From eaccca5df3292848d70d47dbd7480092f8bc0b62 Mon Sep 17 00:00:00 2001 From: Jim Jagielski Date: Fri, 8 Jul 2005 15:17:28 +0000 Subject: [PATCH] Fold in latest SSL doc changes git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209811 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_ssl.html.en | 8 ++++++++ docs/manual/mod/mod_ssl.xml | 7 +++++++ docs/manual/ssl/ssl_faq.html.en | 18 ++++++++++++++++++ 3 files changed, 33 insertions(+) diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 6e9f64b995..a3c81554d8 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -108,6 +108,7 @@ compatibility variables.

SSL_CIPHER_EXPORT string true if cipher is an export cipher SSL_CIPHER_USEKEYSIZE number Number of cipher bits (actually used) SSL_CIPHER_ALGKEYSIZE number Number of cipher bits (possible) +SSL_COMPRESS_METHOD string SSL compression method negotiated SSL_VERSION_INTERFACE string The mod_ssl program version SSL_VERSION_LIBRARY string The OpenSSL program version SSL_CLIENT_M_VERSION string The version of the client certificate @@ -1531,6 +1532,13 @@ The following four storage types are currently supported:

using certain browsers, particularly if client certificates are enabled. This setting is not recommended.

+
  • internal + +

    This disables any global/inter-process Session Cache. However + it does allow OpenSSL to use its own internal session cache. This in + mainly useful in situations where a global cache cannot be used + but the client requires a non-null session ID.

    • +
  • dbm:/path/to/datafile

    This makes use of a DBM hashfile on the local disk to diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index cf1de480e5..c93e5b1918 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -412,6 +412,13 @@ The following four storage types are currently supported:

    using certain browsers, particularly if client certificates are enabled. This setting is not recommended.

    • +
  • internal + +

    This disables any global/inter-process Session Cache. However + it does allow OpenSSL to use its own internal session cache. This in + mainly useful in situations where a global cache cannot be used + but the client requires a non-null session ID.

    • +
  • dbm:/path/to/datafile

    This makes use of a DBM hashfile on the local disk to diff --git a/docs/manual/ssl/ssl_faq.html.en b/docs/manual/ssl/ssl_faq.html.en index d87803023b..b58b57bc19 100644 --- a/docs/manual/ssl/ssl_faq.html.en +++ b/docs/manual/ssl/ssl_faq.html.en @@ -671,6 +671,7 @@ browsers complain that they cannot verify the server certificate?

  • HTTPS and name-based vhosts
  • Why is it not possible to use Name-Based Virtual Hosting to identify different SSL virtual hosts?
    • +
  • How do I get SSL compression working?
  • The lock icon in Netscape locks very late
  • Why do I get I/O errors with MSIE clients?
  • Why do I get I/O errors with NS clients?
    • @@ -795,6 +796,23 @@ Virtual Hosting to identify different SSL virtual hosts? Use different port numbers for different SSL hosts.

    +

    How do I get SSL compression working?

    +

    Although SSL compression negotiation was already defined in the specification +of SSLv2 and TLS, it took until May 2004 when RFC 3749 defined DEFLATE as +a negotiable standard compression method. +

    +

    OpenSSL 0.9.8 started to support this by default when compiled with the +zlib option. If both the client and the server support compression, +it will be used. However, most clients still try to initially connect with an +SSLv2 Hello. As SSLv2 did not include an array of prefered compression algorithms +in its handshake, compression can not be negotiated with these clients. +If the client disables support for SSLv2, based on the used SSL library +a SSLv3 or TLS Hello might be sent and compression might be set up. +You can verify if clients make use of SSL compression by logging the +%{SSL_COMPRESS_METHOD}x variable. +

    + +

    When I use Basic Authentication over HTTPS the lock icon in Netscape browsers still shows the unlocked state when the dialog pops up. Does this mean the username/password is still transmitted unencrypted?

    -- 2.40.0