From: Ruediger Pluem Date: Wed, 13 Nov 2019 13:23:50 +0000 (+0000) Subject: * Rebuild docs X-Git-Tag: 2.5.0-alpha2-ci-test-only~1795 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9a81a381460aab9d790f04b842ce485c7e7bbec8;p=thirdparty%2Fapache%2Fhttpd.git * Rebuild docs git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1869738 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/man/htcacheclean.8 b/docs/man/htcacheclean.8 index ee5ced85cdd..092cf0e99d1 100644 --- a/docs/man/htcacheclean.8 +++ b/docs/man/htcacheclean.8 @@ -19,7 +19,7 @@ .el .ne 3 .IP "\\$1" \\$2 .. -.TH "HTCACHECLEAN" 8 "2018-09-27" "Apache HTTP Server" "htcacheclean" +.TH "HTCACHECLEAN" 8 "2019-11-13" "Apache HTTP Server" "htcacheclean" .SH NAME htcacheclean \- Clean up the disk cache @@ -27,10 +27,10 @@ htcacheclean \- Clean up the disk cache .SH "SYNOPSIS" .PP -\fB\fBhtcacheclean\fR [ -\fBD\fR ] [ -\fBv\fR ] [ -\fBt\fR ] [ -\fBr\fR ] [ -\fBn\fR ] [ -\fBR\fR\fIround\fR ] -\fBp\fR\fIpath\fR [-\fBl\fR\fIlimit\fR| -\fBL\fR\fIlimit\fR]\fR +\fB\fBhtcacheclean\fR [ -\fBD\fR ] [ -\fBv\fR ] [ -\fBt\fR ] [ -\fBr\fR ] [ -\fBn\fR ] [ -\fBR\fR\fIround\fR ] -\fBp\fR\fIpath\fR [ -\fBl\fR\fIlimit\fR ] [ -\fBL\fR\fIlimit\fR ]\fR .PP -\fB\fBhtcacheclean\fR [ -\fBn\fR ] [ -\fBt\fR ] [ -\fBi\fR ] [ -\fBP\fR\fIpidfile\fR ] [ -\fBR\fR\fIround\fR ] -\fBd\fR\fIinterval\fR -\fBp\fR\fIpath\fR [-\fBl\fR\fIlimit\fR| -\fBL\fR\fIlimit\fR]\fR +\fB\fBhtcacheclean\fR [ -\fBn\fR ] [ -\fBt\fR ] [ -\fBi\fR ] [ -\fBP\fR\fIpidfile\fR ] [ -\fBR\fR\fIround\fR ] -\fBd\fR\fIinterval\fR -\fBp\fR\fIpath\fR [ -\fBl\fR\fIlimit\fR ] [ -\fBL\fR\fIlimit\fR ]\fR .PP \fB\fBhtcacheclean\fR [ -\fBv\fR ] [ -\fBR\fR\fIround\fR ] -\fBp\fR\fIpath\fR [ -\fBa\fR ] [ -\fBA\fR ]\fR @@ -77,10 +77,10 @@ Specify \fIpidfile\fR as the name of the file to write the process ID to when da Specify \fIround\fR as the amount to round sizes up to, to compensate for disk block sizes\&. Set to the block size of the cache partition\&. .TP \fB-l\fIlimit\fR\fR -Specify \fIlimit\fR as the total disk cache size limit\&. The value is expressed in bytes by default (or attaching \fBB\fR to the number)\&. Attach \fBK\fR for Kbytes or \fBM\fR for MBytes\&. +Specify \fIlimit\fR as the total disk cache size limit\&. The value is expressed in bytes by default (or attaching \fBB\fR to the number)\&. Attach \fBK\fR for Kbytes, \fBM\fR for MBytes or \fBG\fR for Gbytes\&. .TP \fB-L\fIlimit\fR\fR -Specify \fIlimit\fR as the total disk cache inode limit\&. +Specify \fIlimit\fR as the total disk cache inode limit\&. \fBK\fR, \fBM\fR or \fBG\fR suffix can also be used\&. .TP \fB-i\fR Be intelligent and run only when there was a modification of the disk cache\&. This option is only possible together with the \fB-d\fR option\&. diff --git a/docs/man/httxt2dbm.1 b/docs/man/httxt2dbm.1 index 2f3a94e1a8f..2a06b0c9aec 100644 --- a/docs/man/httxt2dbm.1 +++ b/docs/man/httxt2dbm.1 @@ -19,7 +19,7 @@ .el .ne 3 .IP "\\$1" \\$2 .. -.TH "HTTXT2DBM" 1 "2018-09-27" "Apache HTTP Server" "httxt2dbm" +.TH "HTTXT2DBM" 1 "2019-11-13" "Apache HTTP Server" "httxt2dbm" .SH NAME httxt2dbm \- Generate dbm files for use with RewriteMap @@ -50,7 +50,7 @@ More verbose output Specify the DBM type to be used for the output\&. If not specified, will use the APR Default\&. Available types are: \fBGDBM\fR for GDBM files, \fBSDBM\fR for SDBM files, \fBDB\fR for berkeley DB files, \fBNDBM\fR for NDBM files, \fBdefault\fR for the default DBM type\&. .TP \fB-i \fISOURCE_TXT\fR\fR -Input file from which the dbm is to be created\&. The file should be formated with one record per line, of the form: \fBkey value\fR\&. See the documentation for RewriteMap for further details of this file's format and meaning\&. +Input file from which the dbm is to be created\&. The file should be formatted with one record per line, of the form: \fBkey value\fR\&. See the documentation for RewriteMap for further details of this file's format and meaning\&. .TP \fB-o \fIOUTPUT_DBM\fR\fR Name of the output dbm files\&. diff --git a/docs/manual/misc/security_tips.html.en b/docs/manual/misc/security_tips.html.en index 7ec20e19f59..7ec7b7b6284 100644 --- a/docs/manual/misc/security_tips.html.en +++ b/docs/manual/misc/security_tips.html.en @@ -456,7 +456,7 @@ on how directives are merged.

For modules that don't implement any merging logic, such as - mod_access_compat, the behavior in later sections + mod_access_compat, the behavior in later sections depends on whether the later section has any directives from the module. The configuration is inherited until a change is made, at which point the configuration is replaced and not merged.

diff --git a/docs/manual/misc/security_tips.html.es.utf8 b/docs/manual/misc/security_tips.html.es.utf8 index 9deeeedbb21..2e10c217665 100644 --- a/docs/manual/misc/security_tips.html.es.utf8 +++ b/docs/manual/misc/security_tips.html.es.utf8 @@ -29,6 +29,10 @@  ko  |  tr 

+
Esta traducción podría estar + obsoleta. Consulte la versión en inglés de la + documentación para comprobar si se han producido cambios + recientemente.

Le daremos algunas pistas y consejos sobre problemas de seguridad al configurar un servidor web. Algunas de las sugerencias serán genéricas, otras específicas de Apache.

diff --git a/docs/manual/mod/core.html.de b/docs/manual/mod/core.html.de index ecce09a3144..fe632aa7964 100644 --- a/docs/manual/mod/core.html.de +++ b/docs/manual/mod/core.html.de @@ -1227,7 +1227,7 @@ sich im Apache 2.0 ge

Obwohl die meisten Fehlermeldungen überschrieben werden können, werden unter bestimmten Umständen die internen - Meldungen ungeachtet der Einstellung der ErrorDocument-Direktive verwendet. Insbesondere bei + Meldungen ungeachtet der Einstellung der ErrorDocument-Direktive verwendet. Insbesondere bei einer fehlerhaften Anfrage werden der normale Bearbeitungsprozess sofort beendet und die interne Meldung zurückgegeben. Das ist notwendig, um Sicherheitsprobleme zu vermeiden, die auf Grund fehlerhafter Anfragen @@ -1972,7 +1972,7 @@ bestimmte HTTP-Methoden

Wenn es um Zugriffsbeschränkungen geht, sollte - ein <LimitExcept>-Container sollte immer einem <Limit>-Container vorgezogen + ein <LimitExcept>-Container sollte immer einem <Limit>-Container vorgezogen werden, da <LimitExcept> einen Schutz gegen beliebige Methoden bietet.
@@ -2931,14 +2931,14 @@ bestimmten Verzeichnis verf - - + + +as if 'QualifyRedirectURL On' was configured.
Beschreibung:Controls whether the REDIRECT_URL environment variable is fully qualified
Syntax:QualifyRedirectURL ON|OFF
Voreinstellung:QualifyRedirectURL OFF
Syntax:QualifyRedirectURL On|Off
Voreinstellung:QualifyRedirectURL Off
Kontext:Serverkonfiguration, Virtual Host, Verzeichnis
AllowOverride:FileInfo
Status:Core
Modul:core
Kompatibilität:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

Die Dokumentation zu dieser Direktive wurde noch nicht übersetzt. Bitte schauen Sie in die englische Version.

diff --git a/docs/manual/mod/core.html.en b/docs/manual/mod/core.html.en index b1366db21d1..38cbe3bf67d 100644 --- a/docs/manual/mod/core.html.en +++ b/docs/manual/mod/core.html.en @@ -1493,7 +1493,7 @@ ErrorDocument 403 /errors/forbidden.py?referrer=%{escape:%{HTTP_REFERER}}

Although most error messages can be overridden, there are certain circumstances where the internal messages are used regardless of the - setting of ErrorDocument. In + setting of ErrorDocument. In particular, if a malformed request is detected, normal request processing will be immediately halted and the internal error message returned. This is necessary to guard against security problems caused by @@ -2559,7 +2559,7 @@ wildcard matching available in 2.3.6 and later wildcard syntax shown below, to include files that match a particular pattern, such as *.conf, for example.

-

The Include directive will +

The Include directive will fail with an error if a wildcard expression does not match any file. The IncludeOptional directive can be used if non-matching wildcards should be ignored.

@@ -3212,7 +3212,7 @@ matching URLs where multiple adjacent slashes are frequently collapsed to a single slash (i.e., /home///foo is the same as /home/foo). In URL-space this is not necessarily true. - The <LocationMatch> + The <LocationMatch> directive and the regex version of <Location> require you to explicitly specify multiple slashes if that is your intention.

@@ -3955,7 +3955,7 @@ directory change the pathname used to match against <Directory> sections.

The FollowSymLinks and - SymLinksIfOwnerMatch Options work only in <Directory> sections or + SymLinksIfOwnerMatch Options work only in <Directory> sections or .htaccess files.

Omitting this option should not be considered a security restriction, @@ -4007,7 +4007,7 @@ directory

Note

The FollowSymLinks and - SymLinksIfOwnerMatch Options work only in <Directory> sections or + SymLinksIfOwnerMatch Options work only in <Directory> sections or .htaccess files.

This option should not be considered a security restriction, @@ -4183,19 +4183,19 @@ directory - - + + +as if 'QualifyRedirectURL On' was configured.
Description:Controls whether the REDIRECT_URL environment variable is fully qualified
Syntax:QualifyRedirectURL ON|OFF
Default:QualifyRedirectURL OFF
Syntax:QualifyRedirectURL On|Off
Default:QualifyRedirectURL Off
Context:server config, virtual host, directory
Override:FileInfo
Status:Core
Module:core
Compatibility:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

This directive controls whether the server will ensure that the REDIRECT_URL environment variable is fully qualified. By default, the variable contains the verbatim URL requested by the client, - such as "/index.html". With QualifyRedirectURL ON, the same request would result in a + such as "/index.html". With QualifyRedirectURL On, the same request would result in a value such as "http://www.example.com/index.html".

Even without this directive set, when a request is issued against a fully qualified URL, REDIRECT_URL will remain fully qualified. @@ -4236,17 +4236,26 @@ as if 'QualifyRedirectURL ON' was configured.

DOLLAR_ENDONLY
'$' matches at end of subject string only.
- 
# Add the ICASE option for all regexes by default
+        
# Reset all default/defined options
+RegexDefaultOptions none
+# Add the ICASE option for all regexes by default
 RegexDefaultOptions +ICASE
 ...
+# Add the ICASE option to the already applicable ones
+RegexDefaultOptions +ICASE
 # Remove the default DOLLAR_ENDONLY option, but keep any other one
 RegexDefaultOptions -DOLLAR_ENDONLY
 ...
 # Set the DOTALL option only, resetting any other one
 RegexDefaultOptions DOTALL
 ...
-# Reset all defined options
-RegexDefaultOptions none
+# Set the DOTALL and ICASE options only
+# Options are applied in order and blindly, so:
+#   RegexDefaultOptions DOTALL ICASE
+# would not work as possibly expected (ICASE clears DOTALL)
+RegexDefaultOptions none +DOTALL +ICASE
+# or "simply"
+RegexDefaultOptions DOTALL +ICASE
 ...

 
     
@@ -4439,8 +4448,8 @@ scripts
     so.
-

The option Registry-Strict which is new in Apache HTTP Server - 2.0 does the same thing as Registry but uses only the +

The option Registry-Strict + does the same thing as Registry but uses only the subkey Shell\ExecCGI\Command. The ExecCGI key is not a common one. It must be configured manually in the windows registry and hence prevents @@ -4537,7 +4546,7 @@ to name-virtual hosts

Name-based virtual hosts for the best-matching set of <virtualhost>s are processed - in the order they appear in the configuration. The first matching ServerName or ServerAlias is used, with no different precedence for wildcards + in the order they appear in the configuration. The first matching ServerName or ServerAlias is used, with no different precedence for wildcards (nor for ServerName vs. ServerAlias).

The complete list of names in the <VirtualHost> @@ -4718,15 +4727,14 @@ is accessed by an incompatible browser actually produced a returned error message.

The Off - setting, which is the default, suppresses the footer line (and is - therefore compatible with the behavior of Apache-1.2 and - below). The On setting simply adds a line with the + setting, which is the default, suppresses the footer line. + The On setting simply adds a line with the server version number and ServerName of the serving virtual host, and the EMail setting additionally creates a "mailto:" reference to the ServerAdmin of the referenced document.

-

After version 2.0.44, the details of the server version number +

The details of the server version number presented are controlled by the ServerTokens directive.

See also

@@ -4786,7 +4794,7 @@ header

This setting applies to the entire server, and cannot be enabled or disabled on a virtualhost-by-virtualhost basis.

-

After version 2.0.44, this directive also controls the +

This directive also controls the information presented by the ServerSignature directive.

Setting ServerTokens to less than diff --git a/docs/manual/mod/core.html.es.utf8 b/docs/manual/mod/core.html.es.utf8 index a221f0fe6db..6a603eba6fa 100644 --- a/docs/manual/mod/core.html.es.utf8 +++ b/docs/manual/mod/core.html.es.utf8 @@ -1244,7 +1244,7 @@ in case of an error

Although most error messages can be overriden, there are certain circumstances where the internal messages are used regardless of the - setting of ErrorDocument. In + setting of ErrorDocument. In particular, if a malformed request is detected, normal request processing will be immediately halted and the internal error message returned. This is necessary to guard against security problems caused by @@ -2025,11 +2025,11 @@ wildcard matching available in 2.3.6 and later

When a wildcard is specified for a file component of the path, and no file matches the wildcard, the - Include + Include directive will be silently ignored. When a wildcard is specified for a directory component of the path, and no directory matches the wildcard, the - Include directive will + Include directive will fail with an error saying the directory cannot be found.

@@ -2042,7 +2042,7 @@ wildcard matching available in 2.3.6 and later

When a directory or file component of the path is specified exactly, and that directory or file does not exist, - Include directive will fail with an + Include directive will fail with an error saying the file or directory cannot be found.

The file path specified may be an absolute path, or may be relative @@ -3568,14 +3568,14 @@ On Windows from Apache 2.3.3 and later. - - + + +as if 'QualifyRedirectURL On' was configured.
Descripción:Controls whether the REDIRECT_URL environment variable is fully qualified
Sintaxis:QualifyRedirectURL ON|OFF
Valor por defecto:QualifyRedirectURL OFF
Sintaxis:QualifyRedirectURL On|Off
Valor por defecto:QualifyRedirectURL Off
Contexto:server config, virtual host, directory
Anula:FileInfo
Estado:Core
Módulo:core
Compatibilidad:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

The documentation for this directive has not been translated yet. Please have a look at the English version.

diff --git a/docs/manual/mod/core.html.ja.utf8 b/docs/manual/mod/core.html.ja.utf8 index 5ef51bbbb1d..36bf0258916 100644 --- a/docs/manual/mod/core.html.ja.utf8 +++ b/docs/manual/mod/core.html.ja.utf8 @@ -1174,7 +1174,7 @@ for a complete reference and more examples. にあります。

ほとんどのエラーメッセージを上書きすることができますが、特定の状況下では - ErrorDocument の設定にかかわらず + ErrorDocument の設定にかかわらず 内蔵のメッセージが使われます。 特に、不正な形式のリクエストが検出された場合、通常のリクエスト処理は 即座に中止され、内蔵のエラーメッセージが返されます。 @@ -1939,7 +1939,7 @@ the server configuration files (<TraceEnable> 参照)。

アクセス制御が目的の場合は - <Limit> + <Limit> セクションの代わりに <LimitExcept> セクションを使用した方が良いでしょう。 <LimitExcept> セクションでは不特定のメソッドに対しても防御できるからです。
@@ -2872,14 +2872,14 @@ or specified mutexes - - + + +as if 'QualifyRedirectURL On' was configured.
説明:Controls whether the REDIRECT_URL environment variable is fully qualified
構文:QualifyRedirectURL ON|OFF
デフォルト:QualifyRedirectURL OFF
構文:QualifyRedirectURL On|Off
デフォルト:QualifyRedirectURL Off
コンテキスト:サーバ設定ファイル, バーチャルホスト, ディレクトリ
上書き:FileInfo
ステータス:Core
モジュール:core
互換性:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

このディレクティブの解説文書は まだ翻訳されていません。英語版をご覧ください。

diff --git a/docs/manual/mod/core.html.tr.utf8 b/docs/manual/mod/core.html.tr.utf8 index e8a55f73171..0a2280b20ec 100644 --- a/docs/manual/mod/core.html.tr.utf8 +++ b/docs/manual/mod/core.html.tr.utf8 @@ -1428,7 +1428,7 @@ için iptal edilmiştir. bulabilirsiniz.

Çoğu yerleşik hata iletisi özel iletilerle değiştirilebilse de bazı - durumlarda ErrorDocument ile ne + durumlarda ErrorDocument ile ne belirtildiğine bakılmaksızın yerleşik hata iletileri kullanılır. Özellikle, bozuk bir istek saptandığında normal istek işleme hemen devre dışı bırakılır ve yerleşik hata iletisi döndürülür. Bu, hatalı @@ -2255,7 +2255,7 @@ presence or absence of a specific section directive belli bir şablona uyan dosyaları seçebilmek için, örneğin *.conf gibi dosya kalıplarının kullanılmasını öneriyoruz.

-

Include yönergesi, bir dosya +

Include yönergesi, bir dosya kalıbı ifadesi hiçbir dosyayla eşleşmezse bir hatayla başarısız olacaktır. Eşleşmeyen dosya kalıbı ifadelerinin yoksayılması gerekiyorsa IncludeOptional yönergesi kullanılabilir.

@@ -2315,7 +2315,7 @@ presence or absence of a specific section directive

Bu yönerge, diğer yapılandırma dosyalarının sunucu yapılandırma dosyasında içerilmesini sağlar. Çalışması Include yönergesi ile bir istisna dışında aynıdır. Dosya kalıp karakterlerinin hiçbir dosya veya dizinle - eşleşmemesi durumunda IncludeOptional yönergesi bir hataya sebep olmak yerine + eşleşmemesi durumunda IncludeOptional yönergesi bir hataya sebep olmak yerine bunu sadece yoksayacaktır.

Ayrıca bakınız:

@@ -3716,14 +3716,14 @@ uygulanır. - - + + +as if 'QualifyRedirectURL On' was configured.
Açıklama:Controls whether the REDIRECT_URL environment variable is fully qualified
Sözdizimi:QualifyRedirectURL ON|OFF
Öntanımlı:QualifyRedirectURL OFF
Sözdizimi:QualifyRedirectURL On|Off
Öntanımlı:QualifyRedirectURL Off
Bağlam:sunucu geneli, sanal konak, dizin
Geçersizleştirme:FileInfo
Durum:Çekirdek
Modül:core
Uyumluluk:Directive supported in 2.4.18 and later. 2.4.17 acted -as if 'QualifyRedirectURL ON' was configured.

Bu yönergenin belgesi henüz Türkçeye çevrilmedi. Lütfen İngilizce sürümüne bakınız.

top
@@ -4028,7 +4028,7 @@ kullanılacak konak adları için başka isimler belirtebilmeyi sağlar.

İsme dayalı sanal konaklardan en iyi eşleşme kümesinde olanlar yapılandırmada göründükleri sıraya göre işleme sokulur. Joker - kullanımları arasında fark gözetilmeksizin ServerName veya ServerAlias yönergesi eşleşen ilk sanal konak + kullanımları arasında fark gözetilmeksizin ServerName veya ServerAlias yönergesi eşleşen ilk sanal konak kullanılır.

diff --git a/docs/manual/mod/directives.html.de b/docs/manual/mod/directives.html.de index a2220e79884..98b63ead430 100644 --- a/docs/manual/mod/directives.html.de +++ b/docs/manual/mod/directives.html.de @@ -456,6 +456,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -474,6 +475,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.en b/docs/manual/mod/directives.html.en index 4543021aa81..3eb9fdb8398 100644 --- a/docs/manual/mod/directives.html.en +++ b/docs/manual/mod/directives.html.en @@ -457,6 +457,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -475,6 +476,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.es.utf8 b/docs/manual/mod/directives.html.es.utf8 index ddc39c6e83c..57a274e9e2b 100644 --- a/docs/manual/mod/directives.html.es.utf8 +++ b/docs/manual/mod/directives.html.es.utf8 @@ -459,6 +459,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -477,6 +478,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.ja.utf8 b/docs/manual/mod/directives.html.ja.utf8 index 1819c5e0fd6..fe2791dab36 100644 --- a/docs/manual/mod/directives.html.ja.utf8 +++ b/docs/manual/mod/directives.html.ja.utf8 @@ -454,6 +454,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -472,6 +473,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.ko.euc-kr b/docs/manual/mod/directives.html.ko.euc-kr index 5bdf04d36a6..df3ba0bcdea 100644 --- a/docs/manual/mod/directives.html.ko.euc-kr +++ b/docs/manual/mod/directives.html.ko.euc-kr @@ -454,6 +454,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -472,6 +473,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.tr.utf8 b/docs/manual/mod/directives.html.tr.utf8 index 58fa4f9ab47..71d52a9d254 100644 --- a/docs/manual/mod/directives.html.tr.utf8 +++ b/docs/manual/mod/directives.html.tr.utf8 @@ -453,6 +453,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -471,6 +472,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/directives.html.zh-cn.utf8 b/docs/manual/mod/directives.html.zh-cn.utf8 index b5ec300c4ed..ec021e50402 100644 --- a/docs/manual/mod/directives.html.zh-cn.utf8 +++ b/docs/manual/mod/directives.html.zh-cn.utf8 @@ -452,6 +452,7 @@
  • MDCertificateAuthority
  • MDCertificateFile
  • MDCertificateKeyFile
    • +
  • MDCertificateMonitor
  • MDCertificateProtocol
  • MDCertificateStatus
  • MDChallengeDns01
    • @@ -470,6 +471,10 @@
  • MDRenewWindow
  • MDRequireHttps
  • MDServerStatus
    • +
  • MDStapleOthers
    • +
  • MDStapling
    • +
  • MDStaplingKeepResponse
    • +
  • MDStaplingRenewWindow
  • MDStoreDir
  • MDWarnWindow
  • MemcacheConnTTL
    • diff --git a/docs/manual/mod/mod_access_compat.html.en b/docs/manual/mod/mod_access_compat.html.en index 64a385960de..ebaf18bddd0 100644 --- a/docs/manual/mod/mod_access_compat.html.en +++ b/docs/manual/mod/mod_access_compat.html.en @@ -264,7 +264,7 @@ evaluated. Deny directives, controls a three-pass access control system. The first pass processes either all Allow or all Deny directives, as specified - by the Order + by the Order directive. The second pass parses the rest of the directives (Deny or Allow). The third diff --git a/docs/manual/mod/mod_access_compat.html.es.utf8 b/docs/manual/mod/mod_access_compat.html.es.utf8 index 26a7ac72316..b70835d4a8f 100644 --- a/docs/manual/mod/mod_access_compat.html.es.utf8 +++ b/docs/manual/mod/mod_access_compat.html.es.utf8 @@ -209,7 +209,7 @@ Allow from 2001:db8::a00:20ff:fea7:ccea/10 Deny, realizan un sistema de control de tres fases. La primera fase proceso o bien todas las directivas Allow o todas las directivas Deny, tal y como se haya especificado en la directiva - Order. La segunda fase interpreta el resto de directivas + Order. La segunda fase interpreta el resto de directivas (Deny o Allow). La tercera fase se aplica a todas las peticiones que no coinciden con cualquiera de las dos fases anteriores.

    diff --git a/docs/manual/mod/mod_alias.html.en b/docs/manual/mod/mod_alias.html.en index 4a2b5f99e31..368baee54ae 100644 --- a/docs/manual/mod/mod_alias.html.en +++ b/docs/manual/mod/mod_alias.html.en @@ -241,18 +241,18 @@ expressions

    One subtle difference between Alias - and AliasMatch is + and AliasMatch is that Alias will automatically copy any additional part of the URI, past the part that matched, onto the end of the file path on the right side, - while AliasMatch will + while AliasMatch will not. This means that in almost all cases, you will want the regular expression to match the entire request URI from beginning to end, and to use substitution on the right side.

    In other words, just changing Alias to - AliasMatch will not + AliasMatch will not have the same effect. At a minimum, you need to add ^ to the beginning of the regular expression and add (.*)$ to the end, and add $1 to @@ -275,9 +275,9 @@ expressions

    Of course, there's no point in - using AliasMatch + using AliasMatch where Alias would - work. AliasMatch lets + work. AliasMatch lets you do more complicated things. For example, you could serve different kinds of files from different directories:

    @@ -442,7 +442,7 @@ of the current URL AliasMatch also apply to the difference between Redirect and - RedirectMatch. + RedirectMatch. See AliasMatch for details.

    @@ -619,7 +619,7 @@ and designates the target as a CGI script AliasMatch also apply to the difference between ScriptAlias and - ScriptAliasMatch. + ScriptAliasMatch. See AliasMatch for details.

    diff --git a/docs/manual/mod/mod_alias.html.es.utf8 b/docs/manual/mod/mod_alias.html.es.utf8 index ab728e82904..53e74b0b495 100644 --- a/docs/manual/mod/mod_alias.html.es.utf8 +++ b/docs/manual/mod/mod_alias.html.es.utf8 @@ -216,13 +216,13 @@ Alias "/foo" "/gaq"

    Una sutil diferencia entre Alias - y AliasMatch es que + y AliasMatch es que Alias copiará automáticamente cualquier parte adicional de la URI, pasada la parte que coincide, al final de la ruta del fichero en el parámetro de la derecha, mientras que - AliasMatch no lo hará. Esto significa en casi todos los casos, querrá que las expresiones regulares concuerden con la URI solicitada al completo desde el comienzo al final, y usar la sustitución del parámetro a la derecha.

    + AliasMatch no lo hará. Esto significa en casi todos los casos, querrá que las expresiones regulares concuerden con la URI solicitada al completo desde el comienzo al final, y usar la sustitución del parámetro a la derecha.

    En otras palabras, cambiar Alias a - AliasMatch no tendrá el mismo resultado. Como mínimo, tendrá que añadir un ^ al comienzo de la expresión regular, añadir un (.*)$ al final y añadir + AliasMatch no tendrá el mismo resultado. Como mínimo, tendrá que añadir un ^ al comienzo de la expresión regular, añadir un (.*)$ al final y añadir $1 al final del reemplazo.

    Por ejemplo, supongamos que quiere reemplazar esto con AliasMatch:

    @@ -241,9 +241,9 @@ Alias "/foo" "/gaq"

    Por supuesto, no hay ningún motivo para usar - AliasMatch + AliasMatch donde Alias funcionaría. - AliasMatch le permite hacer cosas más complicadas. Por ejemplo, puede servir diferentes tipos de ficheros desde diferentes directorios:

    + AliasMatch le permite hacer cosas más complicadas. Por ejemplo, puede servir diferentes tipos de ficheros desde diferentes directorios:

    AliasMatch "^/image/(.*)\.jpg$" "/files/jpg.images/$1.jpg"
 AliasMatch "^/image/(.*)\.gif$" "/files/gif.images/$1.gif"
    @@ -379,7 +379,7 @@ Redirect 303 "/three" "http://example.com/other" AliasMatch también aplican a las diferencias entre Redirect y - RedirectMatch. + RedirectMatch. Vea AliasMatch para más detalles.

    @@ -529,7 +529,7 @@ una expresión regular y designa el destino como un script CGI AliasMatch también aplican a las diferencias entre ScriptAlias y - ScriptAliasMatch. + ScriptAliasMatch. Vea AliasMatch para más detalles.

    diff --git a/docs/manual/mod/mod_alias.html.tr.utf8 b/docs/manual/mod/mod_alias.html.tr.utf8 index fbb98a3fd2d..00a7e83963b 100644 --- a/docs/manual/mod/mod_alias.html.tr.utf8 +++ b/docs/manual/mod/mod_alias.html.tr.utf8 @@ -208,16 +208,16 @@ eşler.

    Alias - ve AliasMatch yönergeleri + ve AliasMatch yönergeleri arasındaki başlıca fark Alias yönergesinin, URI'nin ek parçasını, eşleşen parçayı geçip sağ tarafta - dosya yolunun ucuna kendiliğinden kopyalamasıdır. AliasMatch bunu böyle yapmaz. Yani hemen + dosya yolunun ucuna kendiliğinden kopyalamasıdır. AliasMatch bunu böyle yapmaz. Yani hemen her durumda, düzenli ifadenin istenen URI'nin tamamıyla baştan sona eşleşmesi ve yer değiştirmeyi sağ tarafta yapması istenir.

    Başka bir deyişle, basitçe Alias yerine - AliasMatch yazmakla aynı etkiyi + AliasMatch yazmakla aynı etkiyi alamazsınız. En azından düzenli ifadenin başına bir ^ ve sonuna bir (.*)$, ikinci değiştirgenin sonuna da bir $1 eklemeniz gerekir.

    @@ -242,8 +242,8 @@ eşler.

    Şüphesiz, Alias yönergesini - çalıştığı yerde AliasMatch - kullanmanın hiç gereği yoktur. AliasMatch daha karmaşık şeyler yapmamızı sağlar. Örneğin + çalıştığı yerde AliasMatch + kullanmanın hiç gereği yoktur. AliasMatch daha karmaşık şeyler yapmamızı sağlar. Örneğin farklı dosya çeşitlerini farklı dizinlerden sunmak isteyelim:

    @@ -376,7 +376,7 @@ yönlendirme gönderir.

    Alias ve AliasMatch arasındaki farklarla ilgili hususlar Redirect ve - RedirectMatch arasındakilere de + RedirectMatch arasındakilere de uygulanır. Ayrıntılar için AliasMatch yönergesine bakınız.

    @@ -538,7 +538,7 @@ eşler ve hedefi bir CGI betiği olarak çalıştırır.

    Alias ve AliasMatch arasındaki farklarla ilgili hususlar ScriptAlias ve - ScriptAliasMatch arasındakilere + ScriptAliasMatch arasındakilere de uygulanır. Ayrıntılar için AliasMatch yönergesine bakınız.

    diff --git a/docs/manual/mod/mod_auth_basic.html.es.utf8 b/docs/manual/mod/mod_auth_basic.html.es.utf8 index b729da19f00..13cf46194e0 100644 --- a/docs/manual/mod/mod_auth_basic.html.es.utf8 +++ b/docs/manual/mod/mod_auth_basic.html.es.utf8 @@ -196,7 +196,7 @@ que el proveedor elegido está presente en el servidor.

    A través del uso de - AuthBasicUseDigestAlgorithm un sitio puede pasar de Autenticación Digest a Básica sin requerir que a los usuarios se les asignen contraseñas nuevas.

    + AuthBasicUseDigestAlgorithm un sitio puede pasar de Autenticación Digest a Básica sin requerir que a los usuarios se les asignen contraseñas nuevas.

    El método inverso de cambiar de Autenticación Básica a Digest sin asignar nuevas contraseñas generalmente no es posible. Solo si las contraseñas de la Autenticación Básica se han almacenado en texto plano o con un esquema de encriptación reversible sería posible recuperarlas y generar un nuevo almacén de datos siguiendo el esquema de almacenamiento de contraseñas de Autenticación Digest. diff --git a/docs/manual/mod/mod_auth_form.html.en b/docs/manual/mod/mod_auth_form.html.en index a4f97548d5f..475c9a671ca 100644 --- a/docs/manual/mod/mod_auth_form.html.en +++ b/docs/manual/mod/mod_auth_form.html.en @@ -298,9 +298,9 @@ SessionCookieName session path=/

    Another option is to render the login form using a CGI script or other dynamic technology.

    -

    CGI example

            AuthFormProvider file
-        ErrorDocument 401 "/cgi-bin/login.cgi"
-        ...
    +

    CGI example

    AuthFormProvider file
+ErrorDocument 401 "/cgi-bin/login.cgi"
+...
    top
    @@ -379,21 +379,21 @@ lower level modules - +
    Description:The name of a form field carrying the body of the request to attempt on successful login
    Syntax:AuthFormBody fieldname
    Default:httpd_body
    Default:AuthFormBody httpd_body
    Context:directory
    Override:AuthConfig
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormMethod directive specifies - the name of an HTML field which, if present, will contain the method of the request to +

    The AuthFormBody directive specifies + the name of an HTML field which, if present, will contain the body of the request to submit should login be successful.

    By populating the form with fields described by AuthFormMethod, AuthFormMimetype and - AuthFormBody, a website can retry + AuthFormBody, a website can retry a request that may have been interrupted by the login screen, or by a session timeout.

    @@ -402,7 +402,7 @@ lower level modules

    AuthFormDisableNoStore Directive

    - + @@ -410,7 +410,7 @@ lower level modules
    Description:Disable the CacheControl no-store header on the login page
    Syntax:AuthFormDisableNoStore On|Off
    Syntax:AuthFormDisableNoStore On|Off
    Default:AuthFormDisableNoStore Off
    Context:directory
    Override:AuthConfig
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormDisableNoStore flag +

    The AuthFormDisableNoStore flag disables the sending of a Cache-Control no-store header with the error 401 page returned when the user is not yet logged in. The purpose of the header is to make it difficult for an ecmascript application to attempt to resubmit the @@ -423,7 +423,7 @@ lower level modules

    AuthFormFakeBasicAuth Directive

    - + @@ -431,7 +431,7 @@ lower level modules
    Description:Fake a Basic Authentication header
    Syntax:AuthFormFakeBasicAuth On|Off
    Syntax:AuthFormFakeBasicAuth On|Off
    Default:AuthFormFakeBasicAuth Off
    Context:directory
    Override:AuthConfig
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormFakeBasicAuth flag +

    The AuthFormFakeBasicAuth flag determines whether a Basic Authentication header will be added to the request headers. This can be used to expose the username and password to an underlying application, without the underlying application having to be aware @@ -444,14 +444,14 @@ lower level modules - +
    Description:The name of a form field carrying a URL to redirect to on successful login
    Syntax:AuthFormLocation fieldname
    Default:httpd_location
    Default:AuthFormLocation httpd_location
    Context:directory
    Override:AuthConfig
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormLocation directive specifies +

    The AuthFormLocation directive specifies the name of an HTML field which, if present, will contain a URL to redirect the browser to should login be successful.

    @@ -469,7 +469,7 @@ lower level modules Compatibility:Available in Apache HTTP Server 2.3.0 and later. The use of the expression parser has been added in 2.4.4. -

    The AuthFormLoginRequiredLocation directive +

    The AuthFormLoginRequiredLocation directive specifies the URL to redirect to should the user not be authorised to view a page. The value is parsed using the ap_expr parser before being sent to the client. By default, if a user is not authorised to view a page, the HTTP response code @@ -494,7 +494,7 @@ parser has been added in 2.4.4. Compatibility:Available in Apache HTTP Server 2.3.0 and later. The use of the expression parser has been added in 2.4.4. -

    The AuthFormLoginSuccessLocation directive +

    The AuthFormLoginSuccessLocation directive specifies the URL to redirect to should the user have logged in successfully. The value is parsed using the ap_expr parser before being sent to the client. This directive can be overridden if a form field has been defined containing another URL @@ -518,7 +518,7 @@ parser has been added in 2.4.4. Compatibility:Available in Apache HTTP Server 2.3.0 and later. The use of the expression parser has been added in 2.4.4. -

    The AuthFormLogoutLocation directive +

    The AuthFormLogoutLocation directive specifies the URL of a page on the server to redirect to should the user attempt to log out. The value is parsed using the ap_expr parser before being sent to the client.

    @@ -546,19 +546,19 @@ parser has been added in 2.4.4. - +
    Description:The name of a form field carrying the method of the request to attempt on successful login
    Syntax:AuthFormMethod fieldname
    Default:httpd_method
    Default:AuthFormMethod httpd_method
    Context:directory
    Override:AuthConfig
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormMethod directive specifies - the name of an HTML field which, if present, will contain the method of the request to +

    The AuthFormMethod directive specifies + the name of an HTML field which, if present, will contain the method of the request to submit should login be successful.

    By populating the form with fields described by - AuthFormMethod, + AuthFormMethod, AuthFormMimetype and AuthFormBody, a website can retry a request that may have been interrupted by the login screen, or by a session @@ -570,20 +570,20 @@ parser has been added in 2.4.4. - +
    Description:The name of a form field carrying the mimetype of the body of the request to attempt on successful login
    Syntax:AuthFormMimetype fieldname
    Default:httpd_mimetype
    Default:AuthFormMimetype httpd_mimetype
    Context:directory
    Override:AuthConfig
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormMethod directive specifies +

    The AuthFormMimetype directive specifies the name of an HTML field which, if present, will contain the mimetype of the request to submit should login be successful.

    By populating the form with fields described by AuthFormMethod, - AuthFormMimetype and + AuthFormMimetype and AuthFormBody, a website can retry a request that may have been interrupted by the login screen, or by a session timeout.

    @@ -594,14 +594,14 @@ parser has been added in 2.4.4. - +
    Description:The name of a form field carrying the login password
    Syntax:AuthFormPassword fieldname
    Default:httpd_password
    Default:AuthFormPassword httpd_password
    Context:directory
    Override:AuthConfig
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormPassword directive specifies +

    The AuthFormPassword directive specifies the name of an HTML field which, if present, will contain the password to be used to log in.

    @@ -652,7 +652,7 @@ parser has been added in 2.4.4. Module:mod_auth_form Compatibility:Available in Apache HTTP Server 2.3.0 and later -

    The AuthFormSitePassphrase directive +

    The AuthFormSitePassphrase directive specifies a passphrase which, if present in the user session, causes Apache httpd to bypass authentication checks for the given URL. It can be used on high traffic websites to reduce the load induced on authentication infrastructure.

    @@ -678,13 +678,13 @@ parser has been added in 2.4.4. - +
    Description:The largest size of the form in bytes that will be parsed for the login details
    Syntax:AuthFormSize size
    Default:8192
    Default:AuthFormSize 8192
    Context:directory
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormSize directive specifies +

    The AuthFormSize directive specifies the maximum size of the body of the request that will be parsed to find the login form.

    If a login request arrives that exceeds this size, the whole request will be aborted @@ -704,14 +704,14 @@ parser has been added in 2.4.4. - +
    Description:The name of a form field carrying the login username
    Syntax:AuthFormUsername fieldname
    Default:httpd_username
    Default:AuthFormUsername httpd_username
    Context:directory
    Override:AuthConfig
    Status:Base
    Module:mod_auth_form
    Compatibility:Available in Apache HTTP Server 2.3.0 and later
    -

    The AuthFormUsername directive specifies +

    The AuthFormUsername directive specifies the name of an HTML field which, if present, will contain the username to be used to log in.

    diff --git a/docs/manual/mod/mod_authnz_ldap.html.en b/docs/manual/mod/mod_authnz_ldap.html.en index faa6664c6fa..b21bfd2f1dd 100644 --- a/docs/manual/mod/mod_authnz_ldap.html.en +++ b/docs/manual/mod/mod_authnz_ldap.html.en @@ -1431,7 +1431,7 @@ You can of course use search parameters on each of these.

    upgraded to a secure connection on the same port. -

    See above for examples of AuthLDAPURL URLs.

    +

    See above for examples of AuthLDAPURL URLs.

    diff --git a/docs/manual/mod/mod_buffer.html.en b/docs/manual/mod/mod_buffer.html.en index 3f4097accd9..415008e2ac7 100644 --- a/docs/manual/mod/mod_buffer.html.en +++ b/docs/manual/mod/mod_buffer.html.en @@ -91,7 +91,7 @@ Status:Extension Module:mod_buffer -

    The BufferSize +

    The BufferSize directive specifies the amount of data in bytes that will be buffered before being read from or written to each request. The default is 128 kilobytes.

    diff --git a/docs/manual/mod/mod_cache_disk.html.ja.utf8 b/docs/manual/mod/mod_cache_disk.html.ja.utf8 index ad0f6e988fb..30a54e3cdff 100644 --- a/docs/manual/mod/mod_cache_disk.html.ja.utf8 +++ b/docs/manual/mod/mod_cache_disk.html.ja.utf8 @@ -91,7 +91,7 @@

    CacheDirLevels* - CacheDirLength の + CacheDirLength の 結果は 20 以内でなければなりません。

    diff --git a/docs/manual/mod/mod_charset_lite.html.en b/docs/manual/mod/mod_charset_lite.html.en index 175ae8de21b..7161a17d627 100644 --- a/docs/manual/mod/mod_charset_lite.html.en +++ b/docs/manual/mod/mod_charset_lite.html.en @@ -127,7 +127,7 @@
    Specifying the same charset for both CharsetSourceEnc - and CharsetDefault disables translation. The charset + and CharsetDefault disables translation. The charset need not match the charset of the response, but it must be a valid charset on the system.
    @@ -197,7 +197,7 @@ translation support in Solaris 8.

    - Specifying the same charset for both CharsetSourceEnc + Specifying the same charset for both CharsetSourceEnc and CharsetDefault disables translation. The charset need not match the charset of the response, but it must be a valid charset on the system.
    diff --git a/docs/manual/mod/mod_crypto.html.en b/docs/manual/mod/mod_crypto.html.en index ea92f16cab7..9f3583940a1 100644 --- a/docs/manual/mod/mod_crypto.html.en +++ b/docs/manual/mod/mod_crypto.html.en @@ -214,7 +214,7 @@ Status:Extension Module:mod_crypto -

    The CryptoDriver +

    The CryptoDriver directive specifies the name of the crypto driver to use. There is usually a recommended default driver on each platform. Possible values include openssl, commoncrypto and @@ -280,7 +280,7 @@ Status:Extension Module:mod_crypto -

    The CryptoSize +

    The CryptoSize directive specifies the amount of data in bytes that will be buffered before being encrypted or decrypted during each request. The default is 128 kilobytes.

    diff --git a/docs/manual/mod/mod_include.html.en b/docs/manual/mod/mod_include.html.en index 7b9dbdd9fc6..dacd303f539 100644 --- a/docs/manual/mod/mod_include.html.en +++ b/docs/manual/mod/mod_include.html.en @@ -961,7 +961,7 @@ server.
    The Last-Modified header will be respected if already present in a response, and added to the response if the response is a file and the header is missing. The - SSILastModified directive + SSILastModified directive takes precedence over XBitHack.
    @@ -1107,7 +1107,7 @@ set

    The SSILastModified directive takes precedence over the - XBitHack directive when + XBitHack directive when SSILastModified is set to on.

    diff --git a/docs/manual/mod/mod_md.html.en b/docs/manual/mod/mod_md.html.en index bc83bdb8a96..7eec85c7df9 100644 --- a/docs/manual/mod/mod_md.html.en +++ b/docs/manual/mod/mod_md.html.en @@ -40,27 +40,24 @@

    This module manages common properties of domains for one or more virtual hosts. - Its main feature is the use of the ACME protocol - (RFC 8555) - to automate certificate provisioning. Certificates will be renewed - by the module ahead of their expiration to account for disruption in internet - services. There are ways to monitor the status of all Managed Domains - and configurations that will run your own notification commands on renewal, - expiration and errors. -

    -

    - The default ACME Certificate Authority is + Its serves two main purposes: for one, supervise/renew https: certificates via the + ACME protocol (RFC 8555). + Certificates will be renewed by the module ahead of their expiration to account + for disruption in internet services. There are ways to monitor the status of all + certififcates managed this way and configurations that will run your own + notification commands on renewal, expiration and errors. +

    + Second, mod_md offers an alternate OCSP Stapling implementation. This works with + managed certificates as well as with certificates you configure yourself. OCSP + Stapling is a necessary component for any https: site, influencing page load + times and, depending on other setups, page availability. More in the + stapling section below. +

    + The default ACME Authority for managing certificates is Let's Encrypt, but it is possible to configure another CA that supports the protocol.

    -

    Warning

    -

    This module is experimental. Its behaviors, directives, and - defaults are subject to more change from release to - release relative to other standard modules. Users are encouraged to - consult the "CHANGES" file for potential updates.

    -
    -

    Simple configuration example:

    TLS in a VirtualHost context

    @@ -93,39 +90,59 @@ This module requires mod_watchdog to be loaded as well.

    Certificate sign-up and renewal with Let's Encrypt requires your server to be - reachable on port 80 (http:) from the outside. The alternative method over - port 443 (https:) is currently disabled for security reasons (status from - 2018-01-14). + reachable on port 80 (http:) and/or port 443 (https:) from the public internet. + (Unless your server is configured to use DNS for challenges - more on that under + 'wildcard certificates')

    - The module will select from the methods offered by Let's Encrypt. If LE decides - at one point in the future, to re-enable it again, mod_md will - use it when suitable. + The module will select from the methods offered by Let's Encrypt. Usually LE offers + challenges on both ports and DNS and Apache chooses a method available. +

    + To determine which one is available, the module looks at the ports + Apache httpd listens on. If those include port 80, it assumes that the + http: challenge (named http-01) is available. If the server listens + on port 443, the https: challenge (named tls-alpn-01) is also added to + the list. (And if MDChallengeDns01 + is configured, the challenge dns-01 is added as well.) +

    + If your setup is not so straight forward, there are two methods available + to influence this. First, look at MDPortMap + if the server is behind a portmapper, such as a firewall. Second, you may + override the module's guesswork completely by configuring + MDCAChallenges directly. +

    +
    + +

    https: Challenges

    +

    + For domain verification via the TLS protocol `tls-alpn-01` is the name + of the challenge type. It requires the Apache server to listen on port 443 + (see MDPortMap if you map that port + to something else).

    - But for now, only the port 80 variant is available (termed "http-01"). Only - when LE can reach your server on port 80 will mod_md work for - you. For now, at least. + Let's Encrypt will open a TLS connection to Apache using the special indicator + `acme-tls/1` (this indication part of TLS is called ALPN, therefore the name + of the challenge. ALPN is also used by browsers to request a HTTP/2 connection).

    - If you do not want to offer any sites on port 80 any more, you may leave it open - and redirect all requests to your https: sites instead. Use the - MDRequireHttps described below to do - that in a convenient fashion. This will continue to answer http: challenges - from Let's Encrypt. + As with the HTTP/2 protocol, to allow this, you configure:

    + 
    Protocols h2 http/1.1 acme-tls/1
    + +

    + And the `tls-alpn-01` challenge type is available. +

    Wildcard Certificates

    - Wildcard certificates are possible with version 2.x of `mod_md``. But they are - not straight-forward. Let's Encrypt requires the `dns-01` challenge verification + Wildcard certificates are possible, but not straight-forward to use out of + the box. Let's Encrypt requires the `dns-01` challenge verification for those. No other is considered good enough.

    - The difficulty here is that Apache cannot do that on its own. (which is also - a security benefit, since corrupting a web server or the communication path to - it is the scenario `dns-01` protects against). As the name implies, `dns-01` + The difficulty here is that Apache cannot do that on its own. As the name implies, `dns-01` requires you to show some specific DNS records for your domain that contain some challenge data. So you need to _write_ your domain's DNS records.

    - If you know how to do that, you can integrated this with `mod_md`. Let's + If you know how to do that, you can integrated this with mod_md. Let's say you have a script for that in `/usr/bin/acme-setup-dns` you configure Apache with:

    @@ -220,6 +237,52 @@

    +

    Stapling

    +

    + If you want to try the stapling in one Managed Domain alone at first, + configure: +

    + 
    <MDomain mydomain.net>
+  MDStapling on
+</MDomain>
    + +

    + and use the 'server-status' and/or MDMessageCmd to see how it operates. You will + see if Stapling information is there, how long it is valid, from where it came and + when it will be refreshed. +

    + If this all works to your satisfaction, you can switch it on for all your + certificates or just your managed ones. +

    + The existing stapling implementation by mod_ssl is used by many sites + for years. There are two main differences between the mod_ssl and mod_md + one: +

    +
      +
    1. On demand vs. scheduled: mod_ssl retrieves the stapling information + when it is requested, e.g. on a new connection. mod_md retrieves it + right at server start and after 2/3rds of its lifetime.
      2. +
    2. In memory vs. persisted: mod_ssl can persist this + information, but most example configurations use a memory cache. mod_md + always stores in the file system.
      3. +
    +

    + If you are unlucky and restart your server during an outage of your CA's + OCSP service, your users may no longer reach your sites. Without persistence + your server cannot provide the client with the data and the client browser + cannot get it as well, since the OCSP service is not responding. +

    + The implementation in mod_md will have peristed it, load it again after + restart and have it available for incoming connections. A day or two before + this information expires, it will renew it, making it able to copy with + a long OCSP service downtime. +

    + Due to backward compatibility, the existing implementation in mod_ssl could + not be changed drastically. For example, mod_ssl is unable to add a dependency + to mod_watchdog without braking many existing installations (that do not load it). +

    +
    +

    Directives

    @@ -283,11 +351,24 @@ Module:mod_md

    - Sets challenge types and their execution order when proving domain ownership. - The names are protocol specific. - The current ACME protocol version implemented by Let's Encrypt defines three challenge - types that are supported by mod_md. By default, it will try - the one on port 443 when available. + Sets challenge types (in order of preference) when proving domain ownership. + Supported by the module are the challenge methods 'tls-alpn-01', 'dns-01' + and 'http-01'. The module will look at the overall configuation of the server + to find out which methods can be used. +

    + If the server listens on port 80, for example, the 'http-01' method is available. + The prerequisite for 'dns-01' is a configured 'MDChallengeDns01' command. + 'tls-alpn-01' is described above in 'https: Challenges'. +

    + This auto selection works for most setups. But since Apache is a very powerful + server with many configuration options, the situation is not clear for all + possible cases. For example: it may listen on multiple IP addresses where some + are reachable on `https:` and some not. +

    + If you configure 'MDCAChallenges' directly, this auto selection is disabled. + Instead, the module will use the configured challenge list when talking to + the ACME server (a challenge type must be offered by the server as well). + This challenges are examined in the order specified.

    @@ -369,7 +450,7 @@ in your configuration. Then you can add MDRenewMode 'always' to it and the module will get a new certificate before the one from the file expires. When it has done so, you remove the - MDCertificateFile and reload the server. + MDCertificateFile and reload the server.

    Another use case is that you renew your Let's Encrypt certificates with another ACME clients, for example the excellent @@ -396,6 +477,33 @@ SSLCertificateKeyFile directive.

    + +
    top
    +

    MDCertificateMonitor Directive

    + + + + + + + +
    Description:The URL of a certificate log monitor.
    Syntax:MDCertificateMonitor name url
    Default:crt.sh https://crt.sh?q=
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + This is part of the 'server-status' HTML user interface and has nothing to + do with the core functioning itself. It defines the link offered on that + page for easy checking of a certificate monitor. The SHA256 fingerprint + of the certificate is appended to the configured url. +

    + Certificate Monitors offer supervision of Certificate Transparency (CT) + Logs to track the use of certificates for domains. The least you may see + is that Let's Encrypt (or whichever CA you have configured) has entered + your certificates into the CTLogs. +

    + Caveat: certificate logs update and monitor's intakes of those + updates suffer some delay. This varies between logs and monitors. A + brand new certificate will not be known immediately. +

    +
    top

    MDCertificateProtocol Directive

    @@ -501,7 +609,7 @@

    Instead of listing all dns names on the same line, you may use - MDMember to add such names + MDMember to add such names to a managed domain.

    Example

    <MDomain example.org>
@@ -544,7 +652,7 @@
 
             
    
                 This command gets called when one of the following events happen for
-                a Managed Domain: "renewed", "expiring", "errored". The command may
+                a Managed Domain: "renewed", "installed", "expiring", "errored". The command may
                 be invoked for more than these in the future and ignore events
                 it is not prepared to handle.
             
    
@@ -563,13 +671,25 @@ MDMessageCmd /etc/apache/md-message
                 return code other than 0 is regarded as an error. 
             
    
                 'errored' is no immediate cause for concern since renewal is attempted
-                early enough to allow the internet to come back. 
+                early enough to allow the internet to come back. This is reported at most
+                once per hour. 
             
    
                 'expiring' should be taken serious. It is issued when the
                 MDWarnWindow is reached. By default this is
                 10% of the certificate lifetime, so for Let's Encrypt this currently
                 means 9 days before it expires. The warning is repeated at most once
                 a day. 
+            
    
+                'renewed' means that a new certificate has been obtained and is stored
+                in the 'staging' area in the MD store. It will be activated on the next
+                server restart/reload.
+            
    
+                'installed' is triggered when a new certificate has been transferred from
+                staging into the domains location in MD store. This happens at server
+                startup/reload. Different to all other invocations, MDMessageCmd is run
+                with root permissions (on *nix systems) and has access to the certificate
+                files (and keys). Certificates needed for other applications or
+                in different formats can be processed on this event.
    @@ -936,6 +1056,109 @@ MDRenewWindow 10% You can switch that off using this directive.

    +
    +
    top
    +

    MDStapleOthers Directive

    + + + + + + + +
    Description:Enable stapling for certificates not managed by mod_md.
    Syntax:MDStapleOthers on|off
    Default:on
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + This setting only takes effect when `MDStapling` is enabled. It controls + if `mod_md` should also provide stapling information for certificates + that are not directly controlled by it, e.g. renewed via an ACME CA. +

    + +
    +
    top
    +

    MDStapling Directive

    + + + + + + + +
    Description:Enable stapling for all or a particular MDomain.
    Syntax:MDStapling on|off
    Default:off
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + mod_md offers an implementation for providing OCSP stapling information. + This is an alternative to the one provided by 'mod_ssl'. For backward + compatiblity, this is disabled by default. +

    + The stapling can be switched on for all certificates on the server or + for an individual MDomain. This will replace any stapling configurtion + in `mod_ssl` for these hosts. When disabled, the 'mod_ssl' stapling + will do the work (if it is itself enabled, of course). This allows for + a gradual shift over from one implementation to the other. +

    + The stapling of `mod_md` will also work for domains where the certificates + are not managed by this module (see MDStapleOthers for how to control this). + This allows use of the new stapling without using any ACME certificate + management. +

    + +
    +
    top
    +

    MDStaplingKeepResponse Directive

    + + + + + + + +
    Description:Controls when old responses should be removed.
    Syntax:MDStaplingKeepResponse duration
    Default:7d
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + This time window specifies when OCSP response data used in stapling + shall be removed from the store again. Response information older than + 7 days (default) is deleted on server restart/reload. This keeps the store + from growing when certificates are renewed/reconfigured frequently. +

    +

    + +
    +
    top
    +

    MDStaplingRenewWindow Directive

    + + + + + + + +
    Description:Control when the stapling responses will be renewed.
    Syntax:MDStaplingRenewWindow duration
    Default:33%
    Context:server config
    Status:Experimental
    Module:mod_md
    +

    + If the validity of the OCSP response used in stapling falls below 'duration', + mod_md will obtain a new OCSP response. +

    + The CA issueing a certificate commonly also operates the OCSP responder + service and determines how long its signed response about the validity + of a certificate are itself valid. The longer a response is valid, the longer + it can be cached which mean better overall performance for everyone. + The shorter the life time, the more rapidly certificate revocations + spread to clients. Also, service reliability is a consideration. +

    + By adjusting the stapling renew window you can control parts of this yourself. + If you make the renew time short (e.g. a short time before the current + information expires), you gain maximum cache time. But a service outage + (down for maintenance, for example) will affect you. If you renew a long + time before expiry, updates will be made more frequent, cause more load + on the CA server infrastructure and also more coordination between + the child processes of your server. +

    + The default is chosen as 33%, which means renewal is started when only + a third of the response lifetime is left. For a CA that issues OCSP + responses with lifetime of 3 days, this means 2 days of caching and 1 day + for renewal attempts. A service outage would have to last full 24 hours + to affect your domains. +

    + Setting an absolute renew window, like `2d` (2 days), is also possible. +

    +
    top

    MDStoreDir Directive

    diff --git a/docs/manual/mod/mod_mime.html.en b/docs/manual/mod/mod_mime.html.en index af8174d1c01..ef2a009ff3f 100644 --- a/docs/manual/mod/mod_mime.html.en +++ b/docs/manual/mod/mod_mime.html.en @@ -509,9 +509,9 @@ responses from the server them.

    Note that when defining a set of filters using the - AddOutputFilter directive, + AddOutputFilter directive, any definition made will replace any previous definition made by - the AddOutputFilter + the AddOutputFilter directive.

    # Effective filter "DEFLATE"
diff --git a/docs/manual/mod/mod_proxy.html.en b/docs/manual/mod/mod_proxy.html.en
index d18deff624e..a1222ce3437 100644
--- a/docs/manual/mod/mod_proxy.html.en
+++ b/docs/manual/mod/mod_proxy.html.en
@@ -1148,17 +1148,17 @@ ProxyPass "/mirror/foo"   "http://backend.example.com"
    guarantee any ordering or override.

    Ordering ProxyPass Directives

    -

    The configured ProxyPass +

    The configured ProxyPass and ProxyPassMatch rules are checked in the order of configuration. The first rule that matches wins. So usually you should sort conflicting - ProxyPass rules starting with the + ProxyPass rules starting with the longest URLs first. Otherwise, later rules for longer URLS will be hidden by any earlier rule which uses a leading substring of the URL. Note that there is some relation with worker sharing.

    Ordering ProxyPass Directives in Locations

    -

    Only one ProxyPass directive +

    Only one ProxyPass directive can be placed in a Location block, and the most specific location will take precedence.

    @@ -1988,7 +1988,7 @@ expressions need mod_proxy_connect enabled in the server.

    Warning

    -

    Do not enable proxying with ProxyRequests until you have secured your server. Open proxy servers are dangerous +

    Do not enable proxying with ProxyRequests until you have secured your server. Open proxy servers are dangerous both to your network and to the Internet at large.

    diff --git a/docs/manual/mod/mod_proxy.html.ja.utf8 b/docs/manual/mod/mod_proxy.html.ja.utf8 index 4ae3fc0b135..5cf6f3f7548 100644 --- a/docs/manual/mod/mod_proxy.html.ja.utf8 +++ b/docs/manual/mod/mod_proxy.html.ja.utf8 @@ -1166,7 +1166,7 @@ URL を調整する サーバに組み込まれていなければなりません。

    警告

    -

    サーバを安全にするまで ProxyRequests は有効にしないでください。 +

    サーバを安全にするまで ProxyRequests は有効にしないでください。 オープンプロキシサーバはあなた自身のネットワークにとっても、 インターネット全体にとっても危険です。

    diff --git a/docs/manual/mod/mod_proxy_uwsgi.html.en b/docs/manual/mod/mod_proxy_uwsgi.html.en index b5848d24767..f10ff0fd072 100644 --- a/docs/manual/mod/mod_proxy_uwsgi.html.en +++ b/docs/manual/mod/mod_proxy_uwsgi.html.en @@ -26,7 +26,8 @@

    Apache Module mod_proxy_uwsgi

    -

    Available Languages:  en 

    +

    Available Languages:  en  | + fr 

    @@ -82,7 +83,8 @@
    -

    Available Languages:  en 

    +

    Available Languages:  en  | + fr 

    top

    Comments

    Notice:
    This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our mailing lists.
    Description:UWSGI gateway module for mod_proxy
    Status:Extension