From: Joe Orton Date: Tue, 8 May 2018 12:51:38 +0000 (+0000) Subject: Transforms. X-Git-Tag: 2.5.0-alpha2-ci-test-only~2617 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=483864045c36ca1e49834144f9ac9544f15ea999;p=thirdparty%2Fapache%2Fhttpd.git Transforms. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1831175 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 4c0ed33e420..2330fab9fc9 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -611,15 +611,16 @@ confused in this situation.

top

SSLCertificateFile Directive

- - + + +
Description:Server PEM-encoded X.509 certificate data file
Syntax:SSLCertificateFile file-path
Description:Server PEM-encoded X.509 certificate data file or token identifier
Syntax:SSLCertificateFile file-path|certid
Context:server config, virtual host
Status:Extension
Module:mod_ssl
Compatibility:certid available in 2.5.1 and later.

-This directive points to a file with certificate data in PEM format. -At a minimum, the file must include an end-entity (leaf) certificate. +This directive points to a file with certificate data in PEM format, or the certificate identifier through a configured cryptographic token. +If using a PEM file, at minimum, the file must include an end-entity (leaf) certificate. The directive can be used multiple times (referencing different filenames) to support multiple algorithms for server authentication - typically RSA, DSA, and ECC. The number of supported algorithms depends on the @@ -660,6 +661,14 @@ after the certificates using a separate key file. If the private key is encrypted, the pass phrase dialog is forced at startup time.

+

As an alternative to storing certificates and private keys in +files, a certificate identifier can be used to identify a certificate +stored in a token. Currently, only PKCS#11 URIs are +recognized as certificate identifiers, and can be used in conjunction +with the OpenSSL pkcs11 engine configured with SSLCryptoDevice. If SSLCertificateKeyFile is omitted, the +certificate and private key can be loaded through the single +identifier specified with SSLCertificateFile.

+

DH parameter interoperability with primes > 1024 bit

@@ -703,7 +712,12 @@ thus using a custom/suitable length.

-

Example

SSLCertificateFile "/usr/local/apache2/conf/ssl.crt/server.crt"
+

Example

# Example using a PEM-encoded file.
+SSLCertificateFile "/usr/local/apache2/conf/ssl.crt/server.crt"
+# Example use of a certificate and private key from a PKCS#11 token:
+SSLCryptoDevice pkcs11
+...
+SSLCertificateFile "pkcs11:token=My%20Token%20Name;id=45"
diff --git a/docs/manual/mod/mod_ssl.xml.es b/docs/manual/mod/mod_ssl.xml.es index 44b5a8ee809..bf468120c0a 100644 --- a/docs/manual/mod/mod_ssl.xml.es +++ b/docs/manual/mod/mod_ssl.xml.es @@ -1,7 +1,7 @@ - + + diff --git a/docs/manual/mod/mod_ssl.xml.meta b/docs/manual/mod/mod_ssl.xml.meta index d50eb9de390..194507ef078 100644 --- a/docs/manual/mod/mod_ssl.xml.meta +++ b/docs/manual/mod/mod_ssl.xml.meta @@ -9,6 +9,6 @@ en es - fr + fr diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index 5c1896bc36e..712080adb1f 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -1081,7 +1081,7 @@ Client Auth SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Client Auth SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates -SSLCertificateFile file-pathsvEServer PEM-encoded X.509 certificate data file +SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL handshake