From: Joe Orton <jorton@apache.org>
Date: Wed, 10 Jun 2026 17:01:40 +0000 (+0000)
Subject: * modules/md/mod_md_config.c: Flip MDServerStatus to disabled by
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=a5a759746b2516ead99ce4da1502741709eb4132;p=thirdparty%2Fapache%2Fhttpd.git

* modules/md/mod_md_config.c: Flip MDServerStatus to disabled by
  default.

* docs/manual/mod/mod_md.xml: Update accordingly.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935184 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/changes-entries/md-status.txt b/changes-entries/md-status.txt
new file mode 100644
index 0000000000..cf6d627658
--- /dev/null
+++ b/changes-entries/md-status.txt
@@ -0,0 +1,3 @@
+  *) mod_md: MDServerStatus is now disabled by default.  [Joe Orton]
+
+
diff --git a/docs/manual/mod/mod_md.xml b/docs/manual/mod/mod_md.xml
index fe5be655af..7decbb502b 100644
--- a/docs/manual/mod/mod_md.xml
+++ b/docs/manual/mod/mod_md.xml
@@ -1114,17 +1114,20 @@ MDMessageCmd /etc/apache/md-message
         <name>MDServerStatus</name>
         <description>Control if Managed Domain information is added to <code>server-status</code>.</description>
         <syntax>MDServerStatus on|off</syntax>
-        <default>MDServerStatus on</default>
+        <default>MDServerStatus off</default>
         <contextlist>
             <context>server config</context>
         </contextlist>
         <usage>
             <p>
-                Apaches '<code>server-status</code>' handler allows you configure a resource to monitor
-                what is going on. This includes now a section listing all Managed Domains
-                with the DNS names, renewal status, lifetimes and main properties.
+                If enabled, adds a section to the
+                <module>mod_status</module> '<code>server-status</code>' handler
+                output which lists all Managed Domains with the DNS
+                names, renewal status, lifetimes and main properties.
             </p><p>
-                You can switch that off using this directive.
+                As with '<code>md-status</code>', the '<code>server-status</code>' output
+                <strong>must</strong> be protected from public view
+                using appropriate authorization restrictions.
             </p>
         </usage>
     </directivesynopsis>
diff --git a/modules/md/mod_md_config.c b/modules/md/mod_md_config.c
index 9688714537..fa118201ed 100644
--- a/modules/md/mod_md_config.c
+++ b/modules/md/mod_md_config.c
@@ -77,7 +77,7 @@ static md_mod_conf_t defmc = {
     NULL,                      /* message cmd */
     NULL,                      /* env table */
     0,                         /* dry_run flag */
-    1,                         /* server_status_enabled */
+    0,                         /* server_status_enabled */
     1,                         /* certificate_status_enabled */
     &def_ocsp_keep_window,     /* default time to keep ocsp responses */
     &def_ocsp_renew_window,    /* default time to renew ocsp responses */