mod_ssl: Document that SSLStaplingReturnResponderErrors off still returns revoked...

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1933788 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml
index f1c813ce908123745c5575be70e48c416e0094b5..f08d83fbf483c2dbd68172daf59429b5c957cd6f 100644 (file)
--- a/docs/manual/mod/mod_ssl.xml
+++ b/docs/manual/mod/mod_ssl.xml
@@ -2954,7 +2954,10 @@ stapling related OCSP queries (such as responses with an overall status
 other than "successful", responses with a certificate status other than
 "good", expired responses etc.) on to the client.
 If set to <code>off</code>, only responses indicating a certificate status
-of "good" will be included in the TLS handshake.</p>
+of "good" or "revoked" will be included in the TLS handshake.
+Responses with a "revoked" status are always included regardless of
+this setting, because suppressing a known revocation would be a
+security risk.</p>
 </usage>
 </directivesynopsis>