From: Kaspar Brand Date: Sat, 28 Dec 2013 13:28:05 +0000 (+0000) Subject: update transformation X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=350d47e643d857949670003cd97da464dec4f0fc;p=thirdparty%2Fapache%2Fhttpd.git update transformation git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1553825 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 63703b7927e..6df4cdd1d92 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -529,6 +529,14 @@ SSLCARevocationPath /usr/local/apache2/conf/ssl.crl/ Status:Extension Module:mod_ssl +

SSLCertificateChainFile is deprecated

+

SSLCertificateChainFile became obsolete with version +2.5.0-dev as of 2013-12-28, when +SSLCertificateFile +was extended to also load intermediate CA certificates from the server +certificate file.

+
+

This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the @@ -561,25 +569,44 @@ SSLCertificateChainFile /usr/local/apache2/conf/ssl.crt/ca.crt

top

SSLCertificateFile Directive

- +
Description:Server PEM-encoded X.509 Certificate file
Description:Server PEM-encoded X.509 certificate data file
Syntax:SSLCertificateFile file-path
Context:server config, virtual host
Status:Extension
Module:mod_ssl

-This directive points to the file with the PEM-encoded certificate, -optionally also the corresponding private key, and - beginning with -version 2.5.0-dev as of 2013-09-29 - DH parameters and/or an EC curve name -for ephemeral keys (as generated by openssl dhparam -and openssl ecparam, respectively). If the private key -is encrypted, the pass phrase dialog is forced at startup time. +This directive points to a file with certificate data in PEM format. +At a minimum, the file must include an end-entity (leaf) certificate. +Beginning with version 2.5.0-dev as of 2013-12-28, it may also +include intermediate CA certificates, sorted from leaf to root, +and obsoletes SSLCertificateChainFile.

+ +

+Additional optional elements are DH parameters and/or an EC curve name +for ephemeral keys, as generated by openssl dhparam and +openssl ecparam, respectively (supported in version 2.5.0-dev +as of 2013-09-29), and finally, the end-entity certificate's private key. +If the private key is encrypted, the pass phrase dialog is forced +at startup time.

+

-This directive can be used up to three times (referencing different filenames) -when both an RSA, a DSA, and an ECC based server certificate is used in -parallel. Note that DH and ECDH parameters are only read from the first -SSLCertificateFile directive.

+This directive can be used multiple times (referencing different filenames) +to support multiple algorithms for server authentication - typically +RSA, DSA, and ECC. The number of supported algorithms depends on the +OpenSSL version being used for mod_ssl: with version 1.0.0 or later, +openssl list-public-key-algorithms will output a list +of supported algorithms.

+ +

+When running with OpenSSL 1.0.2 or later, this directive allows +to configure the intermediate CA chain on a per-certificate basis, +which removes a limitation of the (now obsolete) +SSLCertificateChainFile directive. +DH and ECDH parameters, however, are only read from the first +SSLCertificateFile directive, as they +are applied independently of the authentication algorithm type.

DH parameter interoperability with primes > 1024 bit

@@ -604,25 +631,26 @@ SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt
top

SSLCertificateKeyFile Directive

- +
Description:Server PEM-encoded Private Key file
Description:Server PEM-encoded private key file
Syntax:SSLCertificateKeyFile file-path
Context:server config, virtual host
Status:Extension
Module:mod_ssl

-This directive points to the PEM-encoded Private Key file for the -server. If the Private Key is not combined with the Certificate in the -SSLCertificateFile, use this additional directive to -point to the file with the stand-alone Private Key. When -SSLCertificateFile is used and the file -contains both the Certificate and the Private Key this directive need -not be used. But we strongly discourage this practice. Instead we -recommend you to separate the Certificate and the Private Key. If the -contained Private Key is encrypted, the Pass Phrase dialog is forced -at startup time. This directive can be used up to three times -(referencing different filenames) when both a RSA, a DSA, and an ECC based -private key is used in parallel.

+This directive points to the PEM-encoded private key file for the +server (the private key may also be combined with the certificate in the +SSLCertificateFile, but this practice +is discouraged). If the contained private key is encrypted, the pass phrase +dialog is forced at startup time.

+ +

+The directive can be used multiple times (referencing different filenames) +to support multiple algorithms for server authentication. For each +SSLCertificateKeyFile +directive, there must be a matching SSLCertificateFile +directive.

+

Example

 SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key