Add support for MinTLS and MaxTLS options (Issue #5119)

[thirdparty/cups.git] / man / client.conf.man.in

diff --git a/man/client.conf.man.in b/man/client.conf.man.in
index 03fe5fa4c046adcd9432e2caa233b937196536c4..7bbc7d6560d0adf3c8f8b0b4ea2548ae1d728ef4 100644 (file)
--- a/man/client.conf.man.in
+++ b/man/client.conf.man.in
@@ -1,7 +1,7 @@
 .\"
 .\" client.conf man page for CUPS.
 .\"
-.\" Copyright 2007-2016 by Apple Inc.
+.\" Copyright 2007-2017 by Apple Inc.
 .\" Copyright 2006 by Easy Software Products.
 .\"
 .\" These coded instructions, statements, and computer programs are the
@@ -10,16 +10,16 @@
 .\" which should have been included with this file.  If this file is
 .\" file is missing or damaged, see the license at "http://www.cups.org/".
 .\"
-.TH client.conf 5 "CUPS" "18 May 2016" "Apple Inc."
+.TH client.conf 5 "CUPS" "3 November 2017" "Apple Inc."
 .SH NAME
 client.conf \- client configuration file for cups
 .SH DESCRIPTION
 The \fBclient.conf\fR file configures the CUPS client and is normally located in the \fI/etc/cups\fR and/or \fI~/.cups\fR directories.
 Each line in the file can be a configuration directive, a blank line, or a comment. Comment lines start with the # character.
 .LP
-\fBNote:\fR Starting with OS X 10.7, this file is only used by command-line and X11 applications plus the IPP backend.
-The \fBServerName\fR directive is not supported on OS X at all.
-Starting with OS X 10.TODO, all applications can access these settings in the \fI/Library/Preferences/org.cups.PrintingPrefs.plist\fR file instead.
+\fBNote:\fR Starting with macOS 10.7, this file is only used by command-line and X11 applications plus the IPP backend.
+The \fBServerName\fR directive is not supported on macOS at all.
+Starting with macOS 10.12, all applications can access these settings in the \fI/Library/Preferences/org.cups.PrintingPrefs.plist\fR file instead.
 See the NOTES section below for more information.
 .SS DIRECTIVES
 The following directives are understood by the client. Consult the online help for detailed descriptions:
@@ -51,20 +51,26 @@ CUPS adds the remote hostname ("name@server.example.com") for you. The default n
 .TP 5
 \fBServerName \fI/domain/socket\fR
 Specifies the address and optionally the port to use when connecting to the server.
-\fBNote: This directive it not supported on OS X 10.7 or later.\fR
+\fBNote: This directive is not supported on macOS 10.7 or later.\fR
 .TP 5
 \fBServerName \fIhostname-or-ip-address\fR[\fI:port\fR]\fB/version=1.1\fR
 Specifies the address and optionally the port to use when connecting to a server running CUPS 1.3.12 and earlier.
 .TP 5
-\fBSSLOptions \fR[\fIAllowDH\fR] [\fIAllowRC4\fR] [\fIAllowSSL3\fR] [\fIDenyTLS1.0\fR]
+\fBSSLOptions \fR[\fIAllowDH\fR] [\fIAllowRC4\fR] [\fIAllowSSL3\fR] [\fIDenyCBC\fR] [\fIDenyTLS1.0\fR] [\fIMaxTLS1.0\fR] [\fIMaxTLS1.1\fR] [\fIMaxTLS1.2\fR] [\fIMaxTLS1.3\fR] [\fIMinTLS1.0\fR] [\fIMinTLS1.1\fR] [\fIMinTLS1.2\fR] [\fIMinTLS1.3\fR]
 .TP 5
 \fBSSLOptions None\fR
 Sets encryption options (only in /etc/cups/client.conf).
 By default, CUPS only supports encryption using TLS v1.0 or higher using known secure cipher suites.
-The \fIAllowDH\fR option enables cipher suites using plain Diffie-Hellman key negotiation.
-The \fIAllowRC4\fR option enables the 128-bit RC4 cipher suites, which are required for some older clients that do not implement newer ones.
+Security is reduced when \fIAllow\fR options are used.
+Security is enhanced when \fIDeny\fR options are used.
+The \fIAllowDH\fR option enables cipher suites using plain Diffie-Hellman key negotiation (not supported on systems using GNU TLS).
+The \fIAllowRC4\fR option enables the 128-bit RC4 cipher suites, which are required for some older clients.
 The \fIAllowSSL3\fR option enables SSL v3.0, which is required for some older clients that do not support TLS v1.0.
+The \fIDenyCBC\fR option disables all CBC cipher suites.
 The \fIDenyTLS1.0\fR option disables TLS v1.0 support - this sets the minimum protocol version to TLS v1.1.
+The \fMinTLS\fR options set the minimum TLS version to support.
+The \fMaxTLS\fR options set the maximum TLS version to support.
+Not all operating systems support TLS 1.3 at this time.
 .TP 5
 \fBTrustOnFirstUse Yes\fR
 .TP 5
@@ -81,7 +87,7 @@ Specifies the default user name to use for requests.
 Specifies whether to only allow TLS with certificates whose common name matches the hostname.
 The default is "No".
 .SH NOTES
-The \fBclient.conf\fR file is deprecated on OS X and will no longer be supported in a future version of CUPS.
+The \fBclient.conf\fR file is deprecated on macOS and will no longer be supported in a future version of CUPS.
 Configuration settings can instead be viewed or changed using the
 .BR defaults (1)
 command:
@@ -97,4 +103,4 @@ On Linux and other systems using GNU TLS, the \fI/etc/cups/ssl/site.crl\fR file,
 .BR default (1),
 CUPS Online Help (http://localhost:631/help)
 .SH COPYRIGHT
-Copyright \[co] 2007-2016 by Apple Inc.
+Copyright \[co] 2007-2017 by Apple Inc.