From 8a36a240a8c07c08116a30e4d9c564f5805bccff Mon Sep 17 00:00:00 2001 From: Mads Toftum Date: Mon, 5 Jan 2004 21:14:19 +0000 Subject: [PATCH] Correct SSLProxyMachineCertificatePath and SSLProxyMachineCertificateFile - the previous description looked like it was copied from SSLProxyCA* Also add a warning about not using encrypted keys in those two. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@102191 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_ssl.html.en | 26 ++++++++++++++---------- docs/manual/mod/mod_ssl.xml | 28 +++++++++++++++----------- docs/manual/mod/quickreference.html.en | 4 ++-- 3 files changed, 33 insertions(+), 25 deletions(-) diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 40a67961a8..e54f46ce78 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -952,7 +952,7 @@ SSLProxyEngine on
top

SSLProxyMachineCertificateFile Directive

- + @@ -960,26 +960,28 @@ SSLProxyEngine on
Description:File of concatenated PEM-encoded CA certificates for proxy server client certificates
Description:File of concatenated PEM-encoded client certificates and keys to be used by the proxy
Syntax:SSLProxyMachineCertificateFile filename
Context:server config
Override:Not applicable
Module:mod_ssl

-This directive sets the all-in-one file where you keep the certificates of -Certification Authorities (CAs) whose proxy client certificates are used for -authentication of the proxy server to remote servers. +This directive sets the all-in-one file where you keep the certificates and +keys used for authentication of the proxy server to remote servers.

This referenced file is simply the concatenation of the various PEM-encoded certificate files, in order of preference. Use this directive alternatively or additionally to SSLProxyMachineCertificatePath.

+
+

Currently there is no support for encrypted private keys

+

Example:

-SSLProxyMachineCertificateFile /usr/local/apache2/conf/ssl.crt/ -

+SSLProxyMachineCertificateFile /usr/local/apache2/conf/ssl.crt/proxy.pem +

top

SSLProxyMachineCertificatePath Directive

- + @@ -987,9 +989,8 @@ SSLProxyMachineCertificateFile /usr/local/apache2/conf/ssl.crt/
Description:Directory of PEM-encoded CA certificates for proxy server client certificates
Description:Directory of PEM-encoded client certificates and keys to be used by the proxy
Syntax:SSLProxyMachineCertificatePath directory
Context:server config
Override:Not applicable
Module:mod_ssl

-This directive sets the directory where you keep the certificates of -Certification Authorities (CAs) whose proxy client certificates are used for -authentication of the proxy server to remote servers. +This directive sets the directory where you keep the certificates and +keys used for authentication of the proxy server to remote servers.

The files in this directory must be PEM-encoded and are accessed through hash filenames. Additionally, you must create symbolic links named @@ -997,10 +998,13 @@ hash filenames. Additionally, you must create symbolic links named directory contains the appropriate symbolic links. Use the Makefile which comes with mod_ssl to accomplish this task.

+
+

Currently there is no support for encrypted private keys

+

Example:

-SSLProxyMachineCertificatePath /usr/local/apache2/conf/ssl.crt/ +SSLProxyMachineCertificatePath /usr/local/apache2/conf/proxy.crt/

diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index 1c039ca57d..d95f8abe79 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -1170,16 +1170,15 @@ SSL_VERSION_INTERFACE SSL_CLIENT_S_DN_OU SSL_SERVER_S_DN_OU SSLProxyMachineCertificatePath -Directory of PEM-encoded CA certificates for proxy server client certificates +Directory of PEM-encoded client certificates and keys to be used by the proxy SSLProxyMachineCertificatePath directory server config Not applicable

-This directive sets the directory where you keep the certificates of -Certification Authorities (CAs) whose proxy client certificates are used for -authentication of the proxy server to remote servers. +This directive sets the directory where you keep the certificates and +keys used for authentication of the proxy server to remote servers.

The files in this directory must be PEM-encoded and are accessed through hash filenames. Additionally, you must create symbolic links named @@ -1187,10 +1186,13 @@ hash filenames. Additionally, you must create symbolic links named directory contains the appropriate symbolic links. Use the Makefile which comes with mod_ssl to accomplish this task.

+ +

Currently there is no support for encrypted private keys

+

Example:

-SSLProxyMachineCertificatePath /usr/local/apache2/conf/ssl.crt/ +SSLProxyMachineCertificatePath /usr/local/apache2/conf/proxy.crt/ @@ -1198,28 +1200,30 @@ SSLProxyMachineCertificatePath /usr/local/apache2/conf/ssl.crt/ SSLProxyMachineCertificateFile -File of concatenated PEM-encoded CA certificates for proxy server client certificates +File of concatenated PEM-encoded client certificates and keys to be used by the proxy SSLProxyMachineCertificateFile filename server config Not applicable

-This directive sets the all-in-one file where you keep the certificates of -Certification Authorities (CAs) whose proxy client certificates are used for -authentication of the proxy server to remote servers. +This directive sets the all-in-one file where you keep the certificates and +keys used for authentication of the proxy server to remote servers.

This referenced file is simply the concatenation of the various PEM-encoded certificate files, in order of preference. Use this directive alternatively or additionally to SSLProxyMachineCertificatePath.

+ +

Currently there is no support for encrypted private keys

+

Example:

-SSLProxyMachineCertificateFile /usr/local/apache2/conf/ssl.crt/ - - +SSLProxyMachineCertificateFile /usr/local/apache2/conf/ssl.crt/proxy.pem + + diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index 5bd79f8a4e..9414c21808 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -642,8 +642,8 @@ Remote Server Auth SSLProxyCipherSuite cipher-spec ALL:!ADH:RC4+RSA:+H +svdhECipher Suite available for negotiation in SSL proxy handshake SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateFile filenamesEFile of concatenated PEM-encoded CA certificates for proxy server client certificates -SSLProxyMachineCertificatePath directorysEDirectory of PEM-encoded CA certificates for proxy server client certificates +SSLProxyMachineCertificateFile filenamesEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysEDirectory of PEM-encoded client certificates and keys to be used by the proxy SSLProxyProtocol [+|-]protocol ... all svEConfigure usable SSL protocol flavors for proxy usage SSLProxyVerify level none svdhEType of remote server Certificate verification SSLProxyVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Remote Server -- 2.50.1