From: Christophe Jaillet SNI Virtual Hosts yes yes Client Certificates yes no
-Machine Certificates for Backend yes yes
+OCSP Stapling yes yes* *)via mod_md OCSP Stapling yes yes* *)via Backend OCSP check yes no* *)stapling will be verified TLS version to allow min-max min
@@ -191,7 +191,8 @@ TLSCipherSuppress ECDHE-ECDSA-AES256-SHA384
the client not provide an SNI, the first configured
virtual host will be selected. If the client does provide
an SNI (as all today's clients do), it must match one
- virtual host (TLS ciphers exclusive list preferred/suppressed ServerName
or ServerAlias
)
+ virtual host (
@@ -251,7 +252,7 @@ MDomain example.net
- Via the directive
- This is set on a global level, not in individual `VirtualHost`s.
- It will affect all `VirtualHost` that match the specified address/port.
- You can use `TLSEngine` several times to use more than one address/port.
+ This is set on a global level, not in individual
- TLSOptions is analog to `SSLOptions` in TLSOptions
, several variables
+ Via the directive
@@ -460,7 +464,7 @@ TLSCiphersSuppress ECDHE-ECDSA-CHACHA20-POLY1305
Therefore most variables are not set by default.
- You can configure `TLSOptions` per location or generally on a
+ You can configure
- `TLSProxyEngine on|off` is analog to `SSLProxyEngine` in
- This can be used in a server/virtual host or `<Proxy>` section to
+ This can be used in a server/virtual host or
This uses a cache on the server side to allow clients to resume connections.
- You can set this to `none` or define a cache as in the `SSLSessionCache`
+ You can set this to `none` or define a cache as in the
If not configured, `mod_tls` will try to create a shared memory cache on its own,