From: Joe Orton <jorton@apache.org>
Date: Tue, 4 Jan 2022 08:38:32 +0000 (+0000)
Subject: Recommend against using SSLOpenSSLConfCmd in preference to mod_ssl
X-Git-Tag: 2.5.0-alpha2-ci-test-only~602
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=238789798392c44f24304ade592e1a6a83f287f2;p=thirdparty%2Fapache%2Fhttpd.git

Recommend against using SSLOpenSSLConfCmd in preference to mod_ssl
directives, and add warning on stability/compatibility.

(e.g. PR: 65764)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1896664 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml
index 8168c1738e7..e196e6e2fd8 100644
--- a/docs/manual/mod/mod_ssl.xml
+++ b/docs/manual/mod/mod_ssl.xml
@@ -2946,13 +2946,6 @@ depends on the OpenSSL version being used for <module>mod_ssl</module>
 names, see the section <em>Supported configuration file commands</em> in the
 <a href="http://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_cmd.html#SUPPORTED-CONFIGURATION-FILE-COMMANDS">SSL_CONF_cmd(3)</a> manual page for OpenSSL.</p>
 
-<p>Some of the <directive>SSLOpenSSLConfCmd</directive> commands can be used
-as an alternative to existing directives (such as
-<directive module="mod_ssl">SSLCipherSuite</directive> or
-<directive module="mod_ssl">SSLProtocol</directive>),
-though it should be noted that the syntax / allowable values for the parameters
-may sometimes differ.</p>
-
 <example><title>Examples</title>
 <highlight language="config">
 SSLOpenSSLConfCmd Options -SessionTicket,ServerPreference
@@ -2962,6 +2955,23 @@ SSLOpenSSLConfCmd Protocol "-ALL, TLSv1.2"
 SSLOpenSSLConfCmd SignatureAlgorithms RSA+SHA384:ECDSA+SHA256
 </highlight>
 </example>
+
+<note type="warning"><title>Compatibility and Stability
+warning</title>
+
+<p>Some of the <directive>SSLOpenSSLConfCmd</directive> commands can be used
+as an alternative to existing directives (such as
+<directive module="mod_ssl">SSLCipherSuite</directive> or
+<directive module="mod_ssl">SSLProtocol</directive>),
+though the syntax / allowable values for the parameters may sometimes differ.</p>
+
+<p>It is recommended that directives provided by mod_ssl are used
+where available to configure OpenSSL, and
+<directive>SSLOpenSSLConfCmd</directive> is only used for features of
+OpenSSL which are not configurable by mod_ssl.  It is possible that
+mod_ssl behaviour will change across versions of httpd where
+<directive>SSLOpenSSLConfCmd</directive> is used.</p>
+</note>
 </usage>
 </directivesynopsis>