From: Ruediger Pluem Date: Wed, 13 Nov 2019 13:27:27 +0000 (+0000) Subject: * Rebuild docs X-Git-Tag: 2.4.42~206 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0c2caad63d22b0fc438628360965d5a60f3ecff3;p=thirdparty%2Fapache%2Fhttpd.git * Rebuild docs git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1869739 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/man/httxt2dbm.1 b/docs/man/httxt2dbm.1 index 9d6fb99b8f9..2a06b0c9aec 100644 --- a/docs/man/httxt2dbm.1 +++ b/docs/man/httxt2dbm.1 @@ -19,7 +19,7 @@ .el .ne 3 .IP "\\$1" \\$2 .. -.TH "HTTXT2DBM" 1 "2018-07-06" "Apache HTTP Server" "httxt2dbm" +.TH "HTTXT2DBM" 1 "2019-11-13" "Apache HTTP Server" "httxt2dbm" .SH NAME httxt2dbm \- Generate dbm files for use with RewriteMap @@ -50,7 +50,7 @@ More verbose output Specify the DBM type to be used for the output\&. If not specified, will use the APR Default\&. Available types are: \fBGDBM\fR for GDBM files, \fBSDBM\fR for SDBM files, \fBDB\fR for berkeley DB files, \fBNDBM\fR for NDBM files, \fBdefault\fR for the default DBM type\&. .TP \fB-i \fISOURCE_TXT\fR\fR -Input file from which the dbm is to be created\&. The file should be formated with one record per line, of the form: \fBkey value\fR\&. See the documentation for RewriteMap for further details of this file's format and meaning\&. +Input file from which the dbm is to be created\&. The file should be formatted with one record per line, of the form: \fBkey value\fR\&. See the documentation for RewriteMap for further details of this file's format and meaning\&. .TP \fB-o \fIOUTPUT_DBM\fR\fR Name of the output dbm files\&. diff --git a/docs/manual/misc/security_tips.html.en b/docs/manual/misc/security_tips.html.en index 2e473d0877e..c8cb1ba03c6 100644 --- a/docs/manual/misc/security_tips.html.en +++ b/docs/manual/misc/security_tips.html.en @@ -132,7 +132,7 @@
  • The use of a threaded mpm may allow you to handle more simultaneous connections, thereby - mitigating DoS attacks. Further, the + mitigating DoS attacks. Further, the event mpm uses asynchronous processing to avoid devoting a thread to each connection. Due to the nature of the OpenSSL library the @@ -454,10 +454,10 @@ directive specific. Always test your changes when creating dependencies on how directives are merged.

    -

    For modules that don't implement any merging logic, such as - mod_access_compat, the behavior in later sections +

    For modules that don't implement any merging logic, such as + mod_access_compat, the behavior in later sections depends on whether the later section has any directives - from the module. The configuration is inherited until a change is made, + from the module. The configuration is inherited until a change is made, at which point the configuration is replaced and not merged.

    diff --git a/docs/manual/misc/security_tips.html.tr.utf8 b/docs/manual/misc/security_tips.html.tr.utf8 index 96f7f1cc868..2d6f32f32a0 100644 --- a/docs/manual/misc/security_tips.html.tr.utf8 +++ b/docs/manual/misc/security_tips.html.tr.utf8 @@ -28,6 +28,7 @@  ko  |  tr 

    +
    Bu çeviri güncel olmayabilir. Son değişiklikler için İngilizce sürüm geçerlidir.

    Bir HTTP Sunucusunu ayarlarken dikkat edilmesi gerekenler ve bazı ipuçları. Öneriler kısmen Apache’ye özel kısmen de genel olacaktır.

    diff --git a/docs/manual/mod/core.html.de b/docs/manual/mod/core.html.de index 210ce2d8606..f78eee9eafe 100644 --- a/docs/manual/mod/core.html.de +++ b/docs/manual/mod/core.html.de @@ -2875,14 +2875,14 @@ On Windows, from Apache 2.3.3 and later. - - + + +as if 'QualifyRedirectURL On' was configured.
    Beschreibung:Controls whether the REDIRECT_URL environment variable is fully qualified
    Syntax:QualifyRedirectURL ON|OFF
    Voreinstellung:QualifyRedirectURL OFF
    Syntax:QualifyRedirectURL On|Off
    Voreinstellung:QualifyRedirectURL Off
    Kontext:Serverkonfiguration, Virtual Host, Verzeichnis
    AllowOverride:FileInfo
    Status:Core
    Modul:core
    Kompatibilität:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

    Die Dokumentation zu dieser Direktive wurde noch nicht übersetzt. Bitte schauen Sie in die englische Version.

    diff --git a/docs/manual/mod/core.html.en b/docs/manual/mod/core.html.en index 4c0b2fd7446..d960ed9a3ce 100644 --- a/docs/manual/mod/core.html.en +++ b/docs/manual/mod/core.html.en @@ -4045,19 +4045,19 @@ On Windows, from Apache 2.3.3 and later. - - + + +as if 'QualifyRedirectURL On' was configured.
    Description:Controls whether the REDIRECT_URL environment variable is fully qualified
    Syntax:QualifyRedirectURL ON|OFF
    Default:QualifyRedirectURL OFF
    Syntax:QualifyRedirectURL On|Off
    Default:QualifyRedirectURL Off
    Context:server config, virtual host, directory
    Override:FileInfo
    Status:Core
    Module:core
    Compatibility:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

    This directive controls whether the server will ensure that the REDIRECT_URL environment variable is fully qualified. By default, the variable contains the verbatim URL requested by the client, - such as "/index.html". With QualifyRedirectURL ON, the same request would result in a + such as "/index.html". With QualifyRedirectURL On, the same request would result in a value such as "http://www.example.com/index.html".

    Even without this directive set, when a request is issued against a fully qualified URL, REDIRECT_URL will remain fully qualified. @@ -4301,8 +4301,8 @@ scripts so.

    -

    The option Registry-Strict which is new in Apache HTTP Server - 2.0 does the same thing as Registry but uses only the +

    The option Registry-Strict + does the same thing as Registry but uses only the subkey Shell\ExecCGI\Command. The ExecCGI key is not a common one. It must be configured manually in the windows registry and hence prevents @@ -4581,15 +4581,14 @@ is accessed by an incompatible browser actually produced a returned error message.

    The Off - setting, which is the default, suppresses the footer line (and is - therefore compatible with the behavior of Apache-1.2 and - below). The On setting simply adds a line with the + setting, which is the default, suppresses the footer line. + The On setting simply adds a line with the server version number and ServerName of the serving virtual host, and the EMail setting additionally creates a "mailto:" reference to the ServerAdmin of the referenced document.

    -

    After version 2.0.44, the details of the server version number +

    The details of the server version number presented are controlled by the ServerTokens directive.

    See also

    @@ -4649,7 +4648,7 @@ header

    This setting applies to the entire server, and cannot be enabled or disabled on a virtualhost-by-virtualhost basis.

    -

    After version 2.0.44, this directive also controls the +

    This directive also controls the information presented by the ServerSignature directive.

    Setting ServerTokens to less than diff --git a/docs/manual/mod/core.html.es b/docs/manual/mod/core.html.es index 6c816581867..8614e971f83 100644 --- a/docs/manual/mod/core.html.es +++ b/docs/manual/mod/core.html.es @@ -3519,14 +3519,14 @@ On Windows from Apache 2.3.3 and later. - - + + +as if 'QualifyRedirectURL On' was configured.
    Descripción:Controls whether the REDIRECT_URL environment variable is fully qualified
    Sintaxis:QualifyRedirectURL ON|OFF
    Valor por defecto:QualifyRedirectURL OFF
    Sintaxis:QualifyRedirectURL On|Off
    Valor por defecto:QualifyRedirectURL Off
    Contexto:server config, virtual host, directory
    Anula:FileInfo
    Estado:Core
    Módulo:core
    Compatibilidad:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

    The documentation for this directive has not been translated yet. Please have a look at the English version.

    diff --git a/docs/manual/mod/core.html.ja.utf8 b/docs/manual/mod/core.html.ja.utf8 index 28c5365eb45..2a87f36dff2 100644 --- a/docs/manual/mod/core.html.ja.utf8 +++ b/docs/manual/mod/core.html.ja.utf8 @@ -2816,14 +2816,14 @@ On Windows, from Apache 2.3.3 and later. - - + + +as if 'QualifyRedirectURL On' was configured.
    説明:Controls whether the REDIRECT_URL environment variable is fully qualified
    構文:QualifyRedirectURL ON|OFF
    デフォルト:QualifyRedirectURL OFF
    構文:QualifyRedirectURL On|Off
    デフォルト:QualifyRedirectURL Off
    コンテキスト:サーバ設定ファイル, バーチャルホスト, ディレクトリ
    上書き:FileInfo
    ステータス:Core
    モジュール:core
    互換性:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

    このディレクティブの解説文書は まだ翻訳されていません。英語版をご覧ください。

    diff --git a/docs/manual/mod/core.html.tr.utf8 b/docs/manual/mod/core.html.tr.utf8 index b56c804a375..685cb78dc1d 100644 --- a/docs/manual/mod/core.html.tr.utf8 +++ b/docs/manual/mod/core.html.tr.utf8 @@ -33,6 +33,7 @@  ja  |  tr 

    +
    Bu çeviri güncel olmayabilir. Son değişiklikler için İngilizce sürüm geçerlidir.
    Açıklama:Apache HTTP Sunucusunda daima mevcut olan çekirdek özellikler
    Durum:Çekirdek
    diff --git a/docs/manual/mod/directives.html.de b/docs/manual/mod/directives.html.de index 9a0ca1f9718..2c23b7920e9 100644 --- a/docs/manual/mod/directives.html.de +++ b/docs/manual/mod/directives.html.de @@ -422,6 +422,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -440,6 +441,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.en b/docs/manual/mod/directives.html.en index 0f11ae95366..12bc6b940b5 100644 --- a/docs/manual/mod/directives.html.en +++ b/docs/manual/mod/directives.html.en @@ -423,6 +423,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -441,6 +442,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.es b/docs/manual/mod/directives.html.es index fe3c657d5b9..40bf1a4a546 100644 --- a/docs/manual/mod/directives.html.es +++ b/docs/manual/mod/directives.html.es @@ -425,6 +425,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -443,6 +444,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.ja.utf8 b/docs/manual/mod/directives.html.ja.utf8 index 2329324dd45..e50e25ab7a3 100644 --- a/docs/manual/mod/directives.html.ja.utf8 +++ b/docs/manual/mod/directives.html.ja.utf8 @@ -420,6 +420,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -438,6 +439,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.ko.euc-kr b/docs/manual/mod/directives.html.ko.euc-kr index 4cee70afa27..7caab3b2828 100644 --- a/docs/manual/mod/directives.html.ko.euc-kr +++ b/docs/manual/mod/directives.html.ko.euc-kr @@ -420,6 +420,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -438,6 +439,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.tr.utf8 b/docs/manual/mod/directives.html.tr.utf8 index 7c8f26f8670..d7445a867a5 100644 --- a/docs/manual/mod/directives.html.tr.utf8 +++ b/docs/manual/mod/directives.html.tr.utf8 @@ -419,6 +419,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -437,6 +438,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.zh-cn.utf8 b/docs/manual/mod/directives.html.zh-cn.utf8 index b109e55db6b..5241ad16602 100644 --- a/docs/manual/mod/directives.html.zh-cn.utf8 +++ b/docs/manual/mod/directives.html.zh-cn.utf8 @@ -418,6 +418,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -436,6 +437,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/mod_auth_form.html.en b/docs/manual/mod/mod_auth_form.html.en index 8398c7c7a34..a94826f8e34 100644 --- a/docs/manual/mod/mod_auth_form.html.en +++ b/docs/manual/mod/mod_auth_form.html.en @@ -298,9 +298,9 @@ SessionCookieName session path=/

    Another option is to render the login form using a CGI script or other dynamic technology.

    -

    CGI example

            AuthFormProvider file
-        ErrorDocument 401 "/cgi-bin/login.cgi"
-        ...
    +

    CGI example

    AuthFormProvider file
+ErrorDocument 401 "/cgi-bin/login.cgi"
+...
    top
    @@ -379,14 +379,14 @@ lower level modules - +
    Description:The name of a form field carrying the body of the request to attempt on successful login
    Syntax:AuthFormBody fieldname
    Default:httpd_body
    Default:AuthFormBody httpd_body
    Context:directory
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormMethod directive specifies - the name of an HTML field which, if present, will contain the method of the request to +

    The AuthFormBody directive specifies + the name of an HTML field which, if present, will contain the body of the request to submit should login be successful.

    By populating the form with fields described by @@ -401,7 +401,7 @@ lower level modules

    AuthFormDisableNoStore Directive

    - + @@ -421,7 +421,7 @@ lower level modules

    AuthFormFakeBasicAuth Directive

    Description:Disable the CacheControl no-store header on the login page
    Syntax:AuthFormDisableNoStore On|Off
    Syntax:AuthFormDisableNoStore On|Off
    Default:AuthFormDisableNoStore Off
    Context:directory
    Status:Base
    - + @@ -441,7 +441,7 @@ lower level modules
    Description:Fake a Basic Authentication header
    Syntax:AuthFormFakeBasicAuth On|Off
    Syntax:AuthFormFakeBasicAuth On|Off
    Default:AuthFormFakeBasicAuth Off
    Context:directory
    Status:Base
    - + @@ -539,14 +539,14 @@ parser has been added in 2.4.4.
    Description:The name of a form field carrying a URL to redirect to on successful login
    Syntax:AuthFormLocation fieldname
    Default:httpd_location
    Default:AuthFormLocation httpd_location
    Context:directory
    Status:Base
    Module:mod_auth_form
    - +
    Description:The name of a form field carrying the method of the request to attempt on successful login
    Syntax:AuthFormMethod fieldname
    Default:httpd_method
    Default:AuthFormMethod httpd_method
    Context:directory
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later

    The AuthFormMethod directive specifies - the name of an HTML field which, if present, will contain the method of the request to + the name of an HTML field which, if present, will contain the method of the request to submit should login be successful.

    By populating the form with fields described by @@ -562,13 +562,13 @@ parser has been added in 2.4.4. - +
    Description:The name of a form field carrying the mimetype of the body of the request to attempt on successful login
    Syntax:AuthFormMimetype fieldname
    Default:httpd_mimetype
    Default:AuthFormMimetype httpd_mimetype
    Context:directory
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormMethod directive specifies +

    The AuthFormMimetype directive specifies the name of an HTML field which, if present, will contain the mimetype of the request to submit should login be successful.

    @@ -585,7 +585,7 @@ parser has been added in 2.4.4. - + @@ -667,7 +667,7 @@ parser has been added in 2.4.4.
    Description:The name of a form field carrying the login password
    Syntax:AuthFormPassword fieldname
    Default:httpd_password
    Default:AuthFormPassword httpd_password
    Context:directory
    Status:Base
    Module:mod_auth_form
    - + @@ -693,7 +693,7 @@ parser has been added in 2.4.4.
    Description:The largest size of the form in bytes that will be parsed for the login details
    Syntax:AuthFormSize size
    Default:8192
    Default:AuthFormSize 8192
    Context:directory
    Status:Base
    Module:mod_auth_form
    - + diff --git a/docs/manual/mod/mod_md.html.en b/docs/manual/mod/mod_md.html.en index 2a72eedb0b3..f5c138702de 100644 --- a/docs/manual/mod/mod_md.html.en +++ b/docs/manual/mod/mod_md.html.en @@ -32,7 +32,7 @@
    Description:The name of a form field carrying the login username
    Syntax:AuthFormUsername fieldname
    Default:httpd_username
    Default:AuthFormUsername httpd_username
    Context:directory
    Status:Base
    Module:mod_auth_form
    - +
    Description:Managing domains across virtual hosts, certificate provisioning via the ACME protocol
    Status:Extension
    Status:Experimental
    Module Identifier:md_module
    Source File:mod_md.c
    Compatibility:Available in version 2.4.30 and later
    @@ -40,27 +40,24 @@

    This module manages common properties of domains for one or more virtual hosts. - Its main feature is the use of the ACME protocol - (RFC 8555) - to automate certificate provisioning. Certificates will be renewed - by the module ahead of their expiration to account for disruption in internet - services. There are ways to monitor the status of all Managed Domains - and configurations that will run your own notification commands on renewal, - expiration and errors. -

    -

    - The default ACME Certificate Authority is + Its serves two main purposes: for one, supervise/renew https: certificates via the + ACME protocol (RFC 8555). + Certificates will be renewed by the module ahead of their expiration to account + for disruption in internet services. There are ways to monitor the status of all + certififcates managed this way and configurations that will run your own + notification commands on renewal, expiration and errors. +

    + Second, mod_md offers an alternate OCSP Stapling implementation. This works with + managed certificates as well as with certificates you configure yourself. OCSP + Stapling is a necessary component for any https: site, influencing page load + times and, depending on other setups, page availability. More in the + stapling section below. +

    + The default ACME Authority for managing certificates is Let's Encrypt, but it is possible to configure another CA that supports the protocol.

    -

    Warning

    -

    This module is experimental. Its behaviors, directives, and - defaults are subject to more change from release to - release relative to other standard modules. Users are encouraged to - consult the "CHANGES" file for potential updates.

    -
    -

    Simple configuration example:

    TLS in a VirtualHost context

    @@ -93,39 +90,59 @@ This module requires mod_watchdog to be loaded as well.

    Certificate sign-up and renewal with Let's Encrypt requires your server to be - reachable on port 80 (http:) from the outside. The alternative method over - port 443 (https:) is currently disabled for security reasons (status from - 2018-01-14). + reachable on port 80 (http:) and/or port 443 (https:) from the public internet. + (Unless your server is configured to use DNS for challenges - more on that under + 'wildcard certificates')

    - The module will select from the methods offered by Let's Encrypt. If LE decides - at one point in the future, to re-enable it again, mod_md will - use it when suitable. + The module will select from the methods offered by Let's Encrypt. Usually LE offers + challenges on both ports and DNS and Apache chooses a method available.

    - But for now, only the port 80 variant is available (termed "http-01"). Only - when LE can reach your server on port 80 will mod_md work for - you. For now, at least. + To determine which one is available, the module looks at the ports + Apache httpd listens on. If those include port 80, it assumes that the + http: challenge (named http-01) is available. If the server listens + on port 443, the https: challenge (named tls-alpn-01) is also added to + the list. (And if MDChallengeDns01 + is configured, the challenge dns-01 is added as well.)

    - If you do not want to offer any sites on port 80 any more, you may leave it open - and redirect all requests to your https: sites instead. Use the - MDRequireHttps described below to do - that in a convenient fashion. This will continue to answer http: challenges - from Let's Encrypt. + If your setup is not so straight forward, there are two methods available + to influence this. First, look at MDPortMap + if the server is behind a portmapper, such as a firewall. Second, you may + override the module's guesswork completely by configuring + MDCAChallenges directly.

    +

    https: Challenges

    +

    + For domain verification via the TLS protocol `tls-alpn-01` is the name + of the challenge type. It requires the Apache server to listen on port 443 + (see MDPortMap if you map that port + to something else). +

    + Let's Encrypt will open a TLS connection to Apache using the special indicator + `acme-tls/1` (this indication part of TLS is called ALPN, therefore the name + of the challenge. ALPN is also used by browsers to request a HTTP/2 connection). +

    + As with the HTTP/2 protocol, to allow this, you configure: +

    + 
    Protocols h2 http/1.1 acme-tls/1
    + +

    + And the `tls-alpn-01` challenge type is available. +

    +
    +

    Wildcard Certificates

    - Wildcard certificates are possible with version 2.x of `mod_md``. But they are - not straight-forward. Let's Encrypt requires the `dns-01` challenge verification + Wildcard certificates are possible, but not straight-forward to use out of + the box. Let's Encrypt requires the `dns-01` challenge verification for those. No other is considered good enough.

    - The difficulty here is that Apache cannot do that on its own. (which is also - a security benefit, since corrupting a web server or the communication path to - it is the scenario `dns-01` protects against). As the name implies, `dns-01` + The difficulty here is that Apache cannot do that on its own. As the name implies, `dns-01` requires you to show some specific DNS records for your domain that contain some challenge data. So you need to _write_ your domain's DNS records.

    - If you know how to do that, you can integrated this with `mod_md`. Let's + If you know how to do that, you can integrated this with mod_md. Let's say you have a script for that in `/usr/bin/acme-setup-dns` you configure Apache with:

    @@ -220,6 +237,52 @@

    +

    Stapling

    +

    + If you want to try the stapling in one Managed Domain alone at first, + configure: +

    + 
    <MDomain mydomain.net>
+  MDStapling on
+</MDomain>
    + +

    + and use the 'server-status' and/or MDMessageCmd to see how it operates. You will + see if Stapling information is there, how long it is valid, from where it came and + when it will be refreshed. +

    + If this all works to your satisfaction, you can switch it on for all your + certificates or just your managed ones. +

    + The existing stapling implementation by mod_ssl is used by many sites + for years. There are two main differences between the mod_ssl and mod_md + one: +

    +
      +
    1. On demand vs. scheduled: mod_ssl retrieves the stapling information + when it is requested, e.g. on a new connection. mod_md retrieves it + right at server start and after 2/3rds of its lifetime.
      2. +
    2. In memory vs. persisted: mod_ssl can persist this + information, but most example configurations use a memory cache. mod_md + always stores in the file system.
      3. +
    +

    + If you are unlucky and restart your server during an outage of your CA's + OCSP service, your users may no longer reach your sites. Without persistence + your server cannot provide the client with the data and the client browser + cannot get it as well, since the OCSP service is not responding. +

    + The implementation in mod_md will have peristed it, load it again after + restart and have it available for incoming connections. A day or two before + this information expires, it will renew it, making it able to copy with + a long OCSP service downtime. +

    + Due to backward compatibility, the existing implementation in mod_ssl could + not be changed drastically. For example, mod_ssl is unable to add a dependency + to mod_watchdog without braking many existing installations (that do not load it). +

    +
    +
    Support Apache!

    Directives

    @@ -261,7 +329,7 @@ Syntax:MDBaseServer on|off Default:MDBaseServer off Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -279,15 +347,28 @@ Syntax:MDCAChallenges name [ name ... ] Default:MDCAChallenges tls-alpn-01 http-01 dns-01 Context:server config -Status:Extension +Status:Experimental Module:mod_md

    - Sets challenge types and their execution order when proving domain ownership. - The names are protocol specific. - The current ACME protocol version implemented by Let's Encrypt defines three challenge - types that are supported by mod_md. By default, it will try - the one on port 443 when available. + Sets challenge types (in order of preference) when proving domain ownership. + Supported by the module are the challenge methods 'tls-alpn-01', 'dns-01' + and 'http-01'. The module will look at the overall configuation of the server + to find out which methods can be used. +

    + If the server listens on port 80, for example, the 'http-01' method is available. + The prerequisite for 'dns-01' is a configured 'MDChallengeDns01' command. + 'tls-alpn-01' is described above in 'https: Challenges'. +

    + This auto selection works for most setups. But since Apache is a very powerful + server with many configuration options, the situation is not clear for all + possible cases. For example: it may listen on multiple IP addresses where some + are reachable on `https:` and some not. +

    + If you configure 'MDCAChallenges' directly, this auto selection is disabled. + Instead, the module will use the configured challenge list when talking to + the ACME server (a challenge type must be offered by the server as well). + This challenges are examined in the order specified.

    @@ -298,7 +379,7 @@ Authority. Syntax:MDCertificateAgreement accepted Context:server config -Status:Extension +Status:Experimental Module:mod_md

    When you use mod_md to obtain a certificate, you become a customer of the CA (e.g. Let's Encrypt). That means you need to read and agree to their Terms of Service, @@ -314,7 +395,7 @@ Syntax:MDCertificateAuthority url Default:MDCertificateAuthority https://acme-v02.api.letsencrypt.org/directory Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -340,7 +421,7 @@ Description:Specify a static certificate file for the MD. Syntax:MDCertificateFile path-to-pem-file Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -384,7 +465,7 @@ Description:Specify a static private key for for the static cerrtificate. Syntax:MDCertificateKeyFile path-to-file Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -396,6 +477,33 @@ SSLCertificateKeyFile directive.

    + +
    top
    +

    MDCertificateMonitor Directive

    + + + + + + + +
    Description:The URL of a certificate log monitor.
    Syntax:MDCertificateMonitor name url
    Default:crt.sh https://crt.sh?q=
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + This is part of the 'server-status' HTML user interface and has nothing to + do with the core functioning itself. It defines the link offered on that + page for easy checking of a certificate monitor. The SHA256 fingerprint + of the certificate is appended to the configured url. +

    + Certificate Monitors offer supervision of Certificate Transparency (CT) + Logs to track the use of certificates for domains. The least you may see + is that Let's Encrypt (or whichever CA you have configured) has entered + your certificates into the CTLogs. +

    + Caveat: certificate logs update and monitor's intakes of those + updates suffer some delay. This varies between logs and monitors. A + brand new certificate will not be known immediately. +

    +
    top

    MDCertificateProtocol Directive

    @@ -404,7 +512,7 @@ Syntax:MDCertificateProtocol protocol Default:MDCertificateProtocol ACME Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -419,7 +527,7 @@ Syntax:MDCertificateStatus on|off Default:MDCertificateStatus on Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -444,7 +552,7 @@ Description: Syntax:MDChallengeDns01 path-to-command Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -468,7 +576,7 @@ Syntax:MDDriveMode always|auto|manual Default:MDDriveMode auto Context:server config -Status:Extension +Status:Experimental Module:mod_md

    This directive exists for backward compatibility as the old name for @@ -482,7 +590,7 @@ Description:Define a proxy for outgoing connections. Syntax:MDHttpProxy url Context:server config -Status:Extension +Status:Experimental Module:mod_md

    Use a http proxy to connect to the MDCertificateAuthority. Define this @@ -496,7 +604,7 @@ Description:Additional hostname for the managed domain. Syntax:MDMember hostname Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -524,7 +632,7 @@ Syntax:MDMembers auto|manual Default:MDMembers auto Context:server config -Status:Extension +Status:Experimental Module:mod_md

    Defines if the ServerName and @@ -539,12 +647,12 @@ Description:Handle events for Manage Domains Syntax:MDMessageCmd path-to-cmd optional-args Context:server config -Status:Extension +Status:Experimental Module:mod_md

    This command gets called when one of the following events happen for - a Managed Domain: "renewed", "expiring", "errored". The command may + a Managed Domain: "renewed", "installed", "expiring", "errored". The command may be invoked for more than these in the future and ignore events it is not prepared to handle.

    @@ -563,13 +671,25 @@ MDMessageCmd /etc/apache/md-message return code other than 0 is regarded as an error.

    'errored' is no immediate cause for concern since renewal is attempted - early enough to allow the internet to come back. + early enough to allow the internet to come back. This is reported at most + once per hour.

    'expiring' should be taken serious. It is issued when the MDWarnWindow is reached. By default this is 10% of the certificate lifetime, so for Let's Encrypt this currently means 9 days before it expires. The warning is repeated at most once a day. +

    + 'renewed' means that a new certificate has been obtained and is stored + in the 'staging' area in the MD store. It will be activated on the next + server restart/reload. +

    + 'installed' is triggered when a new certificate has been transferred from + staging into the domains location in MD store. This happens at server + startup/reload. Different to all other invocations, MDMessageCmd is run + with root permissions (on *nix systems) and has access to the certificate + files (and keys). Certificates needed for other applications or + in different formats can be processed on this event.

    @@ -580,7 +700,7 @@ MDMessageCmd /etc/apache/md-message Syntax:MDMustStaple on|off Default:MDMustStaple off Context:server config -Status:Extension +Status:Experimental Module:mod_md

    Defines if newly requested certificate should have the OCSP Must Staple flag @@ -597,7 +717,7 @@ MDMessageCmd /etc/apache/md-message Description:Run a program when a Managed Domain is ready. Syntax:MDNotifyCmd path [ args ] Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -614,7 +734,7 @@ MDMessageCmd /etc/apache/md-message Description:Define list of domain names that belong to one group. Syntax:MDomain dns-name [ other-dns-name... ] [auto|manual] Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -696,7 +816,7 @@ MDomain example2.org auto Description:Container for directives applied to the same managed domains. Syntax:<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet> Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -729,7 +849,7 @@ MDomain example2.org auto Syntax:MDPortMap map1 [ map2 ] Default:MDPortMap http:80 https:443 Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -772,7 +892,7 @@ MDomain example2.org auto Syntax:MDPrivateKeys type [ params... ] Default:MDPrivateKeys RSA 2048 Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -803,7 +923,7 @@ MDomain example2.org auto Syntax:MDRenewMode always|auto|manual Default:MDRenewMode auto Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -835,7 +955,7 @@ MDomain example2.org auto Syntax:MDRenewWindow duration Default:MDRenewWindow 33% Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -869,7 +989,7 @@ MDRenewWindow 10% Syntax:MDRequireHttps off|temporary|permanent Default:MDRequireHttps off Context:server config -Status:Extension +Status:Experimental Module:mod_md

    This is a convenience directive to ease http: to https: migration of @@ -925,7 +1045,7 @@ MDRenewWindow 10% Syntax:MDServerStatus on|off Default:MDServerStatus on Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -936,6 +1056,109 @@ MDRenewWindow 10% You can switch that off using this directive.

    + +
    top
    +

    MDStapleOthers Directive

    + + + + + + + +
    Description:Enable stapling for certificates not managed by mod_md.
    Syntax:MDStapleOthers on|off
    Default:on
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + This setting only takes effect when `MDStapling` is enabled. It controls + if `mod_md` should also provide stapling information for certificates + that are not directly controlled by it, e.g. renewed via an ACME CA. +

    + +
    +
    top
    +

    MDStapling Directive

    + + + + + + + +
    Description:Enable stapling for all or a particular MDomain.
    Syntax:MDStapling on|off
    Default:off
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + mod_md offers an implementation for providing OCSP stapling information. + This is an alternative to the one provided by 'mod_ssl'. For backward + compatiblity, this is disabled by default. +

    + The stapling can be switched on for all certificates on the server or + for an individual MDomain. This will replace any stapling configurtion + in `mod_ssl` for these hosts. When disabled, the 'mod_ssl' stapling + will do the work (if it is itself enabled, of course). This allows for + a gradual shift over from one implementation to the other. +

    + The stapling of `mod_md` will also work for domains where the certificates + are not managed by this module (see MDStapleOthers for how to control this). + This allows use of the new stapling without using any ACME certificate + management. +

    + +
    +
    top
    +

    MDStaplingKeepResponse Directive

    + + + + + + + +
    Description:Controls when old responses should be removed.
    Syntax:MDStaplingKeepResponse duration
    Default:7d
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + This time window specifies when OCSP response data used in stapling + shall be removed from the store again. Response information older than + 7 days (default) is deleted on server restart/reload. This keeps the store + from growing when certificates are renewed/reconfigured frequently. +

    +

    + +
    +
    top
    +

    MDStaplingRenewWindow Directive

    + + + + + + + +
    Description:Control when the stapling responses will be renewed.
    Syntax:MDStaplingRenewWindow duration
    Default:33%
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + If the validity of the OCSP response used in stapling falls below 'duration', + mod_md will obtain a new OCSP response. +

    + The CA issueing a certificate commonly also operates the OCSP responder + service and determines how long its signed response about the validity + of a certificate are itself valid. The longer a response is valid, the longer + it can be cached which mean better overall performance for everyone. + The shorter the life time, the more rapidly certificate revocations + spread to clients. Also, service reliability is a consideration. +

    + By adjusting the stapling renew window you can control parts of this yourself. + If you make the renew time short (e.g. a short time before the current + information expires), you gain maximum cache time. But a service outage + (down for maintenance, for example) will affect you. If you renew a long + time before expiry, updates will be made more frequent, cause more load + on the CA server infrastructure and also more coordination between + the child processes of your server. +

    + The default is chosen as 33%, which means renewal is started when only + a third of the response lifetime is left. For a CA that issues OCSP + responses with lifetime of 3 days, this means 2 days of caching and 1 day + for renewal attempts. A service outage would have to last full 24 hours + to affect your domains. +

    + Setting an absolute renew window, like `2d` (2 days), is also possible. +

    +
    top

    MDStoreDir Directive

    @@ -944,7 +1167,7 @@ MDRenewWindow 10% Syntax:MDStoreDir path Default:MDStoreDir md Context:server config -Status:Extension +Status:Experimental Module:mod_md

    @@ -966,7 +1189,7 @@ MDRenewWindow 10% Syntax:MDWarnWindow duration Default:MDWarnWindow 10% Context:server config -Status:Extension +Status:Experimental Module:mod_md

    diff --git a/docs/manual/mod/mod_proxy_uwsgi.html.en b/docs/manual/mod/mod_proxy_uwsgi.html.en index da510e4f8a6..06ea7411db9 100644 --- a/docs/manual/mod/mod_proxy_uwsgi.html.en +++ b/docs/manual/mod/mod_proxy_uwsgi.html.en @@ -26,7 +26,8 @@

    Apache Module mod_proxy_uwsgi

    -

    Available Languages:  en 

    +

    Available Languages:  en  | + fr 

    @@ -82,7 +83,8 @@
    -

    Available Languages:  en 

    +

    Available Languages:  en  | + fr 

    top

    Comments

    Notice:
    This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our mailing lists.
    Description:UWSGI gateway module for mod_proxy
    Status:Extension