| <?xml version="1.0" encoding="ISO-8859-1"?> |
| <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> |
| <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head> |
| <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" /> |
| <!-- |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX |
| This file is generated from xml source: DO NOT EDIT |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX |
| --> |
| <title>mod_ssl - Apache HTTP Server Version 2.2</title> |
| <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> |
| <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> |
| <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" /> |
| <script src="../style/scripts/prettify.min.js" type="text/javascript"> |
| </script> |
| |
| <link href="../images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/mod/mod_ssl.html" rel="canonical" /></head> |
| <body> |
| <div id="page-header"> |
| <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p> |
| <p class="apache">Apache HTTP Server Version 2.2</p> |
| <img alt="" src="../images/feather.gif" /></div> |
| <div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div> |
| <div id="path"> |
| <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.2</a> > <a href="./">Modules</a></div> |
| <div id="page-content"> |
| <div class="retired"><h4>Please note</h4> |
| <p>This document refers to the <strong>2.2</strong> version of Apache httpd, which is no longer maintained. The active release is documented <a href="http://httpd.apache.org/docs/current">here</a>. If you have not already upgraded, please follow <a href="http://httpd.apache.org/docs/current/upgrading.html">this link</a> for more information.</p> |
| <p>You may follow <a href="http://httpd.apache.org/docs/current/mod/mod_ssl.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Apache Module mod_ssl</h1> |
| <div class="toplang"> |
| <p><span>Available Languages: </span><a href="../en/mod/mod_ssl.html" title="English"> en </a></p> |
| </div> |
| <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Strong cryptography using the Secure Sockets |
| Layer (SSL) and Transport Layer Security (TLS) protocols</td></tr> |
| <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>ssl_module</td></tr> |
| <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_ssl.c</td></tr></table> |
| <h3>Summary</h3> |
| |
| <p>This module provides SSL v2/v3 and TLS v1 support for the Apache |
| HTTP Server. It was contributed by Ralf S. Engeschall based on his |
| mod_ssl project and originally derived from work by Ben Laurie.</p> |
| |
| <p>This module relies on <a href="http://www.openssl.org/">OpenSSL</a> |
| to provide the cryptography engine.</p> |
| |
| <p>Further details, discussion, and examples are provided in the |
| <a href="../ssl/">SSL documentation</a>.</p> |
| </div> |
| <div id="quickview"><h3>Topics</h3> |
| <ul id="topics"> |
| <li><img alt="" src="../images/down.gif" /> <a href="#envvars">Environment Variables</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#logformats">Custom Log Formats</a></li> |
| </ul><h3 class="directives">Directives</h3> |
| <ul id="toc"> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcacertificatefile">SSLCACertificateFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcacertificatepath">SSLCACertificatePath</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcadnrequestfile">SSLCADNRequestFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcadnrequestpath">SSLCADNRequestPath</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcarevocationfile">SSLCARevocationFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcarevocationpath">SSLCARevocationPath</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcertificatechainfile">SSLCertificateChainFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcertificatefile">SSLCertificateFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslciphersuite">SSLCipherSuite</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcompression">SSLCompression</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslcryptodevice">SSLCryptoDevice</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslengine">SSLEngine</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslfips">SSLFIPS</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslhonorcipherorder">SSLHonorCipherOrder</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslinsecurerenegotiation">SSLInsecureRenegotiation</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslmutex">SSLMutex</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#ssloptions">SSLOptions</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslpassphrasedialog">SSLPassPhraseDialog</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslprotocol">SSLProtocol</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycacertificatefile">SSLProxyCACertificateFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycacertificatepath">SSLProxyCACertificatePath</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycarevocationfile">SSLProxyCARevocationFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycarevocationpath">SSLProxyCARevocationPath</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycheckpeercn">SSLProxyCheckPeerCN</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycheckpeerexpire">SSLProxyCheckPeerExpire</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyciphersuite">SSLProxyCipherSuite</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyengine">SSLProxyEngine</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxymachinecertificatechainfile">SSLProxyMachineCertificateChainFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxymachinecertificatefile">SSLProxyMachineCertificateFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxymachinecertificatepath">SSLProxyMachineCertificatePath</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyprotocol">SSLProxyProtocol</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyverify">SSLProxyVerify</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyverifydepth">SSLProxyVerifyDepth</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslrandomseed">SSLRandomSeed</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslrenegbuffersize">SSLRenegBufferSize</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslrequire">SSLRequire</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslrequiressl">SSLRequireSSL</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslsessioncache">SSLSessionCache</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslsessioncachetimeout">SSLSessionCacheTimeout</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslsessionticketkeyfile">SSLSessionTicketKeyFile</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslsessiontickets">SSLSessionTickets</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslstrictsnivhostcheck">SSLStrictSNIVHostCheck</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslusername">SSLUserName</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslverifyclient">SSLVerifyClient</a></li> |
| <li><img alt="" src="../images/down.gif" /> <a href="#sslverifydepth">SSLVerifyDepth</a></li> |
| </ul> |
| <ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="section"> |
| <h2><a name="envvars" id="envvars">Environment Variables</a></h2> |
| |
| <p>This module can be configured to provide several items of SSL information |
| as additional environment variables to the SSI and CGI namespace. This |
| information is not provided by default for performance reasons. (See |
| <code class="directive">SSLOptions</code> StdEnvVars, below.) The generated variables |
| are listed in the table below. For backward compatibility the information can |
| be made available under different names, too. Look in the <a href="../ssl/ssl_compat.html">Compatibility</a> chapter for details on the |
| compatibility variables.</p> |
| |
| <table class="bordered"> |
| |
| <tr> |
| <th><a name="table3">Variable Name:</a></th> |
| <th>Value Type:</th> |
| <th>Description:</th> |
| </tr> |
| <tr><td><code>HTTPS</code></td> <td>flag</td> <td>HTTPS is being used.</td></tr> |
| <tr><td><code>SSL_PROTOCOL</code></td> <td>string</td> <td>The SSL protocol version (SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2)</td></tr> |
| <tr><td><code>SSL_SESSION_ID</code></td> <td>string</td> <td>The hex-encoded SSL session id</td></tr> |
| <tr><td><code>SSL_CIPHER</code></td> <td>string</td> <td>The cipher specification name</td></tr> |
| <tr><td><code>SSL_CIPHER_EXPORT</code></td> <td>string</td> <td><code>true</code> if cipher is an export cipher</td></tr> |
| <tr><td><code>SSL_CIPHER_USEKEYSIZE</code></td> <td>number</td> <td>Number of cipher bits (actually used)</td></tr> |
| <tr><td><code>SSL_CIPHER_ALGKEYSIZE</code></td> <td>number</td> <td>Number of cipher bits (possible)</td></tr> |
| <tr><td><code>SSL_COMPRESS_METHOD</code></td> <td>string</td> <td>SSL compression method negotiated</td></tr> |
| <tr><td><code>SSL_VERSION_INTERFACE</code></td> <td>string</td> <td>The mod_ssl program version</td></tr> |
| <tr><td><code>SSL_VERSION_LIBRARY</code></td> <td>string</td> <td>The OpenSSL program version</td></tr> |
| <tr><td><code>SSL_CLIENT_M_VERSION</code></td> <td>string</td> <td>The version of the client certificate</td></tr> |
| <tr><td><code>SSL_CLIENT_M_SERIAL</code></td> <td>string</td> <td>The serial of the client certificate</td></tr> |
| <tr><td><code>SSL_CLIENT_S_DN</code></td> <td>string</td> <td>Subject DN in client's certificate</td></tr> |
| <tr><td><code>SSL_CLIENT_S_DN_</code><em>x509</em></td> <td>string</td> <td>Component of client's Subject DN</td></tr> |
| <tr><td><code>SSL_CLIENT_I_DN</code></td> <td>string</td> <td>Issuer DN of client's certificate</td></tr> |
| <tr><td><code>SSL_CLIENT_I_DN_</code><em>x509</em></td> <td>string</td> <td>Component of client's Issuer DN</td></tr> |
| <tr><td><code>SSL_CLIENT_V_START</code></td> <td>string</td> <td>Validity of client's certificate (start time)</td></tr> |
| <tr><td><code>SSL_CLIENT_V_END</code></td> <td>string</td> <td>Validity of client's certificate (end time)</td></tr> |
| <tr><td><code>SSL_CLIENT_V_REMAIN</code></td> <td>string</td> <td>Number of days until client's certificate expires</td></tr> |
| <tr><td><code>SSL_CLIENT_A_SIG</code></td> <td>string</td> <td>Algorithm used for the signature of client's certificate</td></tr> |
| <tr><td><code>SSL_CLIENT_A_KEY</code></td> <td>string</td> <td>Algorithm used for the public key of client's certificate</td></tr> |
| <tr><td><code>SSL_CLIENT_CERT</code></td> <td>string</td> <td>PEM-encoded client certificate</td></tr> |
| <tr><td><code>SSL_CLIENT_CERT_CHAIN_</code><em>n</em></td> <td>string</td> <td>PEM-encoded certificates in client certificate chain</td></tr> |
| <tr><td><code>SSL_CLIENT_VERIFY</code></td> <td>string</td> <td><code>NONE</code>, <code>SUCCESS</code>, <code>GENEROUS</code> or <code>FAILED:</code><em>reason</em></td></tr> |
| <tr><td><code>SSL_SERVER_M_VERSION</code></td> <td>string</td> <td>The version of the server certificate</td></tr> |
| <tr><td><code>SSL_SERVER_M_SERIAL</code></td> <td>string</td> <td>The serial of the server certificate</td></tr> |
| <tr><td><code>SSL_SERVER_S_DN</code></td> <td>string</td> <td>Subject DN in server's certificate</td></tr> |
| <tr><td><code>SSL_SERVER_S_DN_</code><em>x509</em></td> <td>string</td> <td>Component of server's Subject DN</td></tr> |
| <tr><td><code>SSL_SERVER_I_DN</code></td> <td>string</td> <td>Issuer DN of server's certificate</td></tr> |
| <tr><td><code>SSL_SERVER_I_DN_</code><em>x509</em></td> <td>string</td> <td>Component of server's Issuer DN</td></tr> |
| <tr><td><code>SSL_SERVER_V_START</code></td> <td>string</td> <td>Validity of server's certificate (start time)</td></tr> |
| <tr><td><code>SSL_SERVER_V_END</code></td> <td>string</td> <td>Validity of server's certificate (end time)</td></tr> |
| <tr><td><code>SSL_SERVER_A_SIG</code></td> <td>string</td> <td>Algorithm used for the signature of server's certificate</td></tr> |
| <tr><td><code>SSL_SERVER_A_KEY</code></td> <td>string</td> <td>Algorithm used for the public key of server's certificate</td></tr> |
| <tr><td><code>SSL_SERVER_CERT</code></td> <td>string</td> <td>PEM-encoded server certificate</td></tr> |
| <tr><td><code>SSL_TLS_SNI</code></td> <td>string</td> <td>Contents of the SNI TLS extension (if supplied with ClientHello)</td></tr> |
| </table> |
| |
| <p><em>x509</em> specifies a component of an X.509 DN; one of |
| <code>C,ST,L,O,OU,CN,T,I,G,S,D,UID,Email</code>. In Apache 2.1 and |
| later, <em>x509</em> may also include a numeric <code>_n</code> |
| suffix. If the DN in question contains multiple attributes of the |
| same name, this suffix is used as an index to select a particular |
| attribute. For example, where the server certificate subject DN |
| included two OU fields, <code>SSL_SERVER_S_DN_OU_0</code> and |
| <code>SSL_SERVER_S_DN_OU_1</code> could be used to reference each.</p> |
| |
| <p><code>SSL_CLIENT_V_REMAIN</code> is only available in version 2.1 |
| and later.</p> |
| |
| </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="section"> |
| <h2><a name="logformats" id="logformats">Custom Log Formats</a></h2> |
| |
| <p>When <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> is built into Apache or at least |
| loaded (under DSO situation) additional functions exist for the <a href="mod_log_config.html#formats">Custom Log Format</a> of |
| <code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code>. First there is an |
| additional ``<code>%{</code><em>varname</em><code>}x</code>'' |
| eXtension format function which can be used to expand any variables |
| provided by any module, especially those provided by mod_ssl which can |
| you find in the above table.</p> |
| <p> |
| For backward compatibility there is additionally a special |
| ``<code>%{</code><em>name</em><code>}c</code>'' cryptography format function |
| provided. Information about this function is provided in the <a href="../ssl/ssl_compat.html">Compatibility</a> chapter.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| CustomLog logs/ssl_request_log \ |
| "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" |
| </code></p></div> |
| <p>These formats even work without setting the <code>StdEnvVars</code> |
| option of the <code class="directive"><a href="#ssloptions">SSLOptions</a></code> |
| directive.</p> |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCACertificateFile" id="SSLCACertificateFile">SSLCACertificateFile</a> <a name="sslcacertificatefile" id="sslcacertificatefile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA Certificates |
| for Client Auth</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCACertificateFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the <em>all-in-one</em> file where you can assemble the |
| Certificates of Certification Authorities (CA) whose <em>clients</em> you deal |
| with. These are used for Client Authentication. Such a file is simply the |
| concatenation of the various PEM-encoded Certificate files, in order of |
| preference. This can be used alternatively and/or additionally to |
| <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code>.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCACertificateFile /usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCACertificatePath" id="SSLCACertificatePath">SSLCACertificatePath</a> <a name="sslcacertificatepath" id="sslcacertificatepath">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA Certificates for |
| Client Auth</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCACertificatePath <em>directory-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the directory where you keep the Certificates of |
| Certification Authorities (CAs) whose clients you deal with. These are used to |
| verify the client certificate on Client Authentication.</p> |
| <p> |
| The files in this directory have to be PEM-encoded and are accessed through |
| hash filenames. So usually you can't just place the Certificate files |
| there: you also have to create symbolic links named |
| <em>hash-value</em><code>.N</code>. And you should always make sure this directory |
| contains the appropriate symbolic links.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCACertificatePath /usr/local/apache2/conf/ssl.crt/ |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCADNRequestFile" id="SSLCADNRequestFile">SSLCADNRequestFile</a> <a name="sslcadnrequestfile" id="sslcadnrequestfile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA Certificates |
| for defining acceptable CA names</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCADNRequestFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p>When a client certificate is requested by mod_ssl, a list of |
| <em>acceptable Certificate Authority names</em> is sent to the client |
| in the SSL handshake. These CA names can be used by the client to |
| select an appropriate client certificate out of those it has |
| available.</p> |
| |
| <p>If neither of the directives <code class="directive"><a href="#sslcadnrequestpath">SSLCADNRequestPath</a></code> or <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code> are given, then the |
| set of acceptable CA names sent to the client is the names of all the |
| CA certificates given by the <code class="directive"><a href="#sslcacertificatefile">SSLCACertificateFile</a></code> and <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code> directives; in other |
| words, the names of the CAs which will actually be used to verify the |
| client certificate.</p> |
| |
| <p>In some circumstances, it is useful to be able to send a set of |
| acceptable CA names which differs from the actual CAs used to verify |
| the client certificate - for example, if the client certificates are |
| signed by intermediate CAs. In such cases, <code class="directive"><a href="#sslcadnrequestpath">SSLCADNRequestPath</a></code> and/or <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code> can be used; the |
| acceptable CA names are then taken from the complete set of |
| certificates in the directory and/or file specified by this pair of |
| directives.</p> |
| |
| <p><code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code> must |
| specify an <em>all-in-one</em> file containing a concatenation of |
| PEM-encoded CA certificates.</p> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCADNRequestFile /usr/local/apache2/conf/ca-names.crt |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCADNRequestPath" id="SSLCADNRequestPath">SSLCADNRequestPath</a> <a name="sslcadnrequestpath" id="sslcadnrequestpath">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA Certificates for |
| defining acceptable CA names</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCADNRequestPath <em>directory-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| |
| <p>This optional directive can be used to specify the set of |
| <em>acceptable CA names</em> which will be sent to the client when a |
| client certificate is requested. See the <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code> directive for more |
| details.</p> |
| |
| <p>The files in this directory have to be PEM-encoded and are accessed |
| through hash filenames. So usually you can't just place the |
| Certificate files there: you also have to create symbolic links named |
| <em>hash-value</em><code>.N</code>. And you should always make sure |
| this directory contains the appropriate symbolic links.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCADNRequestPath /usr/local/apache2/conf/ca-names.crt/ |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCARevocationFile" id="SSLCARevocationFile">SSLCARevocationFile</a> <a name="sslcarevocationfile" id="sslcarevocationfile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA CRLs for |
| Client Auth</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCARevocationFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the <em>all-in-one</em> file where you can |
| assemble the Certificate Revocation Lists (CRL) of Certification |
| Authorities (CA) whose <em>clients</em> you deal with. These are used |
| for Client Authentication. Such a file is simply the concatenation of |
| the various PEM-encoded CRL files, in order of preference. This can be |
| used alternatively and/or additionally to <code class="directive"><a href="#sslcarevocationpath">SSLCARevocationPath</a></code>.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCARevocationFile /usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCARevocationPath" id="SSLCARevocationPath">SSLCARevocationPath</a> <a name="sslcarevocationpath" id="sslcarevocationpath">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA CRLs for |
| Client Auth</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCARevocationPath <em>directory-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the directory where you keep the Certificate Revocation |
| Lists (CRL) of Certification Authorities (CAs) whose clients you deal with. |
| These are used to revoke the client certificate on Client Authentication.</p> |
| <p> |
| The files in this directory have to be PEM-encoded and are accessed through |
| hash filenames. So usually you have not only to place the CRL files there. |
| Additionally you have to create symbolic links named |
| <em>hash-value</em><code>.rN</code>. And you should always make sure this directory |
| contains the appropriate symbolic links.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCARevocationPath /usr/local/apache2/conf/ssl.crl/ |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCertificateChainFile" id="SSLCertificateChainFile">SSLCertificateChainFile</a> <a name="sslcertificatechainfile" id="sslcertificatechainfile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of PEM-encoded Server CA Certificates</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCertificateChainFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the optional <em>all-in-one</em> file where you can |
| assemble the certificates of Certification Authorities (CA) which form the |
| certificate chain of the server certificate. This starts with the issuing CA |
| certificate of the server certificate and can range up to the root CA |
| certificate. Such a file is simply the concatenation of the various |
| PEM-encoded CA Certificate files, usually in certificate chain order.</p> |
| <p> |
| This should be used alternatively and/or additionally to <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code> for explicitly |
| constructing the server certificate chain which is sent to the browser |
| in addition to the server certificate. It is especially useful to |
| avoid conflicts with CA certificates when using client |
| authentication. Because although placing a CA certificate of the |
| server certificate chain into <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code> has the same effect |
| for the certificate chain construction, it has the side-effect that |
| client certificates issued by this same CA certificate are also |
| accepted on client authentication.</p> |
| <p> |
| But be careful: Providing the certificate chain works only if you are using a |
| <em>single</em> RSA <em>or</em> DSA based server certificate. If you are |
| using a coupled RSA+DSA certificate pair, this will work only if actually both |
| certificates use the <em>same</em> certificate chain. Else the browsers will be |
| confused in this situation.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCertificateChainFile /usr/local/apache2/conf/ssl.crt/ca.crt |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCertificateFile" id="SSLCertificateFile">SSLCertificateFile</a> <a name="sslcertificatefile" id="sslcertificatefile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Server PEM-encoded X.509 Certificate file</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCertificateFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>ECC support is available in Apache 2.2.26 and later</td></tr> |
| </table> |
| <p> |
| This directive points to a file with certificate data in PEM format. |
| At a minimum, the file must include an end-entity (leaf) certificate. |
| The directive can be used up to three times (referencing different filenames) |
| when an RSA, a DSA, and an ECC based server certificate is used in parallel. |
| </p> |
| |
| <p> |
| Custom DH parameters and an EC curve name for ephemeral keys, |
| can be added to end of the first file configured using |
| <code class="directive"><a href="#sslcertificatefile">SSLCertificateFile</a></code>. |
| This is supported in version 2.2.30 or later. |
| Such parameters can be generated using the commands |
| <code>openssl dhparam</code> and <code>openssl ecparam</code>. |
| The parameters can be added as-is to the end of the first |
| certificate file. Only the first file can be used for custom |
| parameters, as they are applied independently of the authentication |
| algorithm type. |
| </p> |
| |
| <p> |
| Finally the the end-entity certificate's private key can also be |
| added to the certificate file instead of using a separate |
| <code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code> |
| directive. This practice is highly discouraged. If the private |
| key is encrypted, the pass phrase dialog is forced at startup time. |
| </p> |
| |
| <div class="note"> |
| <h3>DH parameter interoperability with primes > 1024 bit</h3> |
| <p> |
| Beginning with version 2.2.30, mod_ssl makes use of |
| standardized DH parameters with prime lengths of 2048, 3072, 4096, 6144 and |
| 8192 bits (from <a href="http://www.ietf.org/rfc/rfc3526.txt">RFC 3526</a>), |
| and hands them out to clients based on the length of the certificate's RSA/DSA |
| key. |
| With Java-based clients in particular (Java 7 or earlier), this may lead |
| to handshake failures - see this |
| <a href="../ssl/ssl_faq.html#javadh">FAQ answer</a> for working around |
| such issues. |
| </p> |
| </div> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCertificateKeyFile" id="SSLCertificateKeyFile">SSLCertificateKeyFile</a> <a name="sslcertificatekeyfile" id="sslcertificatekeyfile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Server PEM-encoded Private Key file</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCertificateKeyFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>ECC support is available in Apache 2.2.26 and later</td></tr> |
| </table> |
| <p> |
| This directive points to the PEM-encoded private key file for the |
| server. If the contained private key is encrypted, the pass phrase |
| dialog is forced at startup time.</p> |
| |
| <p> |
| The directive can be used up to three times (referencing different filenames) |
| when an RSA, a DSA, and an ECC based private key is used in parallel. For each |
| <code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code> |
| directive, there must be a matching <code class="directive">SSLCertificateFile</code> |
| directive.</p> |
| |
| <p> |
| The private key may also be combined with the certificate in the file given by |
| <code class="directive"><a href="#sslcertificatefile">SSLCertificateFile</a></code>, but this practice |
| is highly discouraged.</p> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCipherSuite" id="SSLCipherSuite">SSLCipherSuite</a> <a name="sslciphersuite" id="sslciphersuite">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Cipher Suite available for negotiation in SSL |
| handshake</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCipherSuite <em>cipher-spec</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This complex directive uses a colon-separated <em>cipher-spec</em> string |
| consisting of OpenSSL cipher specifications to configure the Cipher Suite the |
| client is permitted to negotiate in the SSL handshake phase. Notice that this |
| directive can be used both in per-server and per-directory context. In |
| per-server context it applies to the standard SSL handshake when a connection |
| is established. In per-directory context it forces a SSL renegotiation with the |
| reconfigured Cipher Suite after the HTTP request was read but before the HTTP |
| response is sent.</p> |
| <p> |
| An SSL cipher specification in <em>cipher-spec</em> is composed of 4 major |
| attributes plus a few extra minor ones:</p> |
| <ul> |
| <li><em>Key Exchange Algorithm</em>:<br /> |
| RSA or Diffie-Hellman variants. |
| </li> |
| <li><em>Authentication Algorithm</em>:<br /> |
| RSA, Diffie-Hellman, DSS or none. |
| </li> |
| <li><em>Cipher/Encryption Algorithm</em>:<br /> |
| DES, Triple-DES, RC4, RC2, IDEA or none. |
| </li> |
| <li><em>MAC Digest Algorithm</em>:<br /> |
| MD5, SHA or SHA1. |
| </li> |
| </ul> |
| <p>An SSL cipher can also be an export cipher and is either a SSLv2 or SSLv3/TLSv1 |
| cipher (here TLSv1 is equivalent to SSLv3). To specify which ciphers to use, |
| one can either specify all the Ciphers, one at a time, or use aliases to |
| specify the preference and order for the ciphers (see <a href="#table1">Table |
| 1</a>).</p> |
| |
| <table class="bordered"> |
| |
| <tr><th><a name="table1">Tag</a></th> <th>Description</th></tr> |
| <tr><td colspan="2"><em>Key Exchange Algorithm:</em></td></tr> |
| <tr><td><code>kRSA</code></td> <td>RSA key exchange</td></tr> |
| <tr><td><code>kDHr</code></td> <td>Diffie-Hellman key exchange with RSA key</td></tr> |
| <tr><td><code>kDHd</code></td> <td>Diffie-Hellman key exchange with DSA key</td></tr> |
| <tr><td><code>kEDH</code></td> <td>Ephemeral (temp.key) Diffie-Hellman key exchange (no cert)</td> </tr> |
| <tr><td colspan="2"><em>Authentication Algorithm:</em></td></tr> |
| <tr><td><code>aNULL</code></td> <td>No authentication</td></tr> |
| <tr><td><code>aRSA</code></td> <td>RSA authentication</td></tr> |
| <tr><td><code>aDSS</code></td> <td>DSS authentication</td> </tr> |
| <tr><td><code>aDH</code></td> <td>Diffie-Hellman authentication</td></tr> |
| <tr><td colspan="2"><em>Cipher Encoding Algorithm:</em></td></tr> |
| <tr><td><code>eNULL</code></td> <td>No encoding</td> </tr> |
| <tr><td><code>DES</code></td> <td>DES encoding</td> </tr> |
| <tr><td><code>3DES</code></td> <td>Triple-DES encoding</td> </tr> |
| <tr><td><code>RC4</code></td> <td>RC4 encoding</td> </tr> |
| <tr><td><code>RC2</code></td> <td>RC2 encoding</td> </tr> |
| <tr><td><code>IDEA</code></td> <td>IDEA encoding</td> </tr> |
| <tr><td colspan="2"><em>MAC Digest Algorithm</em>:</td></tr> |
| <tr><td><code>MD5</code></td> <td>MD5 hash function</td></tr> |
| <tr><td><code>SHA1</code></td> <td>SHA1 hash function</td></tr> |
| <tr><td><code>SHA</code></td> <td>SHA hash function</td> </tr> |
| <tr><td colspan="2"><em>Aliases:</em></td></tr> |
| <tr><td><code>SSLv2</code></td> <td>all SSL version 2.0 ciphers</td></tr> |
| <tr><td><code>SSLv3</code></td> <td>all SSL version 3.0 ciphers</td> </tr> |
| <tr><td><code>TLSv1</code></td> <td>all TLS version 1.0 ciphers</td> </tr> |
| <tr><td><code>EXP</code></td> <td>all export ciphers</td> </tr> |
| <tr><td><code>EXPORT40</code></td> <td>all 40-bit export ciphers only</td> </tr> |
| <tr><td><code>EXPORT56</code></td> <td>all 56-bit export ciphers only</td> </tr> |
| <tr><td><code>LOW</code></td> <td>all low strength ciphers (no export, single DES)</td></tr> |
| <tr><td><code>MEDIUM</code></td> <td>all ciphers with 128 bit encryption</td> </tr> |
| <tr><td><code>HIGH</code></td> <td>all ciphers using Triple-DES</td> </tr> |
| <tr><td><code>RSA</code></td> <td>all ciphers using RSA key exchange</td> </tr> |
| <tr><td><code>DH</code></td> <td>all ciphers using Diffie-Hellman key exchange</td> </tr> |
| <tr><td><code>EDH</code></td> <td>all ciphers using Ephemeral Diffie-Hellman key exchange</td> </tr> |
| <tr><td><code>ADH</code></td> <td>all ciphers using Anonymous Diffie-Hellman key exchange</td> </tr> |
| <tr><td><code>DSS</code></td> <td>all ciphers using DSS authentication</td> </tr> |
| <tr><td><code>NULL</code></td> <td>all ciphers using no encryption</td> </tr> |
| </table> |
| <p> |
| Now where this becomes interesting is that these can be put together |
| to specify the order and ciphers you wish to use. To speed this up |
| there are also aliases (<code>SSLv2, SSLv3, TLSv1, EXP, LOW, MEDIUM, |
| HIGH</code>) for certain groups of ciphers. These tags can be joined |
| together with prefixes to form the <em>cipher-spec</em>. Available |
| prefixes are:</p> |
| <ul> |
| <li>none: add cipher to list</li> |
| <li><code>+</code>: move matching ciphers to the current location in list</li> |
| <li><code>-</code>: remove cipher from list (can be added later again)</li> |
| <li><code>!</code>: kill cipher from list completely (can <strong>not</strong> be added later again)</li> |
| </ul> |
| |
| <div class="note"> |
| <h3><code>aNULL</code>, <code>eNULL</code> and <code>EXP</code> |
| ciphers are always disabled</h3> |
| <p>Beginning with version 2.2.30, null and export-grade |
| ciphers are always disabled, as mod_ssl unconditionally prepends any supplied |
| cipher suite string with <code>!aNULL:!eNULL:!EXP:</code> at initialization.</p> |
| </div> |
| |
| <p>A simpler way to look at all of this is to use the ``<code>openssl ciphers |
| -v</code>'' command which provides a nice way to successively create the |
| correct <em>cipher-spec</em> string. The default <em>cipher-spec</em> string |
| is ``<code>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code>'' which |
| means the following: first, remove from consideration any ciphers that do not |
| authenticate, i.e. for SSL only the Anonymous Diffie-Hellman ciphers. Next, |
| use ciphers using RC4 and RSA. Next include the high, medium and then the low |
| security ciphers. Finally <em>pull</em> all SSLv2 and export ciphers to the |
| end of the list.</p> |
| <div class="example"><pre>$ openssl ciphers -v 'ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP' |
| NULL-SHA SSLv3 Kx=RSA Au=RSA Enc=None Mac=SHA1 |
| NULL-MD5 SSLv3 Kx=RSA Au=RSA Enc=None Mac=MD5 |
| EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 |
| ... ... ... ... ... |
| EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export |
| EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export |
| EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export</pre></div> |
| <p>The complete list of particular RSA & DH ciphers for SSL is given in <a href="#table2">Table 2</a>.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLCipherSuite RSA:!EXP:!NULL:+HIGH:+MEDIUM:-LOW |
| </code></p></div> |
| <table class="bordered"> |
| |
| <tr><th><a name="table2">Cipher-Tag</a></th> <th>Protocol</th> <th>Key Ex.</th> <th>Auth.</th> <th>Enc.</th> <th>MAC</th> <th>Type</th> </tr> |
| <tr><td colspan="7"><em>RSA Ciphers:</em></td></tr> |
| <tr><td><code>DES-CBC3-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>3DES(168)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>DES-CBC3-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>3DES(168)</td> <td>MD5</td> <td /> </tr> |
| <tr><td><code>IDEA-CBC-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>IDEA(128)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>RC4-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>RC4(128)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>RC4-MD5</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>RC4(128)</td> <td>MD5</td> <td /> </tr> |
| <tr><td><code>IDEA-CBC-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>IDEA(128)</td> <td>MD5</td> <td /> </tr> |
| <tr><td><code>RC2-CBC-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>RC2(128)</td> <td>MD5</td> <td /> </tr> |
| <tr><td><code>RC4-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>RC4(128)</td> <td>MD5</td> <td /> </tr> |
| <tr><td><code>DES-CBC-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>DES(56)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>RC4-64-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>RC4(64)</td> <td>MD5</td> <td /> </tr> |
| <tr><td><code>DES-CBC-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>DES(56)</td> <td>MD5</td> <td /> </tr> |
| <tr><td><code>EXP-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>RSA(512)</td> <td>RSA</td> <td>DES(40)</td> <td>SHA1</td> <td> export</td> </tr> |
| <tr><td><code>EXP-RC2-CBC-MD5</code></td> <td>SSLv3</td> <td>RSA(512)</td> <td>RSA</td> <td>RC2(40)</td> <td>MD5</td> <td> export</td> </tr> |
| <tr><td><code>EXP-RC4-MD5</code></td> <td>SSLv3</td> <td>RSA(512)</td> <td>RSA</td> <td>RC4(40)</td> <td>MD5</td> <td> export</td> </tr> |
| <tr><td><code>EXP-RC2-CBC-MD5</code></td> <td>SSLv2</td> <td>RSA(512)</td> <td>RSA</td> <td>RC2(40)</td> <td>MD5</td> <td> export</td> </tr> |
| <tr><td><code>EXP-RC4-MD5</code></td> <td>SSLv2</td> <td>RSA(512)</td> <td>RSA</td> <td>RC4(40)</td> <td>MD5</td> <td> export</td> </tr> |
| <tr><td><code>NULL-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>None</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>NULL-MD5</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>None</td> <td>MD5</td> <td /> </tr> |
| <tr><td colspan="7"><em>Diffie-Hellman Ciphers:</em></td></tr> |
| <tr><td><code>ADH-DES-CBC3-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>None</td> <td>3DES(168)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>ADH-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>None</td> <td>DES(56)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>ADH-RC4-MD5</code></td> <td>SSLv3</td> <td>DH</td> <td>None</td> <td>RC4(128)</td> <td>MD5</td> <td /> </tr> |
| <tr><td><code>EDH-RSA-DES-CBC3-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>RSA</td> <td>3DES(168)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>EDH-DSS-DES-CBC3-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>DSS</td> <td>3DES(168)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>EDH-RSA-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>RSA</td> <td>DES(56)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>EDH-DSS-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>DSS</td> <td>DES(56)</td> <td>SHA1</td> <td /> </tr> |
| <tr><td><code>EXP-EDH-RSA-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH(512)</td> <td>RSA</td> <td>DES(40)</td> <td>SHA1</td> <td> export</td> </tr> |
| <tr><td><code>EXP-EDH-DSS-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH(512)</td> <td>DSS</td> <td>DES(40)</td> <td>SHA1</td> <td> export</td> </tr> |
| <tr><td><code>EXP-ADH-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH(512)</td> <td>None</td> <td>DES(40)</td> <td>SHA1</td> <td> export</td> </tr> |
| <tr><td><code>EXP-ADH-RC4-MD5</code></td> <td>SSLv3</td> <td>DH(512)</td> <td>None</td> <td>RC4(40)</td> <td>MD5</td> <td> export</td> </tr> |
| </table> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCompression" id="SSLCompression">SSLCompression</a> <a name="sslcompression" id="sslcompression">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable compression on the SSL level</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCompression on|off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLCompression off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.2.24 and later, if using OpenSSL 0.9.8 or later; |
| virtual host scope available if using OpenSSL 1.0.0 or later. |
| The default used to be <code>on</code> in versions 2.2.24 to 2.2.25.</td></tr> |
| </table> |
| <p>This directive allows to enable compression on the SSL level.</p> |
| <div class="warning"> |
| <p>Enabling compression causes security issues in most setups (the so called |
| CRIME attack).</p> |
| </div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLCryptoDevice" id="SSLCryptoDevice">SSLCryptoDevice</a> <a name="sslcryptodevice" id="sslcryptodevice">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable use of a cryptographic hardware accelerator</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCryptoDevice <em>engine</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLCryptoDevice builtin</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.1 and later, if using -engine flavor of OpenSSL |
| 0.9.6, or OpenSSL 0.9.7 or later</td></tr> |
| </table> |
| <p> |
| This directive enables use of a cryptographic hardware accelerator |
| board to offload some of the SSL processing overhead. This directive |
| can only be used if the SSL toolkit is built with "engine" support; |
| OpenSSL 0.9.7 and later releases have "engine" support by default, the |
| separate "-engine" releases of OpenSSL 0.9.6 must be used.</p> |
| |
| <p>To discover which engine names are supported, run the command |
| "<code>openssl engine</code>".</p> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| # For a Broadcom accelerator:<br /> |
| SSLCryptoDevice ubsec |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLEngine" id="SSLEngine">SSLEngine</a> <a name="sslengine" id="sslengine">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>SSL Engine Operation Switch</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLEngine on|off|optional</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLEngine off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive toggles the usage of the SSL/TLS Protocol Engine. This |
| should be used inside a <code class="directive"><a href="../mod/core.html#virtualhost"><VirtualHost></a></code> section to enable SSL/TLS for a |
| that virtual host. By default the SSL/TLS Protocol Engine is |
| disabled for both the main server and all configured virtual hosts.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| <VirtualHost _default_:443><br /> |
| SSLEngine on<br /> |
| ...<br /> |
| </VirtualHost> |
| </code></p></div> |
| <p>In Apache 2.1 and later, <code class="directive">SSLEngine</code> can be set to |
| <code>optional</code>. This enables support for |
| <a href="http://www.ietf.org/rfc/rfc2817.txt">RFC 2817</a>, Upgrading to TLS |
| Within HTTP/1.1. At this time no web browsers support RFC 2817.</p> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLFIPS" id="SSLFIPS">SSLFIPS</a> <a name="sslfips" id="sslfips">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>SSL FIPS mode Switch</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLFIPS on|off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLFIPS off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive toggles the usage of the SSL library FIPS_mode flag. |
| It must be set in the global server context and cannot be configured |
| with conflicting settings (SSLFIPS on followed by SSLFIPS off or |
| similar). The mode applies to all SSL library operations. |
| </p> |
| <p> |
| If httpd was compiled against an SSL library which did not support |
| the FIPS_mode flag, <code>SSLFIPS on</code> will fail. Refer to the |
| FIPS 140-2 Security Policy document of the SSL provider library for |
| specific requirements to use mod_ssl in a FIPS 140-2 approved mode |
| of operation; note that mod_ssl itself is not validated, but may be |
| described as using FIPS 140-2 validated cryptographic module, when |
| all components are assembled and operated under the guidelines imposed |
| by the applicable Security Policy. |
| </p> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLHonorCipherOrder" id="SSLHonorCipherOrder">SSLHonorCipherOrder</a> <a name="sslhonorcipherorder" id="sslhonorcipherorder">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Option to prefer the server's cipher preference order</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLHonorCipherOrder <em>flag</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.1 and later, if using OpenSSL 0.9.7 or later</td></tr> |
| </table> |
| <p>When choosing a cipher during an SSLv3 or TLSv1 handshake, normally |
| the client's preference is used. If this directive is enabled, the |
| server's preference will be used instead.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLHonorCipherOrder on |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLInsecureRenegotiation" id="SSLInsecureRenegotiation">SSLInsecureRenegotiation</a> <a name="sslinsecurerenegotiation" id="sslinsecurerenegotiation">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Option to enable support for insecure renegotiation</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLInsecureRenegotiation <em>flag</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLInsecureRenegotiation off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.2.15 and later, if using OpenSSL 0.9.8m or later</td></tr> |
| </table> |
| <p>As originally specified, all versions of the SSL and TLS protocols |
| (up to and including TLS/1.2) were vulnerable to a Man-in-the-Middle |
| attack |
| (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555">CVE-2009-3555</a>) |
| during a renegotiation. This vulnerability allowed an attacker to |
| "prefix" a chosen plaintext to the HTTP request as seen by the web |
| server. A protocol extension was developed which fixed this |
| vulnerability if supported by both client and server.</p> |
| |
| <p>If <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> is linked against OpenSSL version 0.9.8m |
| or later, by default renegotiation is only supported with |
| clients supporting the new protocol extension. If this directive is |
| enabled, renegotiation will be allowed with old (unpatched) clients, |
| albeit insecurely.</p> |
| |
| <div class="warning"><h3>Security warning</h3> |
| <p>If this directive is enabled, SSL connections will be vulnerable to |
| the Man-in-the-Middle prefix attack as described |
| in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555">CVE-2009-3555</a>.</p> |
| </div> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| SSLInsecureRenegotiation on |
| </code></p></div> |
| |
| <p>The <code>SSL_SECURE_RENEG</code> environment variable can be used |
| from an SSI or CGI script to determine whether secure renegotiation is |
| supported for a given SSL connection.</p> |
| |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLMutex" id="SSLMutex">SSLMutex</a> <a name="sslmutex" id="sslmutex">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Semaphore for internal mutual exclusion of |
| operations</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLMutex <em>type</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLMutex none</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This configures the SSL engine's semaphore (aka. lock) which is used for mutual |
| exclusion of operations which have to be done in a synchronized way between the |
| pre-forked Apache server processes. This directive can only be used in the |
| global server context because it's only useful to have one global mutex. |
| This directive is designed to closely match the |
| <code class="directive"><a href="../mod/mpm_common.html#acceptmutex">AcceptMutex</a></code> directive.</p> |
| <p> |
| The following Mutex <em>types</em> are available:</p> |
| <ul> |
| <li><code>none | no</code> |
| <p> |
| This is the default where no Mutex is used at all. Use it at your own |
| risk. But because currently the Mutex is mainly used for synchronizing |
| write access to the SSL Session Cache you can live without it as long |
| as you accept a sometimes garbled Session Cache. So it's not recommended |
| to leave this the default. Instead configure a real Mutex.</p></li> |
| <li><code>posixsem</code> |
| <p> |
| This is an elegant Mutex variant where a Posix Semaphore is used when possible. |
| It is only available when the underlying platform |
| and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it.</p></li> |
| <li><code>sysvsem</code> |
| <p> |
| This is a somewhat elegant Mutex variant where a SystemV IPC Semaphore is used when |
| possible. It is possible to "leak" SysV semaphores if processes crash before |
| the semaphore is removed. It is only available when the underlying platform |
| and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it.</p></li> |
| <li><code>sem</code> |
| <p> |
| This directive tells the SSL Module to pick the "best" semaphore implementation |
| available to it, choosing between Posix and SystemV IPC, in that order. It is only |
| available when the underlying platform and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports at least one of the 2.</p></li> |
| <li><code>pthread</code> |
| <p> |
| This directive tells the SSL Module to use Posix thread mutexes. It is only available |
| if the underlying platform and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it.</p></li> |
| <li><code>fcntl:/path/to/mutex</code> |
| <p> |
| This is a portable Mutex variant where a physical (lock-)file and the <code>fcntl()</code> |
| function are used as the Mutex. |
| Always use a local disk filesystem for <code>/path/to/mutex</code> and never a file |
| residing on a NFS- or AFS-filesystem. It is only available when the underlying platform |
| and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it. Note: Internally, the Process ID (PID) of the |
| Apache parent process is automatically appended to |
| <code>/path/to/mutex</code> to make it unique, so you don't have to worry |
| about conflicts yourself. Notice that this type of mutex is not available |
| under the Win32 environment. There you <em>have</em> to use the semaphore |
| mutex.</p></li> |
| <li><code>flock:/path/to/mutex</code> |
| <p> |
| This is similar to the <code>fcntl:/path/to/mutex</code> method with the |
| exception that the <code>flock()</code> function is used to provide file |
| locking. It is only available when the underlying platform |
| and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it.</p></li> |
| <li><code>file:/path/to/mutex</code> |
| <p> |
| This directive tells the SSL Module to pick the "best" file locking implementation |
| available to it, choosing between <code>fcntl</code> and <code>flock</code>, |
| in that order. It is only available when the underlying platform and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports |
| at least one of the 2.</p></li> |
| <li><code>default | yes</code> |
| <p> |
| This directive tells the SSL Module to pick the default locking implementation |
| as determined by the platform and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a>.</p></li> |
| </ul> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLMutex file:/usr/local/apache/logs/ssl_mutex |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLOptions" id="SSLOptions">SSLOptions</a> <a name="ssloptions" id="ssloptions">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configure various SSL engine run-time options</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLOptions [+|-]<em>option</em> ...</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Options</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive can be used to control various run-time options on a |
| per-directory basis. Normally, if multiple <code>SSLOptions</code> |
| could apply to a directory, then the most specific one is taken |
| completely; the options are not merged. However if <em>all</em> the |
| options on the <code>SSLOptions</code> directive are preceded by a |
| plus (<code>+</code>) or minus (<code>-</code>) symbol, the options |
| are merged. Any options preceded by a <code>+</code> are added to the |
| options currently in force, and any options preceded by a |
| <code>-</code> are removed from the options currently in force.</p> |
| <p> |
| The available <em>option</em>s are:</p> |
| <ul> |
| <li><code>StdEnvVars</code> |
| <p> |
| When this option is enabled, the standard set of SSL related CGI/SSI |
| environment variables are created. This per default is disabled for |
| performance reasons, because the information extraction step is a |
| rather expensive operation. So one usually enables this option for |
| CGI and SSI requests only.</p> |
| </li> |
| <li><code>ExportCertData</code> |
| <p> |
| When this option is enabled, additional CGI/SSI environment variables are |
| created: <code>SSL_SERVER_CERT</code>, <code>SSL_CLIENT_CERT</code> and |
| <code>SSL_CLIENT_CERT_CHAIN_</code><em>n</em> (with <em>n</em> = 0,1,2,..). |
| These contain the PEM-encoded X.509 Certificates of server and client for |
| the current HTTPS connection and can be used by CGI scripts for deeper |
| Certificate checking. Additionally all other certificates of the client |
| certificate chain are provided, too. This bloats up the environment a |
| little bit which is why you have to use this option to enable it on |
| demand.</p> |
| </li> |
| <li><code>FakeBasicAuth</code> |
| <p> |
| When this option is enabled, the Subject Distinguished Name (DN) of the |
| Client X509 Certificate is translated into a HTTP Basic Authorization |
| username. This means that the standard Apache authentication methods can |
| be used for access control. The user name is just the Subject of the |
| Client's X509 Certificate (can be determined by running OpenSSL's |
| <code>openssl x509</code> command: <code>openssl x509 -noout -subject -in |
| </code><em>certificate</em><code>.crt</code>). Note that no password is |
| obtained from the user. Every entry in the user file needs this password: |
| ``<code>xxj31ZMTZzkVA</code>'', which is the DES-encrypted version of the |
| word `<code>password</code>''. Those who live under MD5-based encryption |
| (for instance under FreeBSD or BSD/OS, etc.) should use the following MD5 |
| hash of the same word: ``<code>$1$OXLyS...$Owx8s2/m9/gfkcRVXzgoE/</code>''.</p> |
| </li> |
| <li><code>StrictRequire</code> |
| <p> |
| This <em>forces</em> forbidden access when <code>SSLRequireSSL</code> or |
| <code>SSLRequire</code> successfully decided that access should be |
| forbidden. Usually the default is that in the case where a ``<code>Satisfy |
| any</code>'' directive is used, and other access restrictions are passed, |
| denial of access due to <code>SSLRequireSSL</code> or |
| <code>SSLRequire</code> is overridden (because that's how the Apache |
| <code>Satisfy</code> mechanism should work.) But for strict access restriction |
| you can use <code>SSLRequireSSL</code> and/or <code>SSLRequire</code> in |
| combination with an ``<code>SSLOptions +StrictRequire</code>''. Then an |
| additional ``<code>Satisfy Any</code>'' has no chance once mod_ssl has |
| decided to deny access.</p> |
| </li> |
| <li><code>OptRenegotiate</code> |
| <p> |
| This enables optimized SSL connection renegotiation handling when SSL |
| directives are used in per-directory context. By default a strict |
| scheme is enabled where <em>every</em> per-directory reconfiguration of |
| SSL parameters causes a <em>full</em> SSL renegotiation handshake. When this |
| option is used mod_ssl tries to avoid unnecessary handshakes by doing more |
| granular (but still safe) parameter checks. Nevertheless these granular |
| checks sometimes maybe not what the user expects, so enable this on a |
| per-directory basis only, please.</p> |
| </li> |
| </ul> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLOptions +FakeBasicAuth -StrictRequire<br /> |
| <Files ~ "\.(cgi|shtml)$"><br /> |
| SSLOptions +StdEnvVars -ExportCertData<br /> |
| <Files> |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLPassPhraseDialog" id="SSLPassPhraseDialog">SSLPassPhraseDialog</a> <a name="sslpassphrasedialog" id="sslpassphrasedialog">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Type of pass phrase dialog for encrypted private |
| keys</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLPassPhraseDialog <em>type</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLPassPhraseDialog builtin</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| When Apache starts up it has to read the various Certificate (see |
| <code class="directive"><a href="#sslcertificatefile">SSLCertificateFile</a></code>) and |
| Private Key (see <code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code>) files of the |
| SSL-enabled virtual servers. Because for security reasons the Private |
| Key files are usually encrypted, mod_ssl needs to query the |
| administrator for a Pass Phrase in order to decrypt those files. This |
| query can be done in two ways which can be configured by |
| <em>type</em>:</p> |
| <ul> |
| <li><code>builtin</code> |
| <p> |
| This is the default where an interactive terminal dialog occurs at startup |
| time just before Apache detaches from the terminal. Here the administrator |
| has to manually enter the Pass Phrase for each encrypted Private Key file. |
| Because a lot of SSL-enabled virtual hosts can be configured, the |
| following reuse-scheme is used to minimize the dialog: When a Private Key |
| file is encrypted, all known Pass Phrases (at the beginning there are |
| none, of course) are tried. If one of those known Pass Phrases succeeds no |
| dialog pops up for this particular Private Key file. If none succeeded, |
| another Pass Phrase is queried on the terminal and remembered for the next |
| round (where it perhaps can be reused).</p> |
| <p> |
| This scheme allows mod_ssl to be maximally flexible (because for N encrypted |
| Private Key files you <em>can</em> use N different Pass Phrases - but then |
| you have to enter all of them, of course) while minimizing the terminal |
| dialog (i.e. when you use a single Pass Phrase for all N Private Key files |
| this Pass Phrase is queried only once).</p></li> |
| |
| <li><code>|/path/to/program [args...]</code> |
| |
| <p>This mode allows an external program to be used which acts as a |
| pipe to a particular input device; the program is sent the standard |
| prompt text used for the <code>builtin</code> mode on |
| <code>stdin</code>, and is expected to write password strings on |
| <code>stdout</code>. If several passwords are needed (or an |
| incorrect password is entered), additional prompt text will be |
| written subsequent to the first password being returned, and more |
| passwords must then be written back.</p></li> |
| |
| <li><code>exec:/path/to/program</code> |
| <p> |
| Here an external program is configured which is called at startup for each |
| encrypted Private Key file. It is called with two arguments (the first is |
| of the form ``<code>servername:portnumber</code>'', the second is either |
| ``<code>RSA</code>'', ``<code>DSA</code>'', or ``<code>ECC</code>''), which |
| indicate for which server and algorithm it has to print the corresponding |
| Pass Phrase to <code>stdout</code>. The intent is that this external |
| program first runs security checks to make sure that the system is not |
| compromised by an attacker, and only when these checks were passed |
| successfully it provides the Pass Phrase.</p> |
| <p> |
| Both these security checks, and the way the Pass Phrase is determined, can |
| be as complex as you like. Mod_ssl just defines the interface: an |
| executable program which provides the Pass Phrase on <code>stdout</code>. |
| Nothing more or less! So, if you're really paranoid about security, here |
| is your interface. Anything else has to be left as an exercise to the |
| administrator, because local security requirements are so different.</p> |
| <p> |
| The reuse-algorithm above is used here, too. In other words: The external |
| program is called only once per unique Pass Phrase.</p></li> |
| </ul> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLPassPhraseDialog exec:/usr/local/apache/sbin/pp-filter |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProtocol" id="SSLProtocol">SSLProtocol</a> <a name="sslprotocol" id="sslprotocol">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configure usable SSL protocol flavors</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProtocol [+|-]<em>protocol</em> ...</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProtocol all</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Options</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive can be used to control the SSL protocol flavors mod_ssl should |
| use when establishing its server environment. Clients then can only connect |
| with one of the provided protocols.</p> |
| <p> |
| The available (case-insensitive) <em>protocol</em>s are:</p> |
| <ul> |
| <li><code>SSLv2</code> |
| <p> |
| This is the Secure Sockets Layer (SSL) protocol, version 2.0. It is the |
| original SSL protocol as designed by Netscape Corporation. Though its |
| use has been deprecated, because of weaknesses in the security of the protocol.</p></li> |
| |
| <li><code>SSLv3</code> |
| <p> |
| This is the Secure Sockets Layer (SSL) protocol, version 3.0, from |
| the Netscape Corporation. |
| It is the successor to SSLv2 and the predecessor to TLSv1. It's supported by |
| almost all popular browsers.</p></li> |
| |
| <li><code>TLSv1</code> |
| <p> |
| This is the Transport Layer Security (TLS) protocol, version 1.0. |
| It is the successor to SSLv3 and is defined in |
| <a href="http://www.ietf.org/rfc/rfc2246.txt">RFC 2246</a>.</p></li> |
| |
| <li><code>TLSv1.1</code> (when using OpenSSL 1.0.1 and later) |
| <p> |
| A revision of the TLS 1.0 protocol, as defined in |
| <a href="http://www.ietf.org/rfc/rfc4346.txt">RFC 4346</a>.</p></li> |
| |
| <li><code>TLSv1.2</code> (when using OpenSSL 1.0.1 and later) |
| <p> |
| A revision of the TLS 1.1 protocol, as defined in |
| <a href="http://www.ietf.org/rfc/rfc5246.txt">RFC 5246</a>.</p></li> |
| |
| <li><code>All</code> |
| <p> |
| This is a shortcut for ``<code>+SSLv2 +SSLv3 +TLSv1</code>'' or |
| - when using OpenSSL 1.0.1 and later - |
| ``<code>+SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2</code>'', respectively.</p></li> |
| </ul> |
| <div class="example"><h3>Example</h3><p><code> |
| # enable SSLv3 and all available TLSv1 flavors, but not SSLv2<br /> |
| SSLProtocol All -SSLv2 |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyCACertificateFile" id="SSLProxyCACertificateFile">SSLProxyCACertificateFile</a> <a name="sslproxycacertificatefile" id="sslproxycacertificatefile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA Certificates |
| for Remote Server Auth</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCACertificateFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the <em>all-in-one</em> file where you can assemble the |
| Certificates of Certification Authorities (CA) whose <em>remote servers</em> you deal |
| with. These are used for Remote Server Authentication. Such a file is simply the |
| concatenation of the various PEM-encoded Certificate files, in order of |
| preference. This can be used alternatively and/or additionally to |
| <code class="directive"><a href="#sslproxycacertificatepath">SSLProxyCACertificatePath</a></code>.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyCACertificateFile /usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyCACertificatePath" id="SSLProxyCACertificatePath">SSLProxyCACertificatePath</a> <a name="sslproxycacertificatepath" id="sslproxycacertificatepath">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA Certificates for |
| Remote Server Auth</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCACertificatePath <em>directory-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the directory where you keep the Certificates of |
| Certification Authorities (CAs) whose remote servers you deal with. These are used to |
| verify the remote server certificate on Remote Server Authentication.</p> |
| <p> |
| The files in this directory have to be PEM-encoded and are accessed through |
| hash filenames. So usually you can't just place the Certificate files |
| there: you also have to create symbolic links named |
| <em>hash-value</em><code>.N</code>. And you should always make sure this directory |
| contains the appropriate symbolic links.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyCACertificatePath /usr/local/apache2/conf/ssl.crt/ |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyCARevocationFile" id="SSLProxyCARevocationFile">SSLProxyCARevocationFile</a> <a name="sslproxycarevocationfile" id="sslproxycarevocationfile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA CRLs for |
| Remote Server Auth</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCARevocationFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the <em>all-in-one</em> file where you can |
| assemble the Certificate Revocation Lists (CRL) of Certification |
| Authorities (CA) whose <em>remote servers</em> you deal with. These are used |
| for Remote Server Authentication. Such a file is simply the concatenation of |
| the various PEM-encoded CRL files, in order of preference. This can be |
| used alternatively and/or additionally to <code class="directive"><a href="#sslproxycarevocationpath">SSLProxyCARevocationPath</a></code>.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyCARevocationFile /usr/local/apache2/conf/ssl.crl/ca-bundle-remote-server.crl |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyCARevocationPath" id="SSLProxyCARevocationPath">SSLProxyCARevocationPath</a> <a name="sslproxycarevocationpath" id="sslproxycarevocationpath">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA CRLs for |
| Remote Server Auth</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCARevocationPath <em>directory-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the directory where you keep the Certificate Revocation |
| Lists (CRL) of Certification Authorities (CAs) whose remote servers you deal with. |
| These are used to revoke the remote server certificate on Remote Server Authentication.</p> |
| <p> |
| The files in this directory have to be PEM-encoded and are accessed through |
| hash filenames. So usually you have not only to place the CRL files there. |
| Additionally you have to create symbolic links named |
| <em>hash-value</em><code>.rN</code>. And you should always make sure this directory |
| contains the appropriate symbolic links.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyCARevocationPath /usr/local/apache2/conf/ssl.crl/ |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyCheckPeerCN" id="SSLProxyCheckPeerCN">SSLProxyCheckPeerCN</a> <a name="sslproxycheckpeercn" id="sslproxycheckpeercn">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Whether to check the remote server certificates CN field |
| </td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCheckPeerCN on|off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyCheckPeerCN off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets whether the remote server certificates CN field is |
| compared against the hostname of the request URL. If both are not equal |
| a 502 status code (Bad Gateway) is sent. |
| </p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyCheckPeerCN on |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyCheckPeerExpire" id="SSLProxyCheckPeerExpire">SSLProxyCheckPeerExpire</a> <a name="sslproxycheckpeerexpire" id="sslproxycheckpeerexpire">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Whether to check if remote server certificate is expired |
| </td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCheckPeerExpire on|off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyCheckPeerExpire off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets whether it is checked if the remote server certificate |
| is expired or not. If the check fails a 502 status code (Bad Gateway) is |
| sent. |
| </p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyCheckPeerExpire on |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyCipherSuite" id="SSLProxyCipherSuite">SSLProxyCipherSuite</a> <a name="sslproxyciphersuite" id="sslproxyciphersuite">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Cipher Suite available for negotiation in SSL |
| proxy handshake</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCipherSuite <em>cipher-spec</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p>Equivalent to <code>SSLCipherSuite</code>, but for the proxy connection. |
| Please refer to <code class="directive"><a href="#sslciphersuite">SSLCipherSuite</a></code> |
| for additional information.</p> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyEngine" id="SSLProxyEngine">SSLProxyEngine</a> <a name="sslproxyengine" id="sslproxyengine">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>SSL Proxy Engine Operation Switch</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyEngine on|off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyEngine off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive toggles the usage of the SSL/TLS Protocol Engine for proxy. This |
| is usually used inside a <code class="directive"><a href="../mod/core.html#virtualhost"><VirtualHost></a></code> section to enable SSL/TLS for proxy |
| usage in a particular virtual host. By default the SSL/TLS Protocol Engine is |
| disabled for proxy both for the main server and all configured virtual hosts.</p> |
| |
| <p>Note that the SSLProxyEngine directive should not, in |
| general, be included in a virtual host that will be acting as a |
| forward proxy (using <Proxy> or <ProxyRequest> directives. |
| SSLProxyEngine is not required to enable a forward proxy server to |
| proxy SSL/TLS requests.</p> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| <VirtualHost _default_:443><br /> |
| SSLProxyEngine on<br /> |
| ...<br /> |
| </VirtualHost> |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyMachineCertificateChainFile" id="SSLProxyMachineCertificateChainFile">SSLProxyMachineCertificateChainFile</a> <a name="sslproxymachinecertificatechainfile" id="sslproxymachinecertificatechainfile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyMachineCertificateChainFile <em>filename</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Not applicable</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.2.23 and later</td></tr> |
| </table> |
| <p> |
| This directive sets the all-in-one file where you keep the certificate chain |
| for all of the client certs in use. This directive will be needed if the |
| remote server presents a list of CA certificates that are not direct signers |
| of one of the configured client certificates. |
| </p> |
| <p> |
| This referenced file is simply the concatenation of the various PEM-encoded |
| certificate files. Upon startup, each client certificate configured will |
| be examined and a chain of trust will be constructed. |
| </p> |
| <div class="warning"><h3>Security warning</h3> |
| <p>If this directive is enabled, all of the certificates in the file will be |
| trusted as if they were also in <code class="directive"><a href="#sslproxycacertificatefile"> |
| SSLProxyCACertificateFile</a></code>.</p> |
| </div> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyMachineCertificateChainFile /usr/local/apache2/conf/ssl.crt/proxyCA.pem |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyMachineCertificateFile" id="SSLProxyMachineCertificateFile">SSLProxyMachineCertificateFile</a> <a name="sslproxymachinecertificatefile" id="sslproxymachinecertificatefile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded client certificates and keys to be used by the proxy</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyMachineCertificateFile <em>filename</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Not applicable</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the all-in-one file where you keep the certificates and |
| keys used for authentication of the proxy server to remote servers. |
| </p> |
| <p> |
| This referenced file is simply the concatenation of the various PEM-encoded |
| certificate files, in order of preference. Use this directive alternatively |
| or additionally to <code>SSLProxyMachineCertificatePath</code>. |
| </p> |
| <div class="warning"> |
| <p>Currently there is no support for encrypted private keys</p> |
| </div> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyMachineCertificateFile /usr/local/apache2/conf/ssl.crt/proxy.pem |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyMachineCertificatePath" id="SSLProxyMachineCertificatePath">SSLProxyMachineCertificatePath</a> <a name="sslproxymachinecertificatepath" id="sslproxymachinecertificatepath">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded client certificates and keys to be used by the proxy</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyMachineCertificatePath <em>directory</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Not applicable</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the directory where you keep the certificates and |
| keys used for authentication of the proxy server to remote servers. |
| </p> |
| <p>The files in this directory must be PEM-encoded and are accessed through |
| hash filenames. Additionally, you must create symbolic links named |
| <code><em>hash-value</em>.N</code>. And you should always make sure this |
| directory contains the appropriate symbolic links.</p> |
| <div class="warning"> |
| <p>Currently there is no support for encrypted private keys</p> |
| </div> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyMachineCertificatePath /usr/local/apache2/conf/proxy.crt/ |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyProtocol" id="SSLProxyProtocol">SSLProxyProtocol</a> <a name="sslproxyprotocol" id="sslproxyprotocol">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configure usable SSL protocol flavors for proxy usage</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyProtocol [+|-]<em>protocol</em> ...</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyProtocol all</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Options</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| |
| <p> |
| This directive can be used to control the SSL protocol flavors mod_ssl should |
| use when establishing its server environment for proxy . It will only connect |
| to servers using one of the provided protocols.</p> |
| <p>Please refer to <code class="directive"><a href="#sslprotocol">SSLProtocol</a></code> |
| for additional information. |
| </p> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyVerify" id="SSLProxyVerify">SSLProxyVerify</a> <a name="sslproxyverify" id="sslproxyverify">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Type of remote server Certificate verification</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyVerify <em>level</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyVerify none</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| |
| <p>When a proxy is configured to forward requests to a remote SSL |
| server, this directive can be used to configure certificate |
| verification of the remote server. </p> |
| |
| <div class="warning"> |
| <p>Note that even when certificate verification is enabled, |
| <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> does <strong>not</strong> check whether the |
| <code>commonName</code> (hostname) attribute of the server certificate |
| matches the hostname used to connect to the server. In other words, |
| the proxy does not guarantee that the SSL connection to the backend |
| server is "secure" beyond the fact that the certificate is signed by |
| one of the CAs configured using the |
| <code class="directive">SSLProxyCACertificatePath</code> and/or |
| <code class="directive">SSLProxyCACertificateFile</code> directives. |
| In order to get this check done please have a look at |
| <code class="directive">SSLProxyCheckPeerCN</code> and |
| <code class="directive">SSLProxyCheckPeerExpire</code> directives which are off by |
| default. |
| </p> |
| </div> |
| |
| <p> |
| The following levels are available for <em>level</em>:</p> |
| <ul> |
| <li><strong>none</strong>: |
| no remote server Certificate is required at all</li> |
| <li><strong>optional</strong>: |
| the remote server <em>may</em> present a valid Certificate</li> |
| <li><strong>require</strong>: |
| the remote server <em>has to</em> present a valid Certificate</li> |
| <li><strong>optional_no_ca</strong>: |
| the remote server may present a valid Certificate<br /> |
| but it need not to be (successfully) verifiable.</li> |
| </ul> |
| <p>In practice only levels <strong>none</strong> and |
| <strong>require</strong> are really interesting, because level |
| <strong>optional</strong> doesn't work with all servers and level |
| <strong>optional_no_ca</strong> is actually against the idea of |
| authentication (but can be used to establish SSL test pages, etc.)</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyVerify require |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLProxyVerifyDepth" id="SSLProxyVerifyDepth">SSLProxyVerifyDepth</a> <a name="sslproxyverifydepth" id="sslproxyverifydepth">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Maximum depth of CA Certificates in Remote Server |
| Certificate verification</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyVerifyDepth <em>number</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyVerifyDepth 1</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets how deeply mod_ssl should verify before deciding that the |
| remote server does not have a valid certificate. </p> |
| <p> |
| The depth actually is the maximum number of intermediate certificate issuers, |
| i.e. the number of CA certificates which are max allowed to be followed while |
| verifying the remote server certificate. A depth of 0 means that self-signed |
| remote server certificates are accepted only, the default depth of 1 means |
| the remote server certificate can be self-signed or has to be signed by a CA |
| which is directly known to the server (i.e. the CA's certificate is under |
| <code class="directive"><a href="#sslproxycacertificatepath">SSLProxyCACertificatePath</a></code>), etc.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLProxyVerifyDepth 10 |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLRandomSeed" id="SSLRandomSeed">SSLRandomSeed</a> <a name="sslrandomseed" id="sslrandomseed">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Pseudo Random Number Generator (PRNG) seeding |
| source</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRandomSeed <em>context</em> <em>source</em> |
| [<em>bytes</em>]</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This configures one or more sources for seeding the Pseudo Random Number |
| Generator (PRNG) in OpenSSL at startup time (<em>context</em> is |
| <code>startup</code>) and/or just before a new SSL connection is established |
| (<em>context</em> is <code>connect</code>). This directive can only be used |
| in the global server context because the PRNG is a global facility.</p> |
| <p> |
| The following <em>source</em> variants are available:</p> |
| <ul> |
| <li><code>builtin</code> |
| <p> This is the always available builtin seeding source. Its usage |
| consumes minimum CPU cycles under runtime and hence can be always used |
| without drawbacks. The source used for seeding the PRNG contains of the |
| current time, the current process id and (when applicable) a randomly |
| chosen 1KB extract of the inter-process scoreboard structure of Apache. |
| The drawback is that this is not really a strong source and at startup |
| time (where the scoreboard is still not available) this source just |
| produces a few bytes of entropy. So you should always, at least for the |
| startup, use an additional seeding source.</p></li> |
| <li><code>file:/path/to/source</code> |
| <p> |
| This variant uses an external file <code>/path/to/source</code> as the |
| source for seeding the PRNG. When <em>bytes</em> is specified, only the |
| first <em>bytes</em> number of bytes of the file form the entropy (and |
| <em>bytes</em> is given to <code>/path/to/source</code> as the first |
| argument). When <em>bytes</em> is not specified the whole file forms the |
| entropy (and <code>0</code> is given to <code>/path/to/source</code> as |
| the first argument). Use this especially at startup time, for instance |
| with an available <code>/dev/random</code> and/or |
| <code>/dev/urandom</code> devices (which usually exist on modern Unix |
| derivatives like FreeBSD and Linux).</p> |
| <p> |
| <em>But be careful</em>: Usually <code>/dev/random</code> provides only as |
| much entropy data as it actually has, i.e. when you request 512 bytes of |
| entropy, but the device currently has only 100 bytes available two things |
| can happen: On some platforms you receive only the 100 bytes while on |
| other platforms the read blocks until enough bytes are available (which |
| can take a long time). Here using an existing <code>/dev/urandom</code> is |
| better, because it never blocks and actually gives the amount of requested |
| data. The drawback is just that the quality of the received data may not |
| be the best.</p> |
| <p> |
| On some platforms like FreeBSD one can even control how the entropy is |
| actually generated, i.e. by which system interrupts. More details one can |
| find under <em>rndcontrol(8)</em> on those platforms. Alternatively, when |
| your system lacks such a random device, you can use a tool |
| like <a href="http://www.lothar.com/tech/crypto/">EGD</a> |
| (Entropy Gathering Daemon) and run its client program with the |
| <code>exec:/path/to/program/</code> variant (see below) or use |
| <code>egd:/path/to/egd-socket</code> (see below).</p></li> |
| |
| <li><code>exec:/path/to/program</code> |
| <p> |
| This variant uses an external executable |
| <code>/path/to/program</code> as the source for seeding the |
| PRNG. When <em>bytes</em> is specified, only the first |
| <em>bytes</em> number of bytes of its <code>stdout</code> contents |
| form the entropy. When <em>bytes</em> is not specified, the |
| entirety of the data produced on <code>stdout</code> form the |
| entropy. Use this only at startup time when you need a very strong |
| seeding with the help of an external program (for instance as in |
| the example above with the <code>truerand</code> utility you can |
| find in the mod_ssl distribution which is based on the AT&T |
| <em>truerand</em> library). Using this in the connection context |
| slows down the server too dramatically, of course. So usually you |
| should avoid using external programs in that context.</p></li> |
| <li><code>egd:/path/to/egd-socket</code> (Unix only) |
| <p> |
| This variant uses the Unix domain socket of the |
| external Entropy Gathering Daemon (EGD) (see <a href="http://www.lothar.com/tech/crypto/">http://www.lothar.com/tech |
| /crypto/</a>) to seed the PRNG. Use this if no random device exists |
| on your platform.</p></li> |
| </ul> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLRandomSeed startup builtin<br /> |
| SSLRandomSeed startup file:/dev/random<br /> |
| SSLRandomSeed startup file:/dev/urandom 1024<br /> |
| SSLRandomSeed startup exec:/usr/local/bin/truerand 16<br /> |
| SSLRandomSeed connect builtin<br /> |
| SSLRandomSeed connect file:/dev/random<br /> |
| SSLRandomSeed connect file:/dev/urandom 1024<br /> |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLRenegBufferSize" id="SSLRenegBufferSize">SSLRenegBufferSize</a> <a name="sslrenegbuffersize" id="sslrenegbuffersize">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Set the size for the SSL renegotiation buffer</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRenegBufferSize <var>bytes</var></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLRenegBufferSize 131072</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| |
| <p>If an SSL renegotiation is required in per-location context, for |
| example, any use of <code class="directive"><a href="#sslverifyclient">SSLVerifyClient</a></code> in a Directory or |
| Location block, then <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> must buffer any HTTP |
| request body into memory until the new SSL handshake can be performed. |
| This directive can be used to set the amount of memory that will be |
| used for this buffer. </p> |
| |
| <div class="warning"><p> |
| Note that in many configurations, the client sending the request body |
| will be untrusted so a denial of service attack by consumption of |
| memory must be considered when changing this configuration setting. |
| </p></div> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| SSLRenegBufferSize 262144 |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLRequire" id="SSLRequire">SSLRequire</a> <a name="sslrequire" id="sslrequire">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Allow access only when an arbitrarily complex |
| boolean expression is true</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRequire <em>expression</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive specifies a general access requirement which has to be |
| fulfilled in order to allow access. It is a very powerful directive because the |
| requirement specification is an arbitrarily complex boolean expression |
| containing any number of access checks.</p> |
| <div class="warning"> |
| <p>The implementation of <code>SSLRequire</code> is not thread safe. |
| Using <code>SSLRequire</code> inside <code>.htaccess</code> files |
| on a threaded <a href="../mpm.html">MPM</a> may cause random crashes. |
| </p> |
| </div> |
| <p> |
| The <em>expression</em> must match the following syntax (given as a BNF |
| grammar notation):</p> |
| <blockquote> |
| <pre>expr ::= "<strong>true</strong>" | "<strong>false</strong>" |
| | "<strong>!</strong>" expr |
| | expr "<strong>&&</strong>" expr |
| | expr "<strong>||</strong>" expr |
| | "<strong>(</strong>" expr "<strong>)</strong>" |
| | comp |
| |
| comp ::= word "<strong>==</strong>" word | word "<strong>eq</strong>" word |
| | word "<strong>!=</strong>" word | word "<strong>ne</strong>" word |
| | word "<strong><</strong>" word | word "<strong>lt</strong>" word |
| | word "<strong><=</strong>" word | word "<strong>le</strong>" word |
| | word "<strong>></strong>" word | word "<strong>gt</strong>" word |
| | word "<strong>>=</strong>" word | word "<strong>ge</strong>" word |
| | word "<strong>in</strong>" "<strong>{</strong>" wordlist "<strong>}</strong>" |
| | word "<strong>in</strong>" "<strong>OID(</strong>" word "<strong>)</strong>" |
| | word "<strong>=~</strong>" regex |
| | word "<strong>!~</strong>" regex |
| |
| wordlist ::= word |
| | wordlist "<strong>,</strong>" word |
| |
| word ::= digit |
| | cstring |
| | variable |
| | function |
| |
| digit ::= [0-9]+ |
| cstring ::= "..." |
| variable ::= "<strong>%{</strong>" varname "<strong>}</strong>" |
| function ::= funcname "<strong>(</strong>" funcargs "<strong>)</strong>"</pre> |
| </blockquote> |
| <p>while for <code>varname</code> any variable from <a href="#table3">Table 3</a> can be used. Finally for |
| <code>funcname</code> the following functions are available:</p> |
| <ul> |
| <li><code>file(</code><em>filename</em><code>)</code> |
| <p> |
| This function takes one string argument and expands to the contents of the |
| file. This is especially useful for matching this contents against a |
| regular expression, etc.</p> |
| </li> |
| </ul> |
| <p>Notice that <em>expression</em> is first parsed into an internal machine |
| representation and then evaluated in a second step. Actually, in Global and |
| Per-Server Class context <em>expression</em> is parsed at startup time and |
| at runtime only the machine representation is executed. For Per-Directory |
| context, specifically in a .htaccess context, this is different: here <em> |
| expression</em> has to be parsed and immediately executed for every request.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \<br /> |
| and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \<br /> |
| and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \<br /> |
| and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \<br /> |
| and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \<br /> |
| or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ |
| </code></p></div> |
| <p>The <code>OID()</code> function expects to find zero or more instances |
| of the given OID in the client certificate, and compares the left-hand side |
| string against the value of matching OID attributes. Every matching OID is |
| checked, until a match is found. |
| </p> |
| |
| <p><em>Standard CGI/1.0 and Apache variables:</em></p> |
| <pre>HTTP_USER_AGENT PATH_INFO AUTH_TYPE |
| HTTP_REFERER QUERY_STRING SERVER_SOFTWARE |
| HTTP_COOKIE REMOTE_HOST API_VERSION |
| HTTP_FORWARDED REMOTE_IDENT TIME_YEAR |
| HTTP_HOST IS_SUBREQ TIME_MON |
| HTTP_PROXY_CONNECTION DOCUMENT_ROOT TIME_DAY |
| HTTP_ACCEPT SERVER_ADMIN TIME_HOUR |
| HTTP:headername SERVER_NAME TIME_MIN |
| THE_REQUEST SERVER_PORT TIME_SEC |
| REQUEST_METHOD SERVER_PROTOCOL TIME_WDAY |
| REQUEST_SCHEME REMOTE_ADDR TIME |
| REQUEST_URI REMOTE_USER ENV:<strong>variablename</strong> |
| REQUEST_FILENAME</pre> |
| <p><em>SSL-related variables:</em></p> |
| <pre>HTTPS SSL_CLIENT_M_VERSION SSL_SERVER_M_VERSION |
| SSL_CLIENT_M_SERIAL SSL_SERVER_M_SERIAL |
| SSL_PROTOCOL SSL_CLIENT_V_START SSL_SERVER_V_START |
| SSL_SESSION_ID SSL_CLIENT_V_END SSL_SERVER_V_END |
| SSL_CIPHER SSL_CLIENT_S_DN SSL_SERVER_S_DN |
| SSL_CIPHER_EXPORT SSL_CLIENT_S_DN_C SSL_SERVER_S_DN_C |
| SSL_CIPHER_ALGKEYSIZE SSL_CLIENT_S_DN_ST SSL_SERVER_S_DN_ST |
| SSL_CIPHER_USEKEYSIZE SSL_CLIENT_S_DN_L SSL_SERVER_S_DN_L |
| SSL_VERSION_LIBRARY SSL_CLIENT_S_DN_O SSL_SERVER_S_DN_O |
| SSL_VERSION_INTERFACE SSL_CLIENT_S_DN_OU SSL_SERVER_S_DN_OU |
| SSL_CLIENT_S_DN_CN SSL_SERVER_S_DN_CN |
| SSL_CLIENT_S_DN_T SSL_SERVER_S_DN_T |
| SSL_CLIENT_S_DN_I SSL_SERVER_S_DN_I |
| SSL_CLIENT_S_DN_G SSL_SERVER_S_DN_G |
| SSL_CLIENT_S_DN_S SSL_SERVER_S_DN_S |
| SSL_CLIENT_S_DN_D SSL_SERVER_S_DN_D |
| SSL_CLIENT_S_DN_UID SSL_SERVER_S_DN_UID |
| SSL_CLIENT_S_DN_Email SSL_SERVER_S_DN_Email |
| SSL_CLIENT_I_DN SSL_SERVER_I_DN |
| SSL_CLIENT_I_DN_C SSL_SERVER_I_DN_C |
| SSL_CLIENT_I_DN_ST SSL_SERVER_I_DN_ST |
| SSL_CLIENT_I_DN_L SSL_SERVER_I_DN_L |
| SSL_CLIENT_I_DN_O SSL_SERVER_I_DN_O |
| SSL_CLIENT_I_DN_OU SSL_SERVER_I_DN_OU |
| SSL_CLIENT_I_DN_CN SSL_SERVER_I_DN_CN |
| SSL_CLIENT_I_DN_T SSL_SERVER_I_DN_T |
| SSL_CLIENT_I_DN_I SSL_SERVER_I_DN_I |
| SSL_CLIENT_I_DN_G SSL_SERVER_I_DN_G |
| SSL_CLIENT_I_DN_S SSL_SERVER_I_DN_S |
| SSL_CLIENT_I_DN_D SSL_SERVER_I_DN_D |
| SSL_CLIENT_I_DN_UID SSL_SERVER_I_DN_UID |
| SSL_CLIENT_I_DN_Email SSL_SERVER_I_DN_Email |
| SSL_CLIENT_A_SIG SSL_SERVER_A_SIG |
| SSL_CLIENT_A_KEY SSL_SERVER_A_KEY |
| SSL_CLIENT_CERT SSL_SERVER_CERT |
| SSL_CLIENT_CERT_CHAIN_<strong>n</strong> |
| SSL_CLIENT_VERIFY SSL_TLS_SNI</pre> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLRequireSSL" id="SSLRequireSSL">SSLRequireSSL</a> <a name="sslrequiressl" id="sslrequiressl">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Deny access when SSL is not used for the |
| HTTP request</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRequireSSL</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive forbids access unless HTTP over SSL (i.e. HTTPS) is enabled for |
| the current connection. This is very handy inside the SSL-enabled virtual |
| host or directories for defending against configuration errors that expose |
| stuff that should be protected. When this directive is present all requests |
| are denied which are not using SSL.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLRequireSSL |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLSessionCache" id="SSLSessionCache">SSLSessionCache</a> <a name="sslsessioncache" id="sslsessioncache">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Type of the global/inter-process SSL Session |
| Cache</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLSessionCache <em>type</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLSessionCache none</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This configures the storage type of the global/inter-process SSL Session |
| Cache. This cache is an optional facility which speeds up parallel request |
| processing. For requests to the same server process (via HTTP keep-alive), |
| OpenSSL already caches the SSL session information locally. But because modern |
| clients request inlined images and other data via parallel requests (usually |
| up to four parallel requests are common) those requests are served by |
| <em>different</em> pre-forked server processes. Here an inter-process cache |
| helps to avoid unnecessary session handshakes.</p> |
| <p> |
| The following four storage <em>type</em>s are currently supported:</p> |
| <ul> |
| <li><code>none</code> |
| |
| <p>This disables the global/inter-process Session Cache. This |
| will incur a noticeable speed penalty and may cause problems if |
| using certain browsers, particularly if client certificates are |
| enabled. This setting is not recommended.</p></li> |
| |
| <li><code>nonenotnull</code> |
| |
| <p>This disables any global/inter-process Session Cache. However |
| it does force OpenSSL to send a non-null session ID to |
| accommodate buggy clients that require one.</p></li> |
| |
| <li><code>dbm:/path/to/datafile</code> |
| |
| <p>This makes use of a DBM hashfile on the local disk to |
| synchronize the local OpenSSL memory caches of the server |
| processes. This session cache may suffer reliability issues under |
| high load.</p></li> |
| |
| <li><code>shm:/path/to/datafile</code>[<code>(</code><em>size</em><code>)</code>] |
| |
| <p>This makes use of a high-performance cyclic buffer |
| (approx. <em>size</em> bytes in size) inside a shared memory |
| segment in RAM (established via <code>/path/to/datafile</code>) to |
| synchronize the local OpenSSL memory caches of the server |
| processes. This is the recommended session cache.</p></li> |
| |
| <li><code>dc:UNIX:/path/to/socket</code> |
| |
| <p>This makes use of the <a href="http://www.distcache.org/">distcache</a> distributed session |
| caching libraries. The argument should specify the location of |
| the server or proxy to be used using the distcache address syntax; |
| for example, <code>UNIX:/path/to/socket</code> specifies a UNIX |
| domain socket (typically a local dc_client proxy); |
| <code>IP:server.example.com:9001</code> specifies an IP |
| address.</p></li> |
| |
| </ul> |
| <div class="example"><h3>Examples</h3><p><code> |
| SSLSessionCache dbm:/usr/local/apache/logs/ssl_gcache_data<br /> |
| SSLSessionCache shm:/usr/local/apache/logs/ssl_gcache_data(512000) |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLSessionCacheTimeout" id="SSLSessionCacheTimeout">SSLSessionCacheTimeout</a> <a name="sslsessioncachetimeout" id="sslsessioncachetimeout">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Number of seconds before an SSL session expires |
| in the Session Cache</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLSessionCacheTimeout <em>seconds</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLSessionCacheTimeout 300</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Applies also to RFC 5077 TLS session resumption in Apache 2.2.28 and later</td></tr> |
| </table> |
| <p> |
| This directive sets the timeout in seconds for the information stored in the |
| global/inter-process SSL Session Cache, the OpenSSL internal memory cache and |
| for sessions resumed by TLS session resumption (RFC 5077). |
| It can be set as low as 15 for testing, but should be set to higher |
| values like 300 in real life.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLSessionCacheTimeout 600 |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLSessionTicketKeyFile" id="SSLSessionTicketKeyFile">SSLSessionTicketKeyFile</a> <a name="sslsessionticketkeyfile" id="sslsessionticketkeyfile">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Persistent encryption/decryption key for TLS session tickets</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLSessionTicketKeyFile <em>file-path</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.2.30 and later, if using OpenSSL 0.9.8h or later</td></tr> |
| </table> |
| <p>Optionally configures a secret key for encrypting and decrypting |
| TLS session tickets, as defined in |
| <a href="http://www.ietf.org/rfc/rfc5077.txt">RFC 5077</a>. |
| Primarily suitable for clustered environments where TLS sessions information |
| should be shared between multiple nodes. For single-instance httpd setups, |
| it is recommended to <em>not</em> configure a ticket key file, but to |
| rely on (random) keys generated by mod_ssl at startup, instead.</p> |
| <p>The ticket key file must contain 48 bytes of random data, |
| preferrably created from a high-entropy source. On a Unix-based system, |
| a ticket key file can be created as follows:</p> |
| |
| <div class="example"><p><code> |
| dd if=/dev/random of=/path/to/file.tkey bs=1 count=48 |
| </code></p></div> |
| |
| <p>Ticket keys should be rotated (replaced) on a frequent basis, |
| as this is the only way to invalidate an existing session ticket - |
| OpenSSL currently doesn't allow to specify a limit for ticket lifetimes. |
| A new ticket key only gets used after restarting the web server. |
| All existing session tickets become invalid after a restart.</p> |
| |
| <div class="warning"> |
| <p>The ticket key file contains sensitive keying material and should |
| be protected with file permissions similar to those used for |
| <code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code>.</p> |
| </div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLSessionTickets" id="SSLSessionTickets">SSLSessionTickets</a> <a name="sslsessiontickets" id="sslsessiontickets">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable or disable use of TLS session tickets</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLSessionTickets on|off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLSessionTickets on</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.2.30 and later, if using OpenSSL 0.9.8f |
| or later.</td></tr> |
| </table> |
| <p>This directive allows to enable or disable the use of TLS session tickets |
| (RFC 5077).</p> |
| <div class="warning"> |
| <p>TLS session tickets are enabled by default. Using them without restarting |
| the web server with an appropriate frequency (e.g. daily) compromises perfect |
| forward secrecy.</p> |
| </div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLStrictSNIVHostCheck" id="SSLStrictSNIVHostCheck">SSLStrictSNIVHostCheck</a> <a name="sslstrictsnivhostcheck" id="sslstrictsnivhostcheck">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Whether to allow non SNI clients to access a name based virtual |
| host. |
| </td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLStrictSNIVHostCheck on|off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLStrictSNIVHostCheck off</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.2.12 and later</td></tr> |
| </table> |
| <p> |
| This directive sets whether a non SNI client is allowed to access a name based |
| virtual host. If set to <code>on</code> in the non default name based virtual |
| host, non SNI clients are not allowed to access this particular virtual host. |
| If set to <code>on</code> in the default name based virtual host, non SNI |
| clients are not allowed to access any name based virtual host belonging to |
| this IP / port combination. |
| </p> |
| |
| <div class="warning"><p> |
| This option is only available if httpd was compiled against an SNI capable |
| version of OpenSSL. |
| </p></div> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| SSLStrictSNIVHostCheck on |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLUserName" id="SSLUserName">SSLUserName</a> <a name="sslusername" id="sslusername">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Variable name to determine user name</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLUserName <em>varname</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.0.51 and later</td></tr> |
| </table> |
| <p> |
| This directive sets the "user" field in the Apache request object. |
| This is used by lower modules to identify the user with a character |
| string. In particular, this may cause the environment variable |
| <code>REMOTE_USER</code> to be set. The <em>varname</em> can be |
| any of the <a href="#envvars">SSL environment variables</a>.</p> |
| |
| <p>Note that this directive has no effect if the |
| <code>FakeBasicAuth</code> option is used (see <a href="#ssloptions">SSLOptions</a>).</p> |
| |
| <div class="example"><h3>Example</h3><p><code> |
| SSLUserName SSL_CLIENT_S_DN_CN |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLVerifyClient" id="SSLVerifyClient">SSLVerifyClient</a> <a name="sslverifyclient" id="sslverifyclient">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Type of Client Certificate verification</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLVerifyClient <em>level</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLVerifyClient none</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets the Certificate verification level for the Client |
| Authentication. Notice that this directive can be used both in per-server and |
| per-directory context. In per-server context it applies to the client |
| authentication process used in the standard SSL handshake when a connection is |
| established. In per-directory context it forces a SSL renegotiation with the |
| reconfigured client verification level after the HTTP request was read but |
| before the HTTP response is sent.</p> |
| <p> |
| The following levels are available for <em>level</em>:</p> |
| <ul> |
| <li><strong>none</strong>: |
| no client Certificate is required at all</li> |
| <li><strong>optional</strong>: |
| the client <em>may</em> present a valid Certificate</li> |
| <li><strong>require</strong>: |
| the client <em>has to</em> present a valid Certificate</li> |
| <li><strong>optional_no_ca</strong>: |
| the client may present a valid Certificate<br /> |
| but it need not to be (successfully) verifiable.</li> |
| </ul> |
| <p>In practice only levels <strong>none</strong> and |
| <strong>require</strong> are really interesting, because level |
| <strong>optional</strong> doesn't work with all browsers and level |
| <strong>optional_no_ca</strong> is actually against the idea of |
| authentication (but can be used to establish SSL test pages, etc.)</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLVerifyClient require |
| </code></p></div> |
| |
| </div> |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> |
| <div class="directive-section"><h2><a name="SSLVerifyDepth" id="SSLVerifyDepth">SSLVerifyDepth</a> <a name="sslverifydepth" id="sslverifydepth">Directive</a></h2> |
| <table class="directive"> |
| <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Maximum depth of CA Certificates in Client |
| Certificate verification</td></tr> |
| <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLVerifyDepth <em>number</em></code></td></tr> |
| <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLVerifyDepth 1</code></td></tr> |
| <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> |
| <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> |
| <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> |
| <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> |
| </table> |
| <p> |
| This directive sets how deeply mod_ssl should verify before deciding that the |
| clients don't have a valid certificate. Notice that this directive can be |
| used both in per-server and per-directory context. In per-server context it |
| applies to the client authentication process used in the standard SSL |
| handshake when a connection is established. In per-directory context it forces |
| a SSL renegotiation with the reconfigured client verification depth after the |
| HTTP request was read but before the HTTP response is sent.</p> |
| <p> |
| The depth actually is the maximum number of intermediate certificate issuers, |
| i.e. the number of CA certificates which are max allowed to be followed while |
| verifying the client certificate. A depth of 0 means that self-signed client |
| certificates are accepted only, the default depth of 1 means the client |
| certificate can be self-signed or has to be signed by a CA which is directly |
| known to the server (i.e. the CA's certificate is under |
| <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code>), etc.</p> |
| <div class="example"><h3>Example</h3><p><code> |
| SSLVerifyDepth 10 |
| </code></p></div> |
| |
| </div> |
| </div> |
| <div class="bottomlang"> |
| <p><span>Available Languages: </span><a href="../en/mod/mod_ssl.html" title="English"> en </a></p> |
| </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Libera.chat, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> |
| <script type="text/javascript"><!--//--><![CDATA[//><!-- |
| var comments_shortname = 'httpd'; |
| var comments_identifier = 'http://httpd.apache.org/docs/2.2/mod/mod_ssl.html'; |
| (function(w, d) { |
| if (w.location.hostname.toLowerCase() == "httpd.apache.org") { |
| d.write('<div id="comments_thread"><\/div>'); |
| var s = d.createElement('script'); |
| s.type = 'text/javascript'; |
| s.async = true; |
| s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; |
| (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); |
| } |
| else { |
| d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); |
| } |
| })(window, document); |
| //--><!]]></script></div><div id="footer"> |
| <p class="apache">Copyright 2018 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> |
| <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- |
| if (typeof(prettyPrint) !== 'undefined') { |
| prettyPrint(); |
| } |
| //--><!]]></script> |
| </body></html> |
