From e0c52dabd078761317add953781fa80d600bb58b Mon Sep 17 00:00:00 2001
From: Luca Toscano
This directive defines a set of SSL* configurations under
and gives it a name. This name can be used in the directives
-SSLPolicyUse
and SSLProxyPolicy
+SSLPolicy
and SSLProxyPolicy
to apply this configuration set in the current context.
<SSLPolicy safe-stapling> +Define and Use of a Policy
<SSLPolicy safe-stapling> SSLUseStapling on SSLStaplingResponderTimeout 2 SSLStaplingReturnResponderErrors off @@ -1489,14 +1489,14 @@ compatible and securely with current browsers. by running the following command. This list shows you the detailed configurations each policy is made of: -Examples
> httpd -t -D DUMP_SSL_POLICIES+List all Defined Policies
> httpd -t -D DUMP_SSL_POLICIESThe directive can only be used in the server config (global context), so there cannot be two policies with the same name. However, policies can be redefined:
-Examples
<SSLPolicy proxy-trust> +Policy Overwrite
<SSLPolicy proxy-trust> SSLProxyVerify require </SSLPolicy> ... @@ -1506,15 +1506,15 @@ be redefined:Policy definitions are added in the order they appear, but are -applied when the whole configuration is read. This means that any +applied when the whole configuration has been read. This means that any use of 'proxy-trust' will mean 'SSLProxyVerify none'. The first definition -has no effect at all. You can replace policy definitions that have been -pre-installed without the need to disable them.
+has no effect at all. That allows pre-installed policies to be replaced +without the need to disable them.Additional to replacing policies, redefinitions may just alter an aspect of a policy:
-Examples
<SSLPolicy proxy-trust> +Policy Redefine
<SSLPolicy proxy-trust> SSLProxyVerify require </SSLPolicy> ... @@ -1527,11 +1527,11 @@ an aspect of a policy:This re-uses all settings from the previous 'proxy-trust' and adds one directive on top of it. All others still apply. This is very handy when pre-defined policies (from Apache itself or a distributor) -that almost fit ones needs. Previously, such definitions were +that almost what you need. Previously, such definitions were (copied and) edited. This made updating them difficult. Now they can be setup like this:
-Examples
Include ssl-policies.conf +-Tweak a Pre-Defined Policy
Include ssl-policies.conf <SSLPolicy modern> SSLPolicy modern @@ -1542,7 +1542,7 @@ be setup like this:SSLPolicyUse Directive
+SSLPolicy Directive
-
Description: Apply a SSLPolicy by name @@ -1557,7 +1557,7 @@ settings in the current context. That means that any other SSL* directives you make in the same context remain effective. So, the effective Syntax: SSLPolicy name
SSLProtocol
value in the following settings are: -Examples
<VirtualHost...> # effective: 'all' +Policy Precedence
<VirtualHost...> # effective: 'all' SSLPolicy modern SSLProtocol all </VirtualHost> @@ -1581,7 +1581,7 @@ you make in the same context remain effective. So, the effectiveThere can be more than one policy applied in a context. The later ones overshadowing the earlier ones:
-Examples
<VirtualHost...> # effective: 'intermediate > modern' +Policy Ordering
<VirtualHost...> # effective: 'intermediate > modern' SSLPolicy modern SSLPolicy intermediate </VirtualHost> @@ -2009,11 +2009,11 @@ directory contains the appropriate symbolic links.Module: mod_ssl Compatibility: Available in httpd 2.4.28 and later This directive is similar to
SSLPolicyUse
, but +This directive is similar to
-SSLPolicy
, but applies only the SSLProxy* directives defined in the policy. This helps when you need different policies for front and backends:Examples
SSLPolicy modern +diff --git a/docs/manual/mod/mod_ssl.xml.fr b/docs/manual/mod/mod_ssl.xml.fr index e0ea4fd9e3..e4da18c356 100644 --- a/docs/manual/mod/mod_ssl.xml.fr +++ b/docs/manual/mod/mod_ssl.xml.fr @@ -1,7 +1,7 @@ - +Another Policies for Proxy Only
SSLPolicy modern SSLProxyPolicy intermediate