ITS#9071 Document "tls none" for back-ldap

diff --git a/doc/man/man5/slapd-ldap.5 b/doc/man/man5/slapd-ldap.5
index 947dbdb041fa4d9a9ba141c1749f5615b5616762..755263d101a7e5ae4c5f04c1792bdba2118751ae 100644 (file)
--- a/doc/man/man5/slapd-ldap.5
+++ b/doc/man/man5/slapd-ldap.5
@@ -575,7 +575,7 @@ is used.
 
 .HP
 .hy 0
-.B tls {[try\-]start|[try\-]propagate|ldaps}
+.B tls {none|[try\-]start|[try\-]propagate|ldaps}
 .B [starttls=no]
 .B [tls_cert=<file>]
 .B [tls_key=<file>]
@@ -585,12 +585,13 @@ is used.
 .B [tls_cipher_suite=<ciphers>]
 .B [tls_crlcheck=none|peer|all]
 .RS
-Specify the use of TLS when a regular connection is initialized. The
-StartTLS extended operation will be used unless the URI directive protocol
-scheme is \fBldaps://\fP. In that case this keyword may only be
-set to "ldaps" and the StartTLS operation will not be used.
-\fBpropagate\fP issues the StartTLS operation only if the original
-connection did.
+Specify TLS settings for regular connections.
+
+The first parameter only applies to \fBldap://\fP connections and so
+at the moment, \fBnone\fP and \fBldaps\fP are equivalent.
+
+With \fBpropagate\fP, the proxy issues StartTLS operation only if
+the original connection has a TLS layer set up.
 The \fBtry\-\fP prefix instructs the proxy to continue operations
 if the StartTLS operation failed; its use is \fBnot\fP recommended.