From: Jeff Trawick Date: Sat, 3 May 2014 13:43:14 +0000 (+0000) Subject: Fill in various blurry areas reported on the certificate-transparency X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e1d21f4fb527da83747ed62a32400e38cf77fb3f;p=thirdparty%2Fapache%2Fhttpd.git Fill in various blurry areas reported on the certificate-transparency forum. Fix a minor formatting glitch with the attempt to show shell escaping for a hash sign. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1592205 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_ssl_ct.xml b/docs/manual/mod/mod_ssl_ct.xml index d8b76b5904e..ca76549774e 100644 --- a/docs/manual/mod/mod_ssl_ct.xml +++ b/docs/manual/mod/mod_ssl_ct.xml @@ -433,12 +433,20 @@ ServerHello

Each of the six fields must be specified, but usually only a small amount of information must be configured for each log; use - when no - information is available for the field. The fields are defined as follows:

+ information is available for the field. For example, in support of a + server-only configuration (i.e., no proxy), the administrator might + configure only the log URL to be used when submitting server certificates + and obtaining a Signed Certificate Timestamp.

+ +

The fields are defined as follows:

log-id
This is the id of the log, which is the SHA-256 hash of the log's - public key.
+ public key, provided in hexadecimal format. This string is 64 characters + in length. +
+ This field should be omitted when public-key-file is provided.
public-key-file
This is the name of a file containing the PEM encoding of the log's @@ -447,15 +455,20 @@ ServerHello
trust
This is a generic trust flag. Set this field to 0 to - distrust this log.
- -
min-timestamp
-
SCTs received from this log by the proxy are invalid if the timestamp - is older than this value.
+ distrust this log, or to otherwise avoid using it for server certificate + submission. -
max-timestamp
-
SCTs received from this log by the proxy are invalid if the timestamp - is newer than this value.
+
min-timestamp and max-timestamp
+
A timestamp is a time as expressed in the number of milliseconds since the + epoch, ignoring leap seconds. This is the form of time used in Signed Certificate + Timestamps. This must be provided as a decimal number. +
+ Specify - for one of the timestamps if it is unknown. + For example, when configuring the minimum valid timestamp for a log which remains + valid, specify - for max-timestamp. +
+ SCTs received from this log by the proxy are invalid if the timestamp + is older than min-timestamp or newer than max-timestamp.
log-URL
This is the URL of the log, for use in submitting server certificates diff --git a/docs/manual/programs/ctlogconfig.xml b/docs/manual/programs/ctlogconfig.xml index 95f48b484e9..87fd2536900 100644 --- a/docs/manual/programs/ctlogconfig.xml +++ b/docs/manual/programs/ctlogconfig.xml @@ -26,8 +26,8 @@ ctlogconfig - Certificate Transparency log configuration tool -

ctlogconfig is a tool for maintaining a log configuration - database, for use with mod_ssl_ct.

+

ctlogconfig is a tool for creating and maintaining a log + configuration database, for use with mod_ssl_ct.

Refer first to Log configuration in the mod_ssl_ct documentation.

@@ -76,6 +76,36 @@ log-id|record-id

+
+
log-id
+
This is the id of the log, which is the SHA-256 hash of the log's public key, + provided in hexadecimal format. This string is 64 characters in length.
+ +
record-id
+
This is the record number in the database, as displayed by the dump + sub-command, prefixed with #. As an example, #4 + references the fourth record in the database. (Use shell escaping as necessary.)
+ +
/path/to/public-key.pem
+
This is a file containing the log's public key in PEM format. The public + key is not stored in the database. Instead, a reference to the file is stored. + Thus, the file cannot be removed until the public key in the database is removed + or changed.
+ +
min-timestamp, max-timestamp
+
A timestamp is a time as expressed in the number of milliseconds since the + epoch, ignoring leap seconds. This is the form of time used in Signed Certificate + Timestamps. This must be provided as a decimal number. +
+ Specify - for one of the timestamps if it is unknown. + For example, when configuring the minimum valid timestamp for a log which remains + valid, specify - for max-timestamp. +
+ SCTs received from this log by the proxy are invalid if the timestamp + is older than min-timestamp or newer than max-timestamp.
+ +
+
@@ -89,24 +119,29 @@
configure-public-key
Add a log's public key to the database or set the public key for an existing entry. The log's public key is needed to validate the signature - of SCTs received by a proxy from a backend server.
+ of SCTs received by a proxy from a backend server. (The database will + be created if it does not yet exist.)
configure-url
Add a log's URL to the database or set the URL for an existing entry. The log's URL is used when submitting server certificates to logs in - order to obtain SCTs to send to clients.
+ order to obtain SCTs to send to clients. (The database will + be created if it does not yet exist.)
valid-time-range
Set the minimum valid time and/or the maximum valid time for a log. SCTs from the log with timestamps outside of the valid range will not be - accepted. Use - for a time that is not being configured.
+ accepted. Use - for a time that is not being configured. + (The database will be created if it does not yet exist.)
trust
Mark a log as trusted, which is the default setting. This sub-command - is used to reverse a distrust setting.
+ is used to reverse a distrust setting. (The database will + be created if it does not yet exist.)
distrust
-
Mark a log as distrusted.
+
Mark a log as distrusted. (The database will be created if it does + not yet exist.)
forget
Remove information about a log from the database.
@@ -147,7 +182,7 @@ http://log2.example.com/ which has already been configured.

- $ ctlogconfig /path/to/conf/log-config configure-public-key \\#2 /path/to/conf/log2-pub.pem
+ $ ctlogconfig /path/to/conf/log-config configure-public-key \#2 /path/to/conf/log2-pub.pem
$ ctlogconfig /path/to/conf/log-config dump
Log entry:
Record 1