From: Yann Ylavic When you When you
-If httpd was built against APR version 1.3.0
-or higher, then whenever a query is made to the database server, all
+Whenever a query is made to the database server, all
column values in the first row returned by the query are placed in the
environment, using environment variables with the prefix "AUTHENTICATE_".
mod_http2 uses the library of nghttp2
as its implementation base. In order to build mod_http2 you need at least version 1.2.1 of
libnghttp2 installed on your system../configure you Apache httpd source tree, you need to give it
+ ./configure your Apache httpd source tree, you need to give it
'--enable-http2' as additional argument to trigger the build of the module.
Should your libnghttp2 reside in an unusual place (whatever that is on your
operating system), you may announce its location with '--with-nghttp2=<path>'
diff --git a/docs/manual/mod/directives.html.de b/docs/manual/mod/directives.html.de
index 2f8e00fad0f..ff780233ed8 100644
--- a/docs/manual/mod/directives.html.de
+++ b/docs/manual/mod/directives.html.de
@@ -485,6 +485,8 @@
Exposing Login Information ¶
mod_authn_dbd.
If httpd was built against APR version 1.3.0 - or higher, any additional column values in the first row returned by +
Any additional column values in the first row returned by
the query statement will be stored as environment variables with
names of the form AUTHENTICATE_COLUMN.
mod_authn_dbd.
- If httpd was built against APR version 1.3.0 - or higher, any additional column values in the first row returned by +
Any additional column values in the first row returned by
the query statement will be stored as environment variables with
names of the form AUTHENTICATE_COLUMN.
Require dbd-group team -AuthzDBDQuery "SELECT group FROM authz WHERE user = %s"+AuthzDBDQuery "SELECT user_group FROM authz WHERE user = %s" diff --git a/docs/manual/mod/mod_log_config.html.en.utf8 b/docs/manual/mod/mod_log_config.html.en.utf8 index c4c1e03b129..54bac425d85 100644 --- a/docs/manual/mod/mod_log_config.html.en.utf8 +++ b/docs/manual/mod/mod_log_config.html.en.utf8 @@ -171,8 +171,7 @@
%{format}Ppid, tid,
- and hextid. hextid requires APR 1.2.0 or
- higher.
+ and hextid.
%q? if a query
diff --git a/docs/manual/mod/mod_md.html.en.utf8 b/docs/manual/mod/mod_md.html.en.utf8
index a3dd2470b37..1f177e63513 100644
--- a/docs/manual/mod/mod_md.html.en.utf8
+++ b/docs/manual/mod/mod_md.html.en.utf8
@@ -283,6 +283,43 @@
+ + Since version 2.4.14 of the module, you can use it to get certificates + for your tailscale domains. +
+<MDomain mydomain.some-thing.ts.net> + MDCertificateProtocol tailscale + MDCertificateAuthority file://localhost/var/run/tailscale/tailscaled.sock", +</MDomain>+ +
+ Tailscale provides secure networking between your machines, where ever + they are, and can provide domain names in the *.ts.net space for them. + For those, it will then provide Let's Encrypt certificates as well, so + you can open these domains in your browser securely. +
++ The directives listed above tell Apache to contact the local tailscale + demon for obtaining and renewing certificates. This will only work for + the domain name that tailscale assigns to your machine. +
++ Otherwise, these certificates work exactly like the ones retrieved + via the ACME protocol from Lets Encrypt. You see them in status reporting + and MDMessageCmd directives are executed for them as well. +
++ More details are + available at the mod_md github documentation. +
++ Note that this feature only works on machines where the tailscale + demon provides a unix domain socket. This, so far, seems only the + case on *nix systems. +
+
MDRenewMode
MDRenewWindow
MDRequireHttps
MDRetryDelay
MDRetryFailover
MDServerStatus
MDStapleOthers
MDStapling| Description: | The URL of the ACME Certificate Authority service. |
|---|---|
| Description: | The URL(s) of the ACME Certificate Authority to use. |
| Syntax: | MDCertificateAuthority url |
| Default: | MDCertificateAuthority https://acme-v02.api.letsencrypt.org/directory |
| Default: | MDCertificateAuthority letsencrypt |
| Context: | server config |
| Status: | Experimental |
| Module: | mod_md |
- The URL where the CA offers its service. + The URL(s) where the CA offers its service. + Instead of the actual URL, you may use 'letsencrypt' or 'buypass'.
- Let's Encrypt offers, right now, four such URLs. Two for
- the own legacy version of the ACME protocol, commonly named ACMEv1.
- And two for the RFC 8555 version, named ACMEv2.
+ If you configure more than one URL, each one is tried in a round-robin
+ fashion after a number of failures. You can configure how quickly or
+ delayed that happens via the MDRetryDelay and
+ MDRetryFailover directives. The default setting
+ makes a failover after about half a day of trying.
- Each version has 2 endpoints, as their is a production endpoint and a
- "staging" endpoint for testing. The testing endpoint works the same, but will
- not give you certificates recognized by browsers. However, it also has
- very relaxed rate limits. This allows testing of the service repeatedly
- without you blocking yourself.
+ All other settings apply to each of these URLs. It is therefore
+ not possible to have two with different
+ MDExternalAccountBindings, for example.
+
+ For testing, CAs commonly offer a second service URL. + The 'test' service does not give certificates valid in a browser, + but are more relaxed in regard to rate limits. + This allows for verfication of your own setup before switching + to the production service URL.
-MDCertificateAuthority https://acme-staging-v02.api.letsencrypt.org/directory+
MDCertificateAuthority https://acme-staging-v02.api.letsencrypt.org/directory
| Description: | |
|---|---|
| Syntax: | MDRetryDelay duration |
| Default: | MDRetryDelay 5s |
| Context: | server config |
| Status: | Experimental |
| Module: | mod_md |
| Compatibility: | Available in version 2.4.54 and later |
+ The amount of time to wait after an error before trying + to renew a certificate again. This duration is doubled after + each consecutive error with a maximum of 24 hours. +
++ It is kept separate for each certificate renewal. Meaning an error + on one MDomain does not delay the renewals of other domains. +
+ +| Description: | |
|---|---|
| Syntax: | MDRetryFailover number |
| Default: | MDRetryFailover 13 |
| Context: | server config |
| Status: | Experimental |
| Module: | mod_md |
| Compatibility: | Available in version 2.4.54 and later |
+ The number of consecutive errors on renewing a certificate before
+ another CA is selected. This only applies to configurations that
+ have more than one MDCertificateAuthority
+ specified.
+
The optional interpolate keyword, in combination with +
The optional interpolate keyword, in combination with
ProxyPassInterpolateEnv, causes the ProxyPass
to interpolate environment variables, using the syntax
${VARNAME}. Note that many of the standard CGI-derived
@@ -1688,7 +1688,7 @@ ProxyPassReverse "/mirror/foo/" "https://backend.example.com/"
This directive, together with the interpolate argument to +
This directive, together with the interpolate argument to
ProxyPass, ProxyPassReverse,
ProxyPassReverseCookieDomain, and
ProxyPassReverseCookiePath,
@@ -1701,7 +1701,7 @@ ProxyPassReverse "/mirror/foo/" "https://backend.example.com/"
ProxyPassReverseCookiePath directives
and causes them to substitute the value of an environment
variable varname for the string ${varname}
- in configuration directives if the interpolate option is set.
interpolate option is set.
The scheme/hostname/port portion of ProxyPass may
contain variables, but only the ones available when the directive is parsed
(for example, using Define).
@@ -1788,7 +1788,7 @@ ProxyPassReverse "/mirror/foo/" "https://backend.example.com/"
ProxyPassReverse [path] url
-[interpolate]RewriteRule ... [P]) from mod_rewrite
because it doesn't depend on a corresponding ProxyPass directive.
- The optional interpolate keyword, used together with
- ProxyPassInterpolateEnv, enables interpolation
+
The optional interpolate keyword, used together with
+ ProxyPassInterpolateEnv, enables interpolation
of environment variables specified using the format ${VARNAME}.
Note that interpolation is not supported within the scheme portion of a
URL.
ProxyPassReverseCookieDomain internal-domain
-public-domain [interpolate]Set-Cookie headers.
ProxyPassReverseCookiePath internal-path
-public-path [interpolate]When enabled, this option will pass the Host: line from the incoming +
When enabled, this option will pass the Host: line from the incoming
request to the proxied host, instead of the hostname specified in the
ProxyPass line.
$N in the substitution string!
If an absolute URL is specified,
mod_rewrite checks to see whether the
hostname matches the current host. If it does, the scheme and
hostname are stripped out and the resulting path is treated as
a URL-path. Otherwise, an external redirect is performed for
the given URL. To force an external redirect back to the
- current host, see the [R] flag below.
[R] flag below.
+ Note that a redirect (implicit or not) using an absolute URI
+ will include the requested query-string, to prevent this see the
+ [QSD] flag below.
- (dash)$N in the substitution string!
| Description: | Ce module fournit un moteur de réécriture à base de règles permettant de réécrire les URLs des requêtes à la volée | |||||
|---|---|---|---|---|---|---|
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | X | |||
| Type of ACME challenge used to prove domain ownership. | ||||||
| MDCertificateAgreement accepted | s | X | ||||
| You confirm that you accepted the Terms of Service of the Certificate Authority. | ||||||
| MDCertificateAuthority url | https://acme-v02.ap + | s | X | |||
| The URL of the ACME Certificate Authority service. | ||||||
| MDCertificateAuthority url | letsencrypt | s | X | |||
| The URL(s) of the ACME Certificate Authority to use. | ||||||
| MDCertificateCheck name url | s | X | ||||
| - | ||||||
| MDCertificateFile path-to-pem-file | s | X | ||||
| Specify a static certificate file for the MD. | ||||||
| MDCertificateKeyFile path-to-file | s | X | ||||
| Specify a static private key for for the static cerrtificate. | ||||||
| MDRenewMode always|auto|manual | auto | s | X | |||
| Controls if certificates shall be renewed. | ||||||
| MDRenewWindow duration | 33% | s | X | |||
| Control when a certificate will be renewed. | ||||||
| MDRequireHttps off|temporary|permanent | off | s | X | |||
| Redirects http: traffic to https: for Managed Domains. | ||||||
| MDRetryDelay duration | 5s | s | X | |||
| - | ||||||
| MDRetryFailover number | 13 | s | X | |||
| - | ||||||
| MDServerStatus on|off | on | s | X | |||
| Control if Managed Domain information is added to server-status. | ||||||
| MDStapleOthers on|off | on | s | X | |||
| Enable stapling for certificates not managed by mod_md. | ||||||
| MDStapling on|off | off | s | X | |||
| Enable stapling for all or a particular MDomain. | ||||||
| ProxyPassMatch [regex] !|url [key=value [key=value ...]] | svd | E | ||||
| Maps remote servers into the local server URL-space using regular expressions | ||||||
| ProxyPassReverse [path] url -[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse +[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse proxied server | ||||||
| ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- +public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPassReverseCookiePath internal-path -public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- +public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPreserveHost On|Off | Off | svd | E | |||
| Use incoming Host HTTP request header for proxy request | ||||||
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | X | |||
| Type of ACME challenge used to prove domain ownership. | ||||||
| MDCertificateAgreement accepted | s | X | ||||
| You confirm that you accepted the Terms of Service of the Certificate Authority. | ||||||
| MDCertificateAuthority url | https://acme-v02.ap + | s | X | |||
| The URL of the ACME Certificate Authority service. | ||||||
| MDCertificateAuthority url | letsencrypt | s | X | |||
| The URL(s) of the ACME Certificate Authority to use. | ||||||
| MDCertificateCheck name url | s | X | ||||
| - | ||||||
| MDCertificateFile path-to-pem-file | s | X | ||||
| Specify a static certificate file for the MD. | ||||||
| MDCertificateKeyFile path-to-file | s | X | ||||
| Specify a static private key for for the static cerrtificate. | ||||||
| MDRenewMode always|auto|manual | auto | s | X | |||
| Controls if certificates shall be renewed. | ||||||
| MDRenewWindow duration | 33% | s | X | |||
| Control when a certificate will be renewed. | ||||||
| MDRequireHttps off|temporary|permanent | off | s | X | |||
| Redirects http: traffic to https: for Managed Domains. | ||||||
| MDRetryDelay duration | 5s | s | X | |||
| - | ||||||
| MDRetryFailover number | 13 | s | X | |||
| - | ||||||
| MDServerStatus on|off | on | s | X | |||
| Control if Managed Domain information is added to server-status. | ||||||
| MDStapleOthers on|off | on | s | X | |||
| Enable stapling for certificates not managed by mod_md. | ||||||
| MDStapling on|off | off | s | X | |||
| Enable stapling for all or a particular MDomain. | ||||||
| ProxyPassMatch [regex] !|url [key=value [key=value ...]] | svd | E | ||||
| Maps remote servers into the local server URL-space using regular expressions | ||||||
| ProxyPassReverse [path] url -[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse +[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse proxied server | ||||||
| ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- +public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPassReverseCookiePath internal-path -public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- +public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPreserveHost On|Off | Off | svd | E | |||
| Use incoming Host HTTP request header for proxy request | ||||||
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | X | |||
| Type of ACME challenge used to prove domain ownership. | ||||||
| MDCertificateAgreement accepted | s | X | ||||
| You confirm that you accepted the Terms of Service of the Certificate Authority. | ||||||
| MDCertificateAuthority url | https://acme-v02.ap + | s | X | |||
| The URL of the ACME Certificate Authority service. | ||||||
| MDCertificateAuthority url | letsencrypt | s | X | |||
| The URL(s) of the ACME Certificate Authority to use. | ||||||
| MDCertificateCheck name url | s | X | ||||
| - | ||||||
| MDCertificateFile path-to-pem-file | s | X | ||||
| Specify a static certificate file for the MD. | ||||||
| MDCertificateKeyFile path-to-file | s | X | ||||
| Specify a static private key for for the static cerrtificate. | ||||||
| MDRenewMode always|auto|manual | auto | s | X | |||
| Controls if certificates shall be renewed. | ||||||
| MDRenewWindow duration | 33% | s | X | |||
| Control when a certificate will be renewed. | ||||||
| MDRequireHttps off|temporary|permanent | off | s | X | |||
| Redirects http: traffic to https: for Managed Domains. | ||||||
| MDRetryDelay duration | 5s | s | X | |||
| - | ||||||
| MDRetryFailover number | 13 | s | X | |||
| - | ||||||
| MDServerStatus on|off | on | s | X | |||
| Control if Managed Domain information is added to server-status. | ||||||
| MDStapleOthers on|off | on | s | X | |||
| Enable stapling for certificates not managed by mod_md. | ||||||
| MDStapling on|off | off | s | X | |||
| Enable stapling for all or a particular MDomain. | ||||||
| ProxyPassMatch [regex] !|url [key=value [key=value ...]] | svd | E | ||||
| Maps remote servers into the local server URL-space using regular expressions | ||||||
| ProxyPassReverse [path] url -[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse +[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse proxied server | ||||||
| ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- +public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPassReverseCookiePath internal-path -public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- +public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPreserveHost On|Off | Off | svd | E | |||
| Use incoming Host HTTP request header for proxy request | ||||||
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | X | |||
| Type of ACME challenge used to prove domain ownership. | ||||||
| MDCertificateAgreement accepted | s | X | ||||
| You confirm that you accepted the Terms of Service of the Certificate Authority. | ||||||
| MDCertificateAuthority url | https://acme-v02.ap + | s | X | |||
| The URL of the ACME Certificate Authority service. | ||||||
| MDCertificateAuthority url | letsencrypt | s | X | |||
| The URL(s) of the ACME Certificate Authority to use. | ||||||
| MDCertificateCheck name url | s | X | ||||
| - | ||||||
| MDCertificateFile path-to-pem-file | s | X | ||||
| Specify a static certificate file for the MD. | ||||||
| MDCertificateKeyFile path-to-file | s | X | ||||
| Specify a static private key for for the static cerrtificate. | ||||||
| MDRenewMode always|auto|manual | auto | s | X | |||
| Controls if certificates shall be renewed. | ||||||
| MDRenewWindow duration | 33% | s | X | |||
| Control when a certificate will be renewed. | ||||||
| MDRequireHttps off|temporary|permanent | off | s | X | |||
| Redirects http: traffic to https: for Managed Domains. | ||||||
| MDRetryDelay duration | 5s | s | X | |||
| - | ||||||
| MDRetryFailover number | 13 | s | X | |||
| - | ||||||
| MDServerStatus on|off | on | s | X | |||
| Control if Managed Domain information is added to server-status. | ||||||
| MDStapleOthers on|off | on | s | X | |||
| Enable stapling for certificates not managed by mod_md. | ||||||
| MDStapling on|off | off | s | X | |||
| Enable stapling for all or a particular MDomain. | ||||||
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | X | |||
| Type of ACME challenge used to prove domain ownership. | ||||||
| MDCertificateAgreement accepted | s | X | ||||
| You confirm that you accepted the Terms of Service of the Certificate Authority. | ||||||
| MDCertificateAuthority url | https://acme-v02.ap + | s | X | |||
| The URL of the ACME Certificate Authority service. | ||||||
| MDCertificateAuthority url | letsencrypt | s | X | |||
| The URL(s) of the ACME Certificate Authority to use. | ||||||
| MDCertificateCheck name url | s | X | ||||
| - | ||||||
| MDCertificateFile path-to-pem-file | s | X | ||||
| Specify a static certificate file for the MD. | ||||||
| MDCertificateKeyFile path-to-file | s | X | ||||
| Specify a static private key for for the static cerrtificate. | ||||||
| MDRenewMode always|auto|manual | auto | s | X | |||
| Controls if certificates shall be renewed. | ||||||
| MDRenewWindow duration | 33% | s | X | |||
| Control when a certificate will be renewed. | ||||||
| MDRequireHttps off|temporary|permanent | off | s | X | |||
| Redirects http: traffic to https: for Managed Domains. | ||||||
| MDRetryDelay duration | 5s | s | X | |||
| - | ||||||
| MDRetryFailover number | 13 | s | X | |||
| - | ||||||
| MDServerStatus on|off | on | s | X | |||
| Control if Managed Domain information is added to server-status. | ||||||
| MDStapleOthers on|off | on | s | X | |||
| Enable stapling for certificates not managed by mod_md. | ||||||
| MDStapling on|off | off | s | X | |||
| Enable stapling for all or a particular MDomain. | ||||||
| ProxyPassMatch [regex] !|url [key=value [key=value ...]] | svd | E | ||||
| Maps remote servers into the local server URL-space using regular expressions | ||||||
| ProxyPassReverse [path] url -[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse +[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse proxied server | ||||||
| ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- +public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPassReverseCookiePath internal-path -public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- +public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPreserveHost On|Off | Off | svd | E | |||
| Use incoming Host HTTP request header for proxy request | ||||||
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | D | |||
| Type of ACME challenge used to prove domain ownership. | ||||||
| MDCertificateAgreement accepted | s | D | ||||
| You confirm that you accepted the Terms of Service of the Certificate Authority. | ||||||
| MDCertificateAuthority url | https://acme-v02.ap + | s | D | |||
| The URL of the ACME Certificate Authority service. | ||||||
| MDCertificateAuthority url | letsencrypt | s | D | |||
| The URL(s) of the ACME Certificate Authority to use. | ||||||
| MDCertificateCheck name url | s | D | ||||
| - | ||||||
| MDCertificateFile path-to-pem-file | s | D | ||||
| Specify a static certificate file for the MD. | ||||||
| MDCertificateKeyFile path-to-file | s | D | ||||
| Specify a static private key for for the static cerrtificate. | ||||||
| MDRenewMode always|auto|manual | auto | s | D | |||
| Controls if certificates shall be renewed. | ||||||
| MDRenewWindow duration | 33% | s | D | |||
| Control when a certificate will be renewed. | ||||||
| MDRequireHttps off|temporary|permanent | off | s | D | |||
| Redirects http: traffic to https: for Managed Domains. | ||||||
| MDRetryDelay duration | 5s | s | D | |||
| - | ||||||
| MDRetryFailover number | 13 | s | D | |||
| - | ||||||
| MDServerStatus on|off | on | s | D | |||
| Control if Managed Domain information is added to server-status. | ||||||
| MDStapleOthers on|off | on | s | D | |||
| Enable stapling for certificates not managed by mod_md. | ||||||
| MDStapling on|off | off | s | D | |||
| Enable stapling for all or a particular MDomain. | ||||||
| ProxyPassMatch [regex] !|url [key=value [key=value ...]] | skd | E | ||||
| Maps remote servers into the local server URL-space using regular expressions | ||||||
| ProxyPassReverse [path] url -[interpolate] | skd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse +[interpolate] | skd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse proxied server | ||||||
| ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate] | skd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- +public-domain [interpolate] | skd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPassReverseCookiePath internal-path -public-path [interpolate] | skd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- +public-path [interpolate] | skd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPreserveHost On|Off | Off | skd | E | |||
| Use incoming Host HTTP request header for proxy request | ||||||
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | X | |||
| Type of ACME challenge used to prove domain ownership. | ||||||
| MDCertificateAgreement accepted | s | X | ||||
| You confirm that you accepted the Terms of Service of the Certificate Authority. | ||||||
| MDCertificateAuthority url | https://acme-v02.ap + | s | X | |||
| The URL of the ACME Certificate Authority service. | ||||||
| MDCertificateAuthority url | letsencrypt | s | X | |||
| The URL(s) of the ACME Certificate Authority to use. | ||||||
| MDCertificateCheck name url | s | X | ||||
| - | ||||||
| MDCertificateFile path-to-pem-file | s | X | ||||
| Specify a static certificate file for the MD. | ||||||
| MDCertificateKeyFile path-to-file | s | X | ||||
| Specify a static private key for for the static cerrtificate. | ||||||
| MDRenewMode always|auto|manual | auto | s | X | |||
| Controls if certificates shall be renewed. | ||||||
| MDRenewWindow duration | 33% | s | X | |||
| Control when a certificate will be renewed. | ||||||
| MDRequireHttps off|temporary|permanent | off | s | X | |||
| Redirects http: traffic to https: for Managed Domains. | ||||||
| MDRetryDelay duration | 5s | s | X | |||
| - | ||||||
| MDRetryFailover number | 13 | s | X | |||
| - | ||||||
| MDServerStatus on|off | on | s | X | |||
| Control if Managed Domain information is added to server-status. | ||||||
| MDStapleOthers on|off | on | s | X | |||
| Enable stapling for certificates not managed by mod_md. | ||||||
| MDStapling on|off | off | s | X | |||
| Enable stapling for all or a particular MDomain. | ||||||
| ProxyPassMatch [regex] !|url [key=value [key=value ...]] | svd | E | ||||
| Maps remote servers into the local server URL-space using regular expressions | ||||||
| ProxyPassReverse [path] url -[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse +[interpolate] | svd | E | ||||
| Adjusts the URL in HTTP response headers sent from a reverse proxied server | ||||||
| ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- +public-domain [interpolate] | svd | E | ||||
| Adjusts the Domain string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPassReverseCookiePath internal-path -public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- +public-path [interpolate] | svd | E | ||||
| Adjusts the Path string in Set-Cookie headers from a reverse- proxied server | ||||||
| ProxyPreserveHost On|Off | Off | svd | E | |||
| Use incoming Host HTTP request header for proxy request | ||||||