From: Emeric Brun <ebrun@exceliance.fr>
Date: Fri, 28 Sep 2012 15:07:34 +0000 (+0200)
Subject: DOC: ssl: add 'verify', 'cafile' and 'crlfile' statements on 'bind'
X-Git-Tag: v1.5-dev13~249
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1a073b4650d423c24db42cfb0539c15dc5cf300a;p=thirdparty%2Fhaproxy.git

DOC: ssl: add 'verify', 'cafile' and 'crlfile' statements on 'bind'
---

diff --git a/doc/configuration.txt b/doc/configuration.txt
index ccbd40b3d7..afcd558515 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -6742,6 +6742,11 @@ ecdhe <named curve>
   the named curve (RFC 4492) used to generate ECDH ephemeral keys and makes
   ECDHE cipher suites usable.
 
+cafile <cafile>
+  This setting is only available when support for OpenSSL was built in. It
+  designates a PEM file from which to load CA certificates used to verify
+  client's certificate.
+
 ciphers <ciphers>
   This setting is only available when support for OpenSSL was built in. It sets
   the string describing the list of cipher algorithms ("cipher suite") that are
@@ -6749,6 +6754,11 @@ ciphers <ciphers>
   in "man 1 ciphers" from OpenSSL man pages, and can be for instance a string
   such as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes).
 
+crlfile <cafile>
+  This setting is only available when support for OpenSSL was built in. It
+  designates a PEM file from which to load certificate revocation list used
+  to verify client's certificate.
+
 crt <cert>
   This setting is only available when support for OpenSSL was built in.
   It designates a PEM file from which to load both a certificate and the
@@ -6919,6 +6929,15 @@ user <user>
   setting except that the user name is used instead of its uid. This setting is
   ignored by non UNIX sockets.
 
+verify [none|optional|required]
+  This setting is only available when support for OpenSSL was built in. If set
+  to 'none', client certificate is not requested. This is the default. In other
+  cases, a client certificate is requested. If the client does not provide a
+  certificate after the request and if 'verify' is set to 'required', then the
+  handshake is aborted, while it would have succeeded if set to 'optional'. The
+  certificate provided by the client is always verified using CAs from 'cafile'
+  and optional CRLs from 'crlfile'. On verify failure the handshake is aborted,
+  regardless of the 'verify' option.
 
 5.2. Server and default-server options
 ------------------------------------