From befb52370cf75df77751393d7c3b06146c99d8a3 Mon Sep 17 00:00:00 2001
From: Joe Orton
Date: Fri, 19 Dec 2025 12:49:53 +0000
Subject: [PATCH] Regenerate docs.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1930727 13f79535-47bb-0310-9956-ffa450edef68
---
docs/manual/mod/directives.html.en.utf8 | 2 ++
docs/manual/mod/mod_md.html.en.utf8 | 40 +++++++++++++++++++++
docs/manual/mod/mod_ssl.html.en.utf8 | 36 +++++++++++--------
docs/manual/mod/quickreference.html.en.utf8 | 34 +++++++++---------
4 files changed, 81 insertions(+), 31 deletions(-)
diff --git a/docs/manual/mod/directives.html.en.utf8 b/docs/manual/mod/directives.html.en.utf8
index e9b1aad636..439f92f136 100644
--- a/docs/manual/mod/directives.html.en.utf8
+++ b/docs/manual/mod/directives.html.en.utf8
@@ -481,6 +481,7 @@
MaxThreads
MDActivationDelay
MDBaseServer
+MDCACertificateFile
MDCAChallenges
MDCertificateAgreement
MDCertificateAuthority
@@ -497,6 +498,7 @@
MDDriveMode
MDExternalAccountBinding
MDHttpProxy
+MDInitialDelay
MDMatchNames
MDMember
MDMembers
diff --git a/docs/manual/mod/mod_md.html.en.utf8 b/docs/manual/mod/mod_md.html.en.utf8
index 2b09e8c87d..c37a30c550 100644
--- a/docs/manual/mod/mod_md.html.en.utf8
+++ b/docs/manual/mod/mod_md.html.en.utf8
@@ -288,6 +288,7 @@
+
+
diff --git a/docs/manual/mod/mod_ssl.html.en.utf8 b/docs/manual/mod/mod_ssl.html.en.utf8
index c38cc65420..57c01d93fb 100644
--- a/docs/manual/mod/mod_ssl.html.en.utf8
+++ b/docs/manual/mod/mod_ssl.html.en.utf8
@@ -3045,8 +3045,8 @@ known to the server (i.e. the CA's certificate is under
| Context: | server config |
| Status: | Extension |
| Module: | mod_ssl |
|---|
-
| Compatibility: | Available in httpd 2.5 and later |
|---|
-
This directive sets policy applied when checking whether the
+
| Compatibility: | Available in httpd 2.4.66 and later |
|---|
+
This directive sets the policy applied when checking whether the
<VirtualHost>
identified by the Host request header in an HTTP request
is compatible with the <VirtualHost> identified from the SNI
@@ -3055,6 +3055,12 @@ request is associated with a virtual host which has an incompatible
SSL/TLS configuration under the policy used, an HTTP error response
with status code 421 ("Misdirected Request") will be sent.
+
The policy also applies to TLS connections where an SNI extension
+is not sent during the handshake, implicitly using the default or
+first virtual host definition. If the Host header in an HTTP request
+on such a connection identifies any other non-default virtual host,
+the compatibility policy is tested.
+
The strict policy blocks all HTTP requests which are
identified with a different virtual host to that identifed by SNI.
The insecure policy allows all HTTP requests regardless
@@ -3064,43 +3070,43 @@ of virtual host identified; such a configuration may be vulnerable to
The (default) secure, and authonly
policies compare specific aspects of the SSL configuration for the two
-virtual hosts, which are grouped into two categories:
+virtual hosts, which are grouped into two categories:
- - client vertification and authentication
- settings: directives which affect TLS client certificate
- verification or authentication, such as
SSLVerifyClient, SSLVerifyMode, SSLCACertificatePath, SSLSRPVerifierFile; any use of SSLOpenSSLConfCmd
-
- server certificate/key, or protocol/cipher
restrictions: directives which determine the server
certificate or key (
SSLCertificateKeyFile etc), cipher or
protocol restrictions (SSLCipherSuite and SSLProtocol)
+
+ - client vertification and authentication
+ settings: directives which affect TLS client certificate
+ verification or authentication, such as
SSLVerifyClient, SSLVerifyMode, SSLCACertificatePath, SSLSRPVerifierFile; any use of SSLOpenSSLConfCmd
-This table illustrates whether an HTTP request will be blocked or
+
This table illustrates whether an HTTP request will be blocked or
allowed when the virtual host configurations differ as described,
-under each different policy setting:
+under each different policy setting:
- strict | blocked | blocked | blocked |
+ strict | blocked | blocked | blocked |
- secure | allowed | blocked | blocked |
+ secure | allowed | blocked | blocked |
- authonly | allowed | blocked | allowed |
+ authonly | allowed | allowed | blocked |
- insecure | allowed | allowed | allowed |
+ insecure | allowed | allowed | allowed |
-
+
Example
SSLVHostSNIPolicy authonly
diff --git a/docs/manual/mod/quickreference.html.en.utf8 b/docs/manual/mod/quickreference.html.en.utf8
index ba83a94b9c..dae6f87d50 100644
--- a/docs/manual/mod/quickreference.html.en.utf8
+++ b/docs/manual/mod/quickreference.html.en.utf8
@@ -772,23 +772,25 @@ simultaneously
| MaxThreads number | 2048 | s | M |
| Set the maximum number of worker threads |
| MDActivationDelay duration | | s | X |
| How long to delay activation of new certificates |
| MDBaseServer on|off | off | s | X |
| Control if base server may be managed or only virtual hosts. |
-
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | X |
| Type of ACME challenge used to prove domain ownership. |
-
| MDCertificateAgreement accepted | | s | X |
| You confirm that you accepted the Terms of Service of the Certificate
+ |
| MDCACertificateFile file | none | s | X |
| File containing x509 trust anchors to verify ACME servers. |
+
| MDCAChallenges name [ name ... ] | tls-alpn-01 http-01 + | s | X |
| Type of ACME challenge used to prove domain ownership. |
+
| MDCertificateAgreement accepted | | s | X |
| You confirm that you accepted the Terms of Service of the Certificate
Authority. |
-
| MDCertificateAuthority url | letsencrypt | s | X |
| The URL(s) of the ACME Certificate Authority to use. |
-
| MDCertificateCheck name url | | s | X |
| Set name and URL pattern for a certificate monitoring site. |
-
| MDCertificateFile path-to-pem-file | | s | X |
| Specify a static certificate file for the MD. |
-
| MDCertificateKeyFile path-to-file | | s | X |
| Specify a static private key for for the static cerrtificate. |
-
| MDCertificateMonitor name url | crt.sh https://crt. + | s | X |
| The URL of a certificate log monitor. |
-
| MDCertificateProtocol protocol | ACME | s | X |
| The protocol to use with the Certificate Authority. |
-
| MDCertificateStatus on|off | on | s | X |
| Exposes public certificate information in JSON. |
-
| MDChallengeDns01 path-to-command | | s | X |
| Set the command for setup/teardown of dns-01 challenges |
-
| MDChallengeDns01Version 1|2 | 1 | s | X |
| Set the type of arguments to call MDChallengeDns01 with |
-
| MDCheckInterval duration | 12h | s | X |
| Determines how often certificates are checked |
-
| MDContactEmail address | | s | X |
| Email address used for account registration |
-
| MDDriveMode always|auto|manual | auto | s | X |
| former name of MDRenewMode. |
-
| MDExternalAccountBinding key-id hmac-64 | none | file | none | s | X |
| Set the external account binding keyid and hmac values to use at CA |
-
| MDHttpProxy url | | s | X |
| Define a proxy for outgoing connections. |
+
| MDCertificateAuthority url | letsencrypt | s | X |
| The URL(s) of the ACME Certificate Authority to use. |
+
| MDCertificateCheck name url | | s | X |
| Set name and URL pattern for a certificate monitoring site. |
+
| MDCertificateFile path-to-pem-file | | s | X |
| Specify a static certificate file for the MD. |
+
| MDCertificateKeyFile path-to-file | | s | X |
| Specify a static private key for for the static cerrtificate. |
+
| MDCertificateMonitor name url | crt.sh https://crt. + | s | X |
| The URL of a certificate log monitor. |
+
| MDCertificateProtocol protocol | ACME | s | X |
| The protocol to use with the Certificate Authority. |
+
| MDCertificateStatus on|off | on | s | X |
| Exposes public certificate information in JSON. |
+
| MDChallengeDns01 path-to-command | | s | X |
| Set the command for setup/teardown of dns-01 challenges |
+
| MDChallengeDns01Version 1|2 | 1 | s | X |
| Set the type of arguments to call MDChallengeDns01 with |
+
| MDCheckInterval duration | 12h | s | X |
| Determines how often certificates are checked |
+
| MDContactEmail address | | s | X |
| Email address used for account registration |
+
| MDDriveMode always|auto|manual | auto | s | X |
| former name of MDRenewMode. |
+
| MDExternalAccountBinding key-id hmac-64 | none | file | none | s | X |
| Set the external account binding keyid and hmac values to use at CA |
+
| MDHttpProxy url | | s | X |
| Define a proxy for outgoing connections. |
+
| MDInitialDelay duration | 0s | s | X |
| How long to delay the first certificate check. |
| MDMatchNames all|servernames | all | s | X |
| Determines how DNS names are matched to vhosts |
| MDMember hostname | | s | X |
| Additional hostname for the managed domain. |
| MDMembers auto|manual | auto | s | X |
| Control if the alias domain names are automatically added. |
--
2.47.3