From: Christophe Jaillet
This module can be configured to provide several items of SSL information
-as additional environment variables to the SSI and CGI namespace. This
+as additional environment variables to the SSI and CGI namespace. Except for
+HTTPS and SSL_TLS_SNI which are always defined, this
information is not provided by default for performance reasons. (See
-SSLOptions StdEnvVars, below.) The generated variables
+SSLOptions StdEnvVars, below)
+The generated variables
are listed in the table below. For backward compatibility the information can
be made available under different names, too. Look in the Compatibility chapter for details on the
compatibility variables.
| Variable Name: | -Value Type: | -Description: | +
|---|
| Variable Name | +Value Type | +Description |
|---|---|---|
HTTPS | flag | HTTPS is being used. |
SSL_PROTOCOL | string | The SSL protocol version (SSLv3, TLSv1, TLSv1.1, TLSv1.2) |
SSL_PROTOCOL | string | The SSL protocol version (SSLv3, TLSv1, TLSv1.1, TLSv1.2) |
SSL_SESSION_ID | string | The hex-encoded SSL session id |
SSL_SESSION_RESUMED | string | Initial or Resumed SSL Session. Note: multiple requests may be served over the same (Initial or Resumed) SSL session if HTTP KeepAlive is in use |
SSL_SESSION_RESUMED | string | Initial or Resumed SSL Session. Note: multiple requests may be served over the same (Initial or Resumed) SSL session if HTTP KeepAlive is in use |
SSL_SECURE_RENEG | string | true if secure renegotiation is supported, else false |
SSL_CIPHER | string | The cipher specification name |
SSL_CIPHER | string | The cipher specification name |
SSL_CIPHER_EXPORT | string | true if cipher is an export cipher |
SSL_CIPHER_USEKEYSIZE | number | Number of cipher bits (actually used) |
SSL_CIPHER_USEKEYSIZE | number | Number of cipher bits (actually used) |
SSL_CIPHER_ALGKEYSIZE | number | Number of cipher bits (possible) |
SSL_COMPRESS_METHOD | string | SSL compression method negotiated |
SSL_COMPRESS_METHOD | string | SSL compression method negotiated |
SSL_VERSION_INTERFACE | string | The mod_ssl program version |
SSL_VERSION_LIBRARY | string | The OpenSSL program version |
SSL_VERSION_LIBRARY | string | The OpenSSL program version |
SSL_CLIENT_M_VERSION | string | The version of the client certificate |
SSL_CLIENT_M_SERIAL | string | The serial of the client certificate |
SSL_CLIENT_M_SERIAL | string | The serial of the client certificate |
SSL_CLIENT_S_DN | string | Subject DN in client's certificate |
SSL_CLIENT_S_DN_x509 | string | Component of client's Subject DN |
SSL_CLIENT_S_DN_x509 | string | Component of client's Subject DN |
SSL_CLIENT_SAN_Email_n | string | Client certificate's subjectAltName extension entries of type rfc822Name |
SSL_CLIENT_SAN_DNS_n | string | Client certificate's subjectAltName extension entries of type dNSName |
SSL_CLIENT_SAN_DNS_n | string | Client certificate's subjectAltName extension entries of type dNSName |
SSL_CLIENT_SAN_OTHER_msUPN_n | string | Client certificate's subjectAltName extension entries of type otherName, Microsoft User Principal Name form (OID 1.3.6.1.4.1.311.20.2.3) |
SSL_CLIENT_I_DN | string | Issuer DN of client's certificate |
SSL_CLIENT_I_DN | string | Issuer DN of client's certificate |
SSL_CLIENT_I_DN_x509 | string | Component of client's Issuer DN |
SSL_CLIENT_V_START | string | Validity of client's certificate (start time) |
SSL_CLIENT_V_START | string | Validity of client's certificate (start time) |
SSL_CLIENT_V_END | string | Validity of client's certificate (end time) |
SSL_CLIENT_V_REMAIN | string | Number of days until client's certificate expires |
SSL_CLIENT_V_REMAIN | string | Number of days until client's certificate expires |
SSL_CLIENT_A_SIG | string | Algorithm used for the signature of client's certificate |
SSL_CLIENT_A_KEY | string | Algorithm used for the public key of client's certificate |
SSL_CLIENT_A_KEY | string | Algorithm used for the public key of client's certificate |
SSL_CLIENT_CERT | string | PEM-encoded client certificate |
SSL_CLIENT_CERT_CHAIN_n | string | PEM-encoded certificates in client certificate chain |
SSL_CLIENT_CERT_CHAIN_n | string | PEM-encoded certificates in client certificate chain |
SSL_CLIENT_CERT_RFC4523_CEA | string | Serial number and issuer of the certificate. The format matches that of the CertificateExactAssertion in RFC4523 |
SSL_CLIENT_VERIFY | string | NONE, SUCCESS, GENEROUS or FAILED:reason |
SSL_CLIENT_VERIFY | string | NONE, SUCCESS, GENEROUS or FAILED:reason |
SSL_SERVER_M_VERSION | string | The version of the server certificate |
SSL_SERVER_M_SERIAL | string | The serial of the server certificate |
SSL_SERVER_M_SERIAL | string | The serial of the server certificate |
SSL_SERVER_S_DN | string | Subject DN in server's certificate |
SSL_SERVER_SAN_Email_n | string | Server certificate's subjectAltName extension entries of type rfc822Name |
SSL_SERVER_SAN_Email_n | string | Server certificate's subjectAltName extension entries of type rfc822Name |
SSL_SERVER_SAN_DNS_n | string | Server certificate's subjectAltName extension entries of type dNSName |
SSL_SERVER_SAN_OTHER_dnsSRV_n | string | Server certificate's subjectAltName extension entries of type otherName, SRVName form (OID 1.3.6.1.5.5.7.8.7, RFC 4985) |
SSL_SERVER_SAN_OTHER_dnsSRV_n | string | Server certificate's subjectAltName extension entries of type otherName, SRVName form (OID 1.3.6.1.5.5.7.8.7, RFC 4985) |
SSL_SERVER_S_DN_x509 | string | Component of server's Subject DN |
SSL_SERVER_I_DN | string | Issuer DN of server's certificate |
SSL_SERVER_I_DN | string | Issuer DN of server's certificate |
SSL_SERVER_I_DN_x509 | string | Component of server's Issuer DN |
SSL_SERVER_V_START | string | Validity of server's certificate (start time) |
SSL_SERVER_V_START | string | Validity of server's certificate (start time) |
SSL_SERVER_V_END | string | Validity of server's certificate (end time) |
SSL_SERVER_A_SIG | string | Algorithm used for the signature of server's certificate |
SSL_SERVER_A_SIG | string | Algorithm used for the signature of server's certificate |
SSL_SERVER_A_KEY | string | Algorithm used for the public key of server's certificate |
SSL_SERVER_CERT | string | PEM-encoded server certificate |
SSL_SERVER_CERT | string | PEM-encoded server certificate |
SSL_SRP_USER | string | SRP username |
SSL_SRP_USERINFO | string | SRP user info |
SSL_SRP_USERINFO | string | SRP user info |
SSL_TLS_SNI | string | Contents of the SNI TLS extension (if supplied with ClientHello) |
This directive can be used to control various run-time options on a
-per-directory basis. Normally, if multiple SSLOptions
+per-directory basis. Normally, if multiple SSLOptions
could apply to a directory, then the most specific one is taken
completely; the options are not merged. However if all the
-options on the SSLOptions directive are preceded by a
+options on the SSLOptions directive are preceded by a
plus (+) or minus (-) symbol, the options
are merged. Any options preceded by a + are added to the
options currently in force, and any options preceded by a
@@ -1376,8 +1376,8 @@ The available options are:
StrictRequire
- This forces forbidden access when SSLRequireSSL or
- SSLRequire successfully decided that access should be
+ This forces forbidden access when SSLRequireSSL or
+ SSLRequire successfully decided that access should be
forbidden. Usually the default is that in the case where a ``Satisfy
any'' directive is used, and other access restrictions are passed,
denial of access due to SSLRequireSSL or
diff --git a/docs/manual/mod/mod_ssl.xml.es b/docs/manual/mod/mod_ssl.xml.es
index fd2e889df6d..17622cbdce2 100644
--- a/docs/manual/mod/mod_ssl.xml.es
+++ b/docs/manual/mod/mod_ssl.xml.es
@@ -1,7 +1,7 @@
-
+
diff --git a/docs/manual/mod/mod_ssl.xml.fr b/docs/manual/mod/mod_ssl.xml.fr
index c55eba7f307..544b27307df 100644
--- a/docs/manual/mod/mod_ssl.xml.fr
+++ b/docs/manual/mod/mod_ssl.xml.fr
@@ -1,7 +1,7 @@
-
+
diff --git a/docs/manual/mod/mod_ssl.xml.meta b/docs/manual/mod/mod_ssl.xml.meta
index d50eb9de390..194507ef078 100644
--- a/docs/manual/mod/mod_ssl.xml.meta
+++ b/docs/manual/mod/mod_ssl.xml.meta
@@ -9,6 +9,6 @@