From: Igor Galić Date: Tue, 21 Sep 2010 07:38:17 +0000 (+0000) Subject: Removing ``FAQs'' which are *really* out of date. X-Git-Tag: 2.3.9~474 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dec3330600fd617e8d3c0c920111eb9221b059f4;p=thirdparty%2Fapache%2Fhttpd.git Removing ``FAQs'' which are *really* out of date. Updating others to remotely match current pratice (i.e.: current Ciphers used, 1024 -> 2048 bits, etc) git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@999259 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/ssl/ssl_faq.html.en b/docs/manual/ssl/ssl_faq.html.en index 2bb3535ad25..ab2f34aa3be 100644 --- a/docs/manual/ssl/ssl_faq.html.en +++ b/docs/manual/ssl/ssl_faq.html.en @@ -345,7 +345,7 @@ Certificate for testing purposes?
  • Create a RSA private key for your Apache server (will be Triple-DES encrypted and PEM formatted):

    - $ openssl genrsa -des3 -out server.key 1024
    + $ openssl genrsa -des3 -out server.key 2048

    Please backup this server.key file and the pass-phrase you entered in a secure location. @@ -417,7 +417,7 @@ Certificate for testing purposes?
  • Create a RSA private key for your server (will be Triple-DES encrypted and PEM formatted):

    - $ openssl genrsa -des3 -out server.key 1024
    + $ openssl genrsa -des3 -out server.key 2048

    Please backup this host.key file and the pass-phrase you entered in a secure location. @@ -528,17 +528,8 @@ Certificate for testing purposes?

    $ openssl req -noout -modulus -in server.csr | openssl md5

    -

    Why do connections fail with an "alert -bad certificate" error?

    -

    Errors such as OpenSSL: error:14094412: SSL - routines:SSL3_READ_BYTES:sslv3 alert bad certificate in the SSL - logfile, are usually caused by a browser which is unable to handle the server - certificate/private-key. For example, Netscape Navigator 3.x is - unable to handle RSA key lengths not equal to 1024 bits.

    - -

    How can I convert a certificate from PEM to DER format?

    -

    The default certificate format for SSLeay/OpenSSL is PEM, which is simply +

    The default certificate format for OpenSSL is PEM, which is simply Base64 encoded DER, with header and footer lines. For some applications (e.g. Microsoft Internet Explorer) you need the certificate in plain DER format. You can convert a PEM file cert.pem into the @@ -583,9 +574,6 @@ Does this mean the username/password is being sent unencrypted?

  • Why do I get I/O errors when connecting via HTTPS to an Apache+mod_ssl server with Microsoft Internet Explorer (MSIE)?
    • -
  • Why do I get I/O errors, or the message "Netscape has -encountered bad data from the server", when connecting via -HTTPS to an Apache+mod_ssl server with Netscape Navigator?

    • Why do I get lots of random SSL protocol @@ -622,13 +610,9 @@ sometimes take up to 30 seconds to establish a connection?

    least the following ciphers are supported:

      -
    1. RC4 with MD5
      2. -
    2. RC4 with MD5 (export version restricted to 40-bit key)
      3. -
    3. RC2 with MD5
      4. -
    4. RC2 with MD5 (export version restricted to 40-bit key)
      5. -
    5. IDEA with MD5
      6. -
    6. DES with MD5
      7. -
    7. Triple-DES with MD5
      8. +
    8. RC4 with SHA1
      9. +
    9. AES with SHA1
      10. +
    10. Triple-DES with SHA1

    To determine the actual list of ciphers available, you should run @@ -651,7 +635,7 @@ error when connecting to my newly installed server?

    Either you have made a mistake with your SSLCipherSuite directive (compare it with the pre-configured example in - httpd.conf-dist) or you chose to use DSA/DH + extra/httpd-ssl.conf) or you chose to use DSA/DH algorithms instead of RSA when you generated your private key and ignored or overlooked the warnings. If you have chosen DSA/DH, then your server cannot communicate using RSA-based SSL @@ -777,47 +761,6 @@ HTTPS to an Apache+mod_ssl server with Microsoft Internet Explorer (MSIE)?all your clients, MSIE or otherwise.

    -

    The next problem is that 56bit export versions of MSIE 5.x - browsers have a broken SSLv3 implementation, which interacts badly - with OpenSSL versions greater than 0.9.4. You can accept this and - require your clients to upgrade their browsers, you can downgrade to - OpenSSL 0.9.4 (not advised), or you can work around this, accepting - that your workaround will affect other browsers too:

    -

    SSLProtocol all -SSLv3

    -

    will completely disables the SSLv3 protocol and allow those - browsers to work. A better workaround is to disable only those - ciphers which cause trouble.

    -

    SSLCipherSuite - ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP -

    - -

    This also allows the broken MSIE versions to work, but only removes the - newer 56bit TLS ciphers.

    - -

    Another problem with MSIE 5.x clients is that they refuse to connect to - URLs of the form https://12.34.56.78/ (where IP-addresses are used - instead of the hostname), if the server is using the Server Gated - Cryptography (SGC) facility. This can only be avoided by using the fully - qualified domain name (FQDN) of the website in hyperlinks instead, because - MSIE 5.x has an error in the way it handles the SGC negotiation.

    - -

    And finally there are versions of MSIE which seem to require that - an SSL session can be reused (a totally non-standard-conforming - behaviour, of course). Connecting with those MSIE versions only work - if a SSL session cache is used. So, as a work-around, make sure you - are using a session cache (see the SSLSessionCache directive).

    - - -

    Why do I get I/O errors, or the message "Netscape has -encountered bad data from the server", when connecting via -HTTPS to an Apache+mod_ssl server with Netscape Navigator?

    -

    - This usually occurs when you have created a new server certificate for - a given domain, but had previously told your browser to always accept - the old server certificate. Once you clear the entry for the old - certificate from your browser, everything should be fine. Netscape's SSL - implementation is correct, so when you encounter I/O errors with Netscape - Navigator it is usually caused by the configured certificates.

    top
    @@ -846,11 +789,6 @@ for my core dump? one, it may have been answered several times before, and been included in this doc. -
    Postings from the modssl-users Support Mailing List - http://www.modssl.org/support/
    -
    Search for your problem in the archives of the modssl-users mailing list. - You're probably not the first person to have had this problem! -
    @@ -860,14 +798,6 @@ of mod_ssl problems? preference. Please go through these possibilities in this order - don't just pick the one you like the look of.

      -
    1. Send a Problem Report to the modssl-users Support Mailing List
      - - modssl-users@modssl.org
      - This is the preferred way of submitting your problem report, because this way, - others can see the problem, and learn from any answers. You must subscribe to - the list first, but you can then easily discuss your problem with both the - author and the whole mod_ssl user community. -
    2. Send a Problem Report to the Apache httpd Users Support Mailing List
      @@ -892,7 +822,7 @@ provide when writing a bug report?

      You should always provide at least the following information:

      -
      Apache and OpenSSL version information
      +
      Apache httpd and OpenSSL version information
      The Apache version can be determined by running httpd -v. The OpenSSL version can be determined by running openssl version. Alternatively, if @@ -901,14 +831,14 @@ provide when writing a bug report? single step.
      -
      The details on how you built and installed Apache+mod_ssl+OpenSSL
      +
      The details on how you built and installed Apache httpd and OpenSSL
      For this you can provide a logfile of your terminal session which shows the configuration and install steps. If this is not possible, you should at least provide the configure command line you used.
      In case of core dumps please include a Backtrace
      -
      If your Apache+mod_ssl+OpenSSL dumps its core, please attach +
      If your Apache httpd dumps its core, please attach a stack-frame ``backtrace'' (see below for information on how to get this). This information is required in order to find a reason for your core dump. diff --git a/docs/manual/ssl/ssl_faq.xml b/docs/manual/ssl/ssl_faq.xml index 4d5c2e39d08..1081da7445c 100644 --- a/docs/manual/ssl/ssl_faq.xml +++ b/docs/manual/ssl/ssl_faq.xml @@ -351,7 +351,7 @@ Certificate for testing purposes?
    3. Create a RSA private key for your Apache server (will be Triple-DES encrypted and PEM formatted):

      - $ openssl genrsa -des3 -out server.key 1024
      + $ openssl genrsa -des3 -out server.key 2048

      Please backup this server.key file and the pass-phrase you entered in a secure location. @@ -423,7 +423,7 @@ Certificate for testing purposes?
    4. Create a RSA private key for your server (will be Triple-DES encrypted and PEM formatted):

      - $ openssl genrsa -des3 -out server.key 1024
      + $ openssl genrsa -des3 -out server.key 2048

      Please backup this host.key file and the pass-phrase you entered in a secure location. @@ -534,17 +534,8 @@ Certificate for testing purposes?

      $ openssl req -noout -modulus -in server.csr | openssl md5

      -
      Why do connections fail with an "alert -bad certificate" error? -

      Errors such as OpenSSL: error:14094412: SSL - routines:SSL3_READ_BYTES:sslv3 alert bad certificate in the SSL - logfile, are usually caused by a browser which is unable to handle the server - certificate/private-key. For example, Netscape Navigator 3.x is - unable to handle RSA key lengths not equal to 1024 bits.

      -
      -
      How can I convert a certificate from PEM to DER format? -

      The default certificate format for SSLeay/OpenSSL is PEM, which is simply +

      The default certificate format for OpenSSL is PEM, which is simply Base64 encoded DER, with header and footer lines. For some applications (e.g. Microsoft Internet Explorer) you need the certificate in plain DER format. You can convert a PEM file cert.pem into the @@ -590,9 +581,6 @@ Does this mean the username/password is being sent unencrypted?

    5. Why do I get I/O errors when connecting via HTTPS to an Apache+mod_ssl server with Microsoft Internet Explorer (MSIE)?
      6. -
    6. Why do I get I/O errors, or the message "Netscape has -encountered bad data from the server", when connecting via -HTTPS to an Apache+mod_ssl server with Netscape Navigator?
      7. Why do I get lots of random SSL protocol @@ -629,13 +617,9 @@ sometimes take up to 30 seconds to establish a connection? least the following ciphers are supported:

        -
      1. RC4 with MD5
        2. -
      2. RC4 with MD5 (export version restricted to 40-bit key)
        3. -
      3. RC2 with MD5
        4. -
      4. RC2 with MD5 (export version restricted to 40-bit key)
        5. -
      5. IDEA with MD5
        6. -
      6. DES with MD5
        7. -
      7. Triple-DES with MD5
        8. +
      8. RC4 with SHA1
        9. +
      9. AES with SHA1
        10. +
      10. Triple-DES with SHA1

      To determine the actual list of ciphers available, you should run @@ -659,7 +643,7 @@ error when connecting to my newly installed server?

      Either you have made a mistake with your SSLCipherSuite directive (compare it with the pre-configured example in - httpd.conf-dist) or you chose to use DSA/DH + extra/httpd-ssl.conf) or you chose to use DSA/DH algorithms instead of RSA when you generated your private key and ignored or overlooked the warnings. If you have chosen DSA/DH, then your server cannot communicate using RSA-based SSL @@ -784,50 +768,8 @@ HTTPS to an Apache+mod_ssl server with Microsoft Internet Explorer (MSIE)?all your clients, MSIE or otherwise.

      - -

      The next problem is that 56bit export versions of MSIE 5.x - browsers have a broken SSLv3 implementation, which interacts badly - with OpenSSL versions greater than 0.9.4. You can accept this and - require your clients to upgrade their browsers, you can downgrade to - OpenSSL 0.9.4 (not advised), or you can work around this, accepting - that your workaround will affect other browsers too:

      - SSLProtocol all -SSLv3 -

      will completely disables the SSLv3 protocol and allow those - browsers to work. A better workaround is to disable only those - ciphers which cause trouble.

      -

      SSLCipherSuite - ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP -

      - -

      This also allows the broken MSIE versions to work, but only removes the - newer 56bit TLS ciphers.

      - -

      Another problem with MSIE 5.x clients is that they refuse to connect to - URLs of the form https://12.34.56.78/ (where IP-addresses are used - instead of the hostname), if the server is using the Server Gated - Cryptography (SGC) facility. This can only be avoided by using the fully - qualified domain name (FQDN) of the website in hyperlinks instead, because - MSIE 5.x has an error in the way it handles the SGC negotiation.

      - -

      And finally there are versions of MSIE which seem to require that - an SSL session can be reused (a totally non-standard-conforming - behaviour, of course). Connecting with those MSIE versions only work - if a SSL session cache is used. So, as a work-around, make sure you - are using a session cache (see the SSLSessionCache directive).

      -
      Why do I get I/O errors, or the message "Netscape has -encountered bad data from the server", when connecting via -HTTPS to an Apache+mod_ssl server with Netscape Navigator? -

      - This usually occurs when you have created a new server certificate for - a given domain, but had previously told your browser to always accept - the old server certificate. Once you clear the entry for the old - certificate from your browser, everything should be fine. Netscape's SSL - implementation is correct, so when you encounter I/O errors with Netscape - Navigator it is usually caused by the configured certificates.

      -
      @@ -856,12 +798,6 @@ for my core dump?
      7. one, it may have been answered several times before, and been included in this doc. -
      Postings from the modssl-users Support Mailing List - http://www.modssl.org/support/
      -
      Search for your problem in the archives of the modssl-users mailing list. - You're probably not the first person to have had this problem! -
      @@ -871,14 +807,6 @@ of mod_ssl problems? preference. Please go through these possibilities in this order - don't just pick the one you like the look of.

        -
      1. Send a Problem Report to the modssl-users Support Mailing List
        - - modssl-users@modssl.org
        - This is the preferred way of submitting your problem report, because this way, - others can see the problem, and learn from any answers. You must subscribe to - the list first, but you can then easily discuss your problem with both the - author and the whole mod_ssl user community. -
      2. Send a Problem Report to the Apache httpd Users Support Mailing List
        @@ -903,7 +831,7 @@ provide when writing a bug report?

        You should always provide at least the following information:

        -
        Apache and OpenSSL version information
        +
        Apache httpd and OpenSSL version information
        The Apache version can be determined by running httpd -v. The OpenSSL version can be determined by running openssl version. Alternatively, if @@ -912,14 +840,14 @@ provide when writing a bug report? single step.
        -
        The details on how you built and installed Apache+mod_ssl+OpenSSL
        +
        The details on how you built and installed Apache httpd and OpenSSL
        For this you can provide a logfile of your terminal session which shows the configuration and install steps. If this is not possible, you should at least provide the configure command line you used.
        In case of core dumps please include a Backtrace
        -
        If your Apache+mod_ssl+OpenSSL dumps its core, please attach +
        If your Apache httpd dumps its core, please attach a stack-frame ``backtrace'' (see below for information on how to get this). This information is required in order to find a reason for your core dump.