158,7 @@ you find in the above table.

    For backward compatibility there is additionally a special ``%{name}c'' cryptography format function provided. Information about this function is provided in the Compatibility chapter.

    -

    -Example:

    -

    +

    Example

    CustomLog logs/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

    @@ -501,6 +501,33 @@ SSLCipherSuite RSA:!EXP:!NULL:+HIGH:+MEDIUM:-LOW EXP-ADH-RC4-MD5 SSLv3 DH(512) None RC4(40) MD5 export +
    +
    top
    +

    SSLCryptoDevice Directive

    + + + + + + + + +
    Description:Enable use of a cryptographic hardware accelerator
    Syntax:SSLCryptoDevice engine
    Default:SSLCryptoDevice builtin
    Context:server config
    Status:Extension
    Module:mod_ssl
    Compatibility:Available if mod_ssl is built using -DSSL_ENGINE_EXPERIMENTAL
    +

    +This directive enables use of a cryptographic hardware accelerator +board to offload some of the SSL processing overhead. This directive +can only be used if the SSL toolkit is built with "engine" support; +OpenSSL 0.9.7 and later releases have "engine" support by default, the +separate "-engine" releases of OpenSSL 0.9.6 must be used.

    + +

    To discover which engine names are supported, run the command +"openssl engine".

    + +

    Example

    +# For a Broadcom accelerator:
    +SSLCryptoDevice ubsec +

    +
    top

    SSLEngine Directive

    @@ -524,6 +551,24 @@ SSLEngine on
    </VirtualHost>

    + +
    top
    +

    SSLHonorCipherOrder Directive

    + + + + + + + +
    Description:Option to prefer the server's cipher preference order
    Syntax:SSLHonorCiperOrder flag
    Context:server config, virtual host
    Status:Extension
    Module:mod_ssl
    Compatibility:Available in Apache 2.1 and later, if using OpenSSL 0.9.7 or later
    +

    When choosing a cipher during an SSLv3 or TLSv1 handshake, normally +the client's preference is used. If this directive is enabled, the +server's preference will be used instead.

    +

    Example

    +SSLHonorCipherOrder on +

    +
    top

    SSLMutex Directive

    @@ -768,9 +813,7 @@ query can be done in two ways which can be configured by The reuse-algorithm above is used here, too. In other words: The external program is called only once per unique Pass Phrase.

    -

    -Example:

    -

    +

    Example

    SSLPassPhraseDialog exec:/usr/local/apache/sbin/pp-filter

    @@ -983,9 +1026,7 @@ or additionally to SSLProxyMachineCertificatePath.

    Currently there is no support for encrypted private keys

    -

    -Example:

    -

    +

    Example

    SSLProxyMachineCertificateFile /usr/local/apache2/conf/ssl.crt/proxy.pem

    @@ -1013,9 +1054,7 @@ comes with mod_ssl to accomplish this task.

    Currently there is no support for encrypted private keys

    -

    -Example:

    -

    +

    Example

    SSLProxyMachineCertificatePath /usr/local/apache2/conf/proxy.crt/

    @@ -1449,11 +1488,10 @@ SSLSessionCacheTimeout 600 Compatibility:Available in Apache 2.1 and later

    - This directive sets the "user" field in the Apache request object. This is used by lower modules to identify the user with a character string. In particular, this may cause the environment variable -REMOTE_USER to be set. The varname can be +REMOTE_USER to be set. The varname can be any of the SSL environment variables.

    Example

    SSLUserName SSL_CLIENT_S_DN_CN diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index 38f1290980..ae2f43b52f 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -635,7 +635,9 @@ Client Auth SSLCertificateKeyFile file-pathsvEServer PEM-encoded Private Key file SSLCipherSuite cipher-spec ALL:!ADH:RC4+RSA:+H +svdhECipher Suite available for negotiation in SSL handshake -SSLEngine on|off off svESSL Engine Operation Switch +SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator +SSLEngine on|off off svESSL Engine Operation Switch +SSLHonorCiperOrder flagsvEOption to prefer the server's cipher preference order SSLMutex type none sESemaphore for internal mutual exclusion of operations SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -- 2.50.1