From a344b93495641a9c7fd2ce8b854695f8e67210b7 Mon Sep 17 00:00:00 2001
From: Stefan Fritsch servername:portnumber
'', the second is either
- ``RSA
'' or ``DSA
''), which indicate for which
- server and algorithm it has to print the corresponding Pass Phrase to
- stdout
. The intent is that this external program first runs
- security checks to make sure that the system is not compromised by an
- attacker, and only when these checks were passed successfully it provides
- the Pass Phrase.
RSA
'', ``DSA
'', or ``ECC
''), which
+ indicate for which server and algorithm it has to print the corresponding
+ Pass Phrase to stdout
. The intent is that this external
+ program first runs security checks to make sure that the system is not
+ compromised by an attacker, and only when these checks were passed
+ successfully it provides the Pass Phrase.
Both these security checks, and the way the Pass Phrase is determined, can be as complex as you like. Mod_ssl just defines the interface: an @@ -803,8 +803,8 @@ This directive points to the PEM-encoded Certificate file for the server and optionally also to the corresponding RSA or DSA Private Key file for it (contained in the same file). If the contained Private Key is encrypted the Pass Phrase dialog is forced at startup time. This directive can be used up to -two times (referencing different filenames) when both a RSA and a DSA based -server certificate is used in parallel.
+three times (referencing different filenames) when both a RSA, a DSA, and an +ECC based server certificate is used in parallel.