github.com/krum110487/go-htaccess@v0.0.0-20240316004156-60641c8e7598/tests/data/apache_2_2_34/manual/mod/mod_ssl.html.en (about) 1 <?xml version="1.0" encoding="ISO-8859-1"?> 2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head> 4 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" /> 5 <!-- 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 This file is generated from xml source: DO NOT EDIT 8 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 9 --> 10 <title>mod_ssl - Apache HTTP Server Version 2.2</title> 11 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 12 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 13 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" /> 14 <script src="../style/scripts/prettify.min.js" type="text/javascript"> 15 </script> 16 17 <link href="../images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/mod/mod_ssl.html" rel="canonical" /></head> 18 <body> 19 <div id="page-header"> 20 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p> 21 <p class="apache">Apache HTTP Server Version 2.2</p> 22 <img alt="" src="../images/feather.gif" /></div> 23 <div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div> 24 <div id="path"> 25 <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.2</a> > <a href="./">Modules</a></div> 26 <div id="page-content"> 27 <div class="retired"><h4>Please note</h4> 28 <p> This document refers to a legacy release (<strong>2.2</strong>) of Apache httpd. The active release (<strong>2.4</strong>) is documented <a href="http://httpd.apache.org/docs/current">here</a>. If you have not already upgraded, please follow <a href="http://httpd.apache.org/docs/current/upgrading.html">this link</a> for more information.</p> 29 <p>You may follow <a href="http://httpd.apache.org/docs/current/mod/mod_ssl.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Apache Module mod_ssl</h1> 30 <div class="toplang"> 31 <p><span>Available Languages: </span><a href="../en/mod/mod_ssl.html" title="English"> en </a></p> 32 </div> 33 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Strong cryptography using the Secure Sockets 34 Layer (SSL) and Transport Layer Security (TLS) protocols</td></tr> 35 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr> 36 <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>ssl_module</td></tr> 37 <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_ssl.c</td></tr></table> 38 <h3>Summary</h3> 39 40 <p>This module provides SSL v2/v3 and TLS v1 support for the Apache 41 HTTP Server. It was contributed by Ralf S. Engeschall based on his 42 mod_ssl project and originally derived from work by Ben Laurie.</p> 43 44 <p>This module relies on <a href="http://www.openssl.org/">OpenSSL</a> 45 to provide the cryptography engine.</p> 46 47 <p>Further details, discussion, and examples are provided in the 48 <a href="../ssl/">SSL documentation</a>.</p> 49 </div> 50 <div id="quickview"><h3>Topics</h3> 51 <ul id="topics"> 52 <li><img alt="" src="../images/down.gif" /> <a href="#envvars">Environment Variables</a></li> 53 <li><img alt="" src="../images/down.gif" /> <a href="#logformats">Custom Log Formats</a></li> 54 </ul><h3 class="directives">Directives</h3> 55 <ul id="toc"> 56 <li><img alt="" src="../images/down.gif" /> <a href="#sslcacertificatefile">SSLCACertificateFile</a></li> 57 <li><img alt="" src="../images/down.gif" /> <a href="#sslcacertificatepath">SSLCACertificatePath</a></li> 58 <li><img alt="" src="../images/down.gif" /> <a href="#sslcadnrequestfile">SSLCADNRequestFile</a></li> 59 <li><img alt="" src="../images/down.gif" /> <a href="#sslcadnrequestpath">SSLCADNRequestPath</a></li> 60 <li><img alt="" src="../images/down.gif" /> <a href="#sslcarevocationfile">SSLCARevocationFile</a></li> 61 <li><img alt="" src="../images/down.gif" /> <a href="#sslcarevocationpath">SSLCARevocationPath</a></li> 62 <li><img alt="" src="../images/down.gif" /> <a href="#sslcertificatechainfile">SSLCertificateChainFile</a></li> 63 <li><img alt="" src="../images/down.gif" /> <a href="#sslcertificatefile">SSLCertificateFile</a></li> 64 <li><img alt="" src="../images/down.gif" /> <a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></li> 65 <li><img alt="" src="../images/down.gif" /> <a href="#sslciphersuite">SSLCipherSuite</a></li> 66 <li><img alt="" src="../images/down.gif" /> <a href="#sslcompression">SSLCompression</a></li> 67 <li><img alt="" src="../images/down.gif" /> <a href="#sslcryptodevice">SSLCryptoDevice</a></li> 68 <li><img alt="" src="../images/down.gif" /> <a href="#sslengine">SSLEngine</a></li> 69 <li><img alt="" src="../images/down.gif" /> <a href="#sslfips">SSLFIPS</a></li> 70 <li><img alt="" src="../images/down.gif" /> <a href="#sslhonorcipherorder">SSLHonorCipherOrder</a></li> 71 <li><img alt="" src="../images/down.gif" /> <a href="#sslinsecurerenegotiation">SSLInsecureRenegotiation</a></li> 72 <li><img alt="" src="../images/down.gif" /> <a href="#sslmutex">SSLMutex</a></li> 73 <li><img alt="" src="../images/down.gif" /> <a href="#ssloptions">SSLOptions</a></li> 74 <li><img alt="" src="../images/down.gif" /> <a href="#sslpassphrasedialog">SSLPassPhraseDialog</a></li> 75 <li><img alt="" src="../images/down.gif" /> <a href="#sslprotocol">SSLProtocol</a></li> 76 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycacertificatefile">SSLProxyCACertificateFile</a></li> 77 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycacertificatepath">SSLProxyCACertificatePath</a></li> 78 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycarevocationfile">SSLProxyCARevocationFile</a></li> 79 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycarevocationpath">SSLProxyCARevocationPath</a></li> 80 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycheckpeercn">SSLProxyCheckPeerCN</a></li> 81 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxycheckpeerexpire">SSLProxyCheckPeerExpire</a></li> 82 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyciphersuite">SSLProxyCipherSuite</a></li> 83 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyengine">SSLProxyEngine</a></li> 84 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxymachinecertificatechainfile">SSLProxyMachineCertificateChainFile</a></li> 85 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxymachinecertificatefile">SSLProxyMachineCertificateFile</a></li> 86 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxymachinecertificatepath">SSLProxyMachineCertificatePath</a></li> 87 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyprotocol">SSLProxyProtocol</a></li> 88 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyverify">SSLProxyVerify</a></li> 89 <li><img alt="" src="../images/down.gif" /> <a href="#sslproxyverifydepth">SSLProxyVerifyDepth</a></li> 90 <li><img alt="" src="../images/down.gif" /> <a href="#sslrandomseed">SSLRandomSeed</a></li> 91 <li><img alt="" src="../images/down.gif" /> <a href="#sslrenegbuffersize">SSLRenegBufferSize</a></li> 92 <li><img alt="" src="../images/down.gif" /> <a href="#sslrequire">SSLRequire</a></li> 93 <li><img alt="" src="../images/down.gif" /> <a href="#sslrequiressl">SSLRequireSSL</a></li> 94 <li><img alt="" src="../images/down.gif" /> <a href="#sslsessioncache">SSLSessionCache</a></li> 95 <li><img alt="" src="../images/down.gif" /> <a href="#sslsessioncachetimeout">SSLSessionCacheTimeout</a></li> 96 <li><img alt="" src="../images/down.gif" /> <a href="#sslsessionticketkeyfile">SSLSessionTicketKeyFile</a></li> 97 <li><img alt="" src="../images/down.gif" /> <a href="#sslsessiontickets">SSLSessionTickets</a></li> 98 <li><img alt="" src="../images/down.gif" /> <a href="#sslstrictsnivhostcheck">SSLStrictSNIVHostCheck</a></li> 99 <li><img alt="" src="../images/down.gif" /> <a href="#sslusername">SSLUserName</a></li> 100 <li><img alt="" src="../images/down.gif" /> <a href="#sslverifyclient">SSLVerifyClient</a></li> 101 <li><img alt="" src="../images/down.gif" /> <a href="#sslverifydepth">SSLVerifyDepth</a></li> 102 </ul> 103 <ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> 104 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 105 <div class="section"> 106 <h2><a name="envvars" id="envvars">Environment Variables</a></h2> 107 108 <p>This module can be configured to provide several items of SSL information 109 as additional environment variables to the SSI and CGI namespace. This 110 information is not provided by default for performance reasons. (See 111 <code class="directive">SSLOptions</code> StdEnvVars, below.) The generated variables 112 are listed in the table below. For backward compatibility the information can 113 be made available under different names, too. Look in the <a href="../ssl/ssl_compat.html">Compatibility</a> chapter for details on the 114 compatibility variables.</p> 115 116 <table class="bordered"> 117 118 <tr> 119 <th><a name="table3">Variable Name:</a></th> 120 <th>Value Type:</th> 121 <th>Description:</th> 122 </tr> 123 <tr><td><code>HTTPS</code></td> <td>flag</td> <td>HTTPS is being used.</td></tr> 124 <tr><td><code>SSL_PROTOCOL</code></td> <td>string</td> <td>The SSL protocol version (SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2)</td></tr> 125 <tr><td><code>SSL_SESSION_ID</code></td> <td>string</td> <td>The hex-encoded SSL session id</td></tr> 126 <tr><td><code>SSL_CIPHER</code></td> <td>string</td> <td>The cipher specification name</td></tr> 127 <tr><td><code>SSL_CIPHER_EXPORT</code></td> <td>string</td> <td><code>true</code> if cipher is an export cipher</td></tr> 128 <tr><td><code>SSL_CIPHER_USEKEYSIZE</code></td> <td>number</td> <td>Number of cipher bits (actually used)</td></tr> 129 <tr><td><code>SSL_CIPHER_ALGKEYSIZE</code></td> <td>number</td> <td>Number of cipher bits (possible)</td></tr> 130 <tr><td><code>SSL_COMPRESS_METHOD</code></td> <td>string</td> <td>SSL compression method negotiated</td></tr> 131 <tr><td><code>SSL_VERSION_INTERFACE</code></td> <td>string</td> <td>The mod_ssl program version</td></tr> 132 <tr><td><code>SSL_VERSION_LIBRARY</code></td> <td>string</td> <td>The OpenSSL program version</td></tr> 133 <tr><td><code>SSL_CLIENT_M_VERSION</code></td> <td>string</td> <td>The version of the client certificate</td></tr> 134 <tr><td><code>SSL_CLIENT_M_SERIAL</code></td> <td>string</td> <td>The serial of the client certificate</td></tr> 135 <tr><td><code>SSL_CLIENT_S_DN</code></td> <td>string</td> <td>Subject DN in client's certificate</td></tr> 136 <tr><td><code>SSL_CLIENT_S_DN_</code><em>x509</em></td> <td>string</td> <td>Component of client's Subject DN</td></tr> 137 <tr><td><code>SSL_CLIENT_I_DN</code></td> <td>string</td> <td>Issuer DN of client's certificate</td></tr> 138 <tr><td><code>SSL_CLIENT_I_DN_</code><em>x509</em></td> <td>string</td> <td>Component of client's Issuer DN</td></tr> 139 <tr><td><code>SSL_CLIENT_V_START</code></td> <td>string</td> <td>Validity of client's certificate (start time)</td></tr> 140 <tr><td><code>SSL_CLIENT_V_END</code></td> <td>string</td> <td>Validity of client's certificate (end time)</td></tr> 141 <tr><td><code>SSL_CLIENT_V_REMAIN</code></td> <td>string</td> <td>Number of days until client's certificate expires</td></tr> 142 <tr><td><code>SSL_CLIENT_A_SIG</code></td> <td>string</td> <td>Algorithm used for the signature of client's certificate</td></tr> 143 <tr><td><code>SSL_CLIENT_A_KEY</code></td> <td>string</td> <td>Algorithm used for the public key of client's certificate</td></tr> 144 <tr><td><code>SSL_CLIENT_CERT</code></td> <td>string</td> <td>PEM-encoded client certificate</td></tr> 145 <tr><td><code>SSL_CLIENT_CERT_CHAIN_</code><em>n</em></td> <td>string</td> <td>PEM-encoded certificates in client certificate chain</td></tr> 146 <tr><td><code>SSL_CLIENT_VERIFY</code></td> <td>string</td> <td><code>NONE</code>, <code>SUCCESS</code>, <code>GENEROUS</code> or <code>FAILED:</code><em>reason</em></td></tr> 147 <tr><td><code>SSL_SERVER_M_VERSION</code></td> <td>string</td> <td>The version of the server certificate</td></tr> 148 <tr><td><code>SSL_SERVER_M_SERIAL</code></td> <td>string</td> <td>The serial of the server certificate</td></tr> 149 <tr><td><code>SSL_SERVER_S_DN</code></td> <td>string</td> <td>Subject DN in server's certificate</td></tr> 150 <tr><td><code>SSL_SERVER_S_DN_</code><em>x509</em></td> <td>string</td> <td>Component of server's Subject DN</td></tr> 151 <tr><td><code>SSL_SERVER_I_DN</code></td> <td>string</td> <td>Issuer DN of server's certificate</td></tr> 152 <tr><td><code>SSL_SERVER_I_DN_</code><em>x509</em></td> <td>string</td> <td>Component of server's Issuer DN</td></tr> 153 <tr><td><code>SSL_SERVER_V_START</code></td> <td>string</td> <td>Validity of server's certificate (start time)</td></tr> 154 <tr><td><code>SSL_SERVER_V_END</code></td> <td>string</td> <td>Validity of server's certificate (end time)</td></tr> 155 <tr><td><code>SSL_SERVER_A_SIG</code></td> <td>string</td> <td>Algorithm used for the signature of server's certificate</td></tr> 156 <tr><td><code>SSL_SERVER_A_KEY</code></td> <td>string</td> <td>Algorithm used for the public key of server's certificate</td></tr> 157 <tr><td><code>SSL_SERVER_CERT</code></td> <td>string</td> <td>PEM-encoded server certificate</td></tr> 158 <tr><td><code>SSL_TLS_SNI</code></td> <td>string</td> <td>Contents of the SNI TLS extension (if supplied with ClientHello)</td></tr> 159 </table> 160 161 <p><em>x509</em> specifies a component of an X.509 DN; one of 162 <code>C,ST,L,O,OU,CN,T,I,G,S,D,UID,Email</code>. In Apache 2.1 and 163 later, <em>x509</em> may also include a numeric <code>_n</code> 164 suffix. If the DN in question contains multiple attributes of the 165 same name, this suffix is used as an index to select a particular 166 attribute. For example, where the server certificate subject DN 167 included two OU fields, <code>SSL_SERVER_S_DN_OU_0</code> and 168 <code>SSL_SERVER_S_DN_OU_1</code> could be used to reference each.</p> 169 170 <p><code>SSL_CLIENT_V_REMAIN</code> is only available in version 2.1 171 and later.</p> 172 173 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 174 <div class="section"> 175 <h2><a name="logformats" id="logformats">Custom Log Formats</a></h2> 176 177 <p>When <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> is built into Apache or at least 178 loaded (under DSO situation) additional functions exist for the <a href="mod_log_config.html#formats">Custom Log Format</a> of 179 <code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code>. First there is an 180 additional ``<code>%{</code><em>varname</em><code>}x</code>'' 181 eXtension format function which can be used to expand any variables 182 provided by any module, especially those provided by mod_ssl which can 183 you find in the above table.</p> 184 <p> 185 For backward compatibility there is additionally a special 186 ``<code>%{</code><em>name</em><code>}c</code>'' cryptography format function 187 provided. Information about this function is provided in the <a href="../ssl/ssl_compat.html">Compatibility</a> chapter.</p> 188 <div class="example"><h3>Example</h3><p><code> 189 CustomLog logs/ssl_request_log \ 190 "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" 191 </code></p></div> 192 <p>These formats even work without setting the <code>StdEnvVars</code> 193 option of the <code class="directive"><a href="#ssloptions">SSLOptions</a></code> 194 directive.</p> 195 </div> 196 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 197 <div class="directive-section"><h2><a name="SSLCACertificateFile" id="SSLCACertificateFile">SSLCACertificateFile</a> <a name="sslcacertificatefile" id="sslcacertificatefile">Directive</a></h2> 198 <table class="directive"> 199 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA Certificates 200 for Client Auth</td></tr> 201 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCACertificateFile <em>file-path</em></code></td></tr> 202 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 203 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 204 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 205 </table> 206 <p> 207 This directive sets the <em>all-in-one</em> file where you can assemble the 208 Certificates of Certification Authorities (CA) whose <em>clients</em> you deal 209 with. These are used for Client Authentication. Such a file is simply the 210 concatenation of the various PEM-encoded Certificate files, in order of 211 preference. This can be used alternatively and/or additionally to 212 <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code>.</p> 213 <div class="example"><h3>Example</h3><p><code> 214 SSLCACertificateFile /usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt 215 </code></p></div> 216 217 </div> 218 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 219 <div class="directive-section"><h2><a name="SSLCACertificatePath" id="SSLCACertificatePath">SSLCACertificatePath</a> <a name="sslcacertificatepath" id="sslcacertificatepath">Directive</a></h2> 220 <table class="directive"> 221 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA Certificates for 222 Client Auth</td></tr> 223 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCACertificatePath <em>directory-path</em></code></td></tr> 224 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 225 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 226 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 227 </table> 228 <p> 229 This directive sets the directory where you keep the Certificates of 230 Certification Authorities (CAs) whose clients you deal with. These are used to 231 verify the client certificate on Client Authentication.</p> 232 <p> 233 The files in this directory have to be PEM-encoded and are accessed through 234 hash filenames. So usually you can't just place the Certificate files 235 there: you also have to create symbolic links named 236 <em>hash-value</em><code>.N</code>. And you should always make sure this directory 237 contains the appropriate symbolic links.</p> 238 <div class="example"><h3>Example</h3><p><code> 239 SSLCACertificatePath /usr/local/apache2/conf/ssl.crt/ 240 </code></p></div> 241 242 </div> 243 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 244 <div class="directive-section"><h2><a name="SSLCADNRequestFile" id="SSLCADNRequestFile">SSLCADNRequestFile</a> <a name="sslcadnrequestfile" id="sslcadnrequestfile">Directive</a></h2> 245 <table class="directive"> 246 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA Certificates 247 for defining acceptable CA names</td></tr> 248 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCADNRequestFile <em>file-path</em></code></td></tr> 249 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 250 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 251 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 252 </table> 253 <p>When a client certificate is requested by mod_ssl, a list of 254 <em>acceptable Certificate Authority names</em> is sent to the client 255 in the SSL handshake. These CA names can be used by the client to 256 select an appropriate client certificate out of those it has 257 available.</p> 258 259 <p>If neither of the directives <code class="directive"><a href="#sslcadnrequestpath">SSLCADNRequestPath</a></code> or <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code> are given, then the 260 set of acceptable CA names sent to the client is the names of all the 261 CA certificates given by the <code class="directive"><a href="#sslcacertificatefile">SSLCACertificateFile</a></code> and <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code> directives; in other 262 words, the names of the CAs which will actually be used to verify the 263 client certificate.</p> 264 265 <p>In some circumstances, it is useful to be able to send a set of 266 acceptable CA names which differs from the actual CAs used to verify 267 the client certificate - for example, if the client certificates are 268 signed by intermediate CAs. In such cases, <code class="directive"><a href="#sslcadnrequestpath">SSLCADNRequestPath</a></code> and/or <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code> can be used; the 269 acceptable CA names are then taken from the complete set of 270 certificates in the directory and/or file specified by this pair of 271 directives.</p> 272 273 <p><code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code> must 274 specify an <em>all-in-one</em> file containing a concatenation of 275 PEM-encoded CA certificates.</p> 276 277 <div class="example"><h3>Example</h3><p><code> 278 SSLCADNRequestFile /usr/local/apache2/conf/ca-names.crt 279 </code></p></div> 280 281 </div> 282 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 283 <div class="directive-section"><h2><a name="SSLCADNRequestPath" id="SSLCADNRequestPath">SSLCADNRequestPath</a> <a name="sslcadnrequestpath" id="sslcadnrequestpath">Directive</a></h2> 284 <table class="directive"> 285 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA Certificates for 286 defining acceptable CA names</td></tr> 287 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCADNRequestPath <em>directory-path</em></code></td></tr> 288 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 289 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 290 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 291 </table> 292 293 <p>This optional directive can be used to specify the set of 294 <em>acceptable CA names</em> which will be sent to the client when a 295 client certificate is requested. See the <code class="directive"><a href="#sslcadnrequestfile">SSLCADNRequestFile</a></code> directive for more 296 details.</p> 297 298 <p>The files in this directory have to be PEM-encoded and are accessed 299 through hash filenames. So usually you can't just place the 300 Certificate files there: you also have to create symbolic links named 301 <em>hash-value</em><code>.N</code>. And you should always make sure 302 this directory contains the appropriate symbolic links.</p> 303 <div class="example"><h3>Example</h3><p><code> 304 SSLCADNRequestPath /usr/local/apache2/conf/ca-names.crt/ 305 </code></p></div> 306 307 </div> 308 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 309 <div class="directive-section"><h2><a name="SSLCARevocationFile" id="SSLCARevocationFile">SSLCARevocationFile</a> <a name="sslcarevocationfile" id="sslcarevocationfile">Directive</a></h2> 310 <table class="directive"> 311 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA CRLs for 312 Client Auth</td></tr> 313 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCARevocationFile <em>file-path</em></code></td></tr> 314 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 315 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 316 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 317 </table> 318 <p> 319 This directive sets the <em>all-in-one</em> file where you can 320 assemble the Certificate Revocation Lists (CRL) of Certification 321 Authorities (CA) whose <em>clients</em> you deal with. These are used 322 for Client Authentication. Such a file is simply the concatenation of 323 the various PEM-encoded CRL files, in order of preference. This can be 324 used alternatively and/or additionally to <code class="directive"><a href="#sslcarevocationpath">SSLCARevocationPath</a></code>.</p> 325 <div class="example"><h3>Example</h3><p><code> 326 SSLCARevocationFile /usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl 327 </code></p></div> 328 329 </div> 330 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 331 <div class="directive-section"><h2><a name="SSLCARevocationPath" id="SSLCARevocationPath">SSLCARevocationPath</a> <a name="sslcarevocationpath" id="sslcarevocationpath">Directive</a></h2> 332 <table class="directive"> 333 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA CRLs for 334 Client Auth</td></tr> 335 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCARevocationPath <em>directory-path</em></code></td></tr> 336 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 337 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 338 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 339 </table> 340 <p> 341 This directive sets the directory where you keep the Certificate Revocation 342 Lists (CRL) of Certification Authorities (CAs) whose clients you deal with. 343 These are used to revoke the client certificate on Client Authentication.</p> 344 <p> 345 The files in this directory have to be PEM-encoded and are accessed through 346 hash filenames. So usually you have not only to place the CRL files there. 347 Additionally you have to create symbolic links named 348 <em>hash-value</em><code>.rN</code>. And you should always make sure this directory 349 contains the appropriate symbolic links.</p> 350 <div class="example"><h3>Example</h3><p><code> 351 SSLCARevocationPath /usr/local/apache2/conf/ssl.crl/ 352 </code></p></div> 353 354 </div> 355 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 356 <div class="directive-section"><h2><a name="SSLCertificateChainFile" id="SSLCertificateChainFile">SSLCertificateChainFile</a> <a name="sslcertificatechainfile" id="sslcertificatechainfile">Directive</a></h2> 357 <table class="directive"> 358 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of PEM-encoded Server CA Certificates</td></tr> 359 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCertificateChainFile <em>file-path</em></code></td></tr> 360 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 361 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 362 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 363 </table> 364 <p> 365 This directive sets the optional <em>all-in-one</em> file where you can 366 assemble the certificates of Certification Authorities (CA) which form the 367 certificate chain of the server certificate. This starts with the issuing CA 368 certificate of the server certificate and can range up to the root CA 369 certificate. Such a file is simply the concatenation of the various 370 PEM-encoded CA Certificate files, usually in certificate chain order.</p> 371 <p> 372 This should be used alternatively and/or additionally to <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code> for explicitly 373 constructing the server certificate chain which is sent to the browser 374 in addition to the server certificate. It is especially useful to 375 avoid conflicts with CA certificates when using client 376 authentication. Because although placing a CA certificate of the 377 server certificate chain into <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code> has the same effect 378 for the certificate chain construction, it has the side-effect that 379 client certificates issued by this same CA certificate are also 380 accepted on client authentication.</p> 381 <p> 382 But be careful: Providing the certificate chain works only if you are using a 383 <em>single</em> RSA <em>or</em> DSA based server certificate. If you are 384 using a coupled RSA+DSA certificate pair, this will work only if actually both 385 certificates use the <em>same</em> certificate chain. Else the browsers will be 386 confused in this situation.</p> 387 <div class="example"><h3>Example</h3><p><code> 388 SSLCertificateChainFile /usr/local/apache2/conf/ssl.crt/ca.crt 389 </code></p></div> 390 391 </div> 392 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 393 <div class="directive-section"><h2><a name="SSLCertificateFile" id="SSLCertificateFile">SSLCertificateFile</a> <a name="sslcertificatefile" id="sslcertificatefile">Directive</a></h2> 394 <table class="directive"> 395 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Server PEM-encoded X.509 Certificate file</td></tr> 396 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCertificateFile <em>file-path</em></code></td></tr> 397 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 398 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 399 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 400 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>ECC support is available in Apache 2.2.26 and later</td></tr> 401 </table> 402 <p> 403 This directive points to a file with certificate data in PEM format. 404 At a minimum, the file must include an end-entity (leaf) certificate. 405 The directive can be used up to three times (referencing different filenames) 406 when an RSA, a DSA, and an ECC based server certificate is used in parallel. 407 </p> 408 409 <p> 410 Custom DH parameters and an EC curve name for ephemeral keys, 411 can be added to end of the first file configured using 412 <code class="directive"><a href="#sslcertificatefile">SSLCertificateFile</a></code>. 413 This is supported in version 2.2.30 or later. 414 Such parameters can be generated using the commands 415 <code>openssl dhparam</code> and <code>openssl ecparam</code>. 416 The parameters can be added as-is to the end of the first 417 certificate file. Only the first file can be used for custom 418 parameters, as they are applied independently of the authentication 419 algorithm type. 420 </p> 421 422 <p> 423 Finally the the end-entity certificate's private key can also be 424 added to the certificate file instead of using a separate 425 <code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code> 426 directive. This practice is highly discouraged. If the private 427 key is encrypted, the pass phrase dialog is forced at startup time. 428 </p> 429 430 <div class="note"> 431 <h3>DH parameter interoperability with primes > 1024 bit</h3> 432 <p> 433 Beginning with version 2.2.30, mod_ssl makes use of 434 standardized DH parameters with prime lengths of 2048, 3072, 4096, 6144 and 435 8192 bits (from <a href="http://www.ietf.org/rfc/rfc3526.txt">RFC 3526</a>), 436 and hands them out to clients based on the length of the certificate's RSA/DSA 437 key. 438 With Java-based clients in particular (Java 7 or earlier), this may lead 439 to handshake failures - see this 440 <a href="../ssl/ssl_faq.html#javadh">FAQ answer</a> for working around 441 such issues. 442 </p> 443 </div> 444 445 <div class="example"><h3>Example</h3><p><code> 446 SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt 447 </code></p></div> 448 449 </div> 450 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 451 <div class="directive-section"><h2><a name="SSLCertificateKeyFile" id="SSLCertificateKeyFile">SSLCertificateKeyFile</a> <a name="sslcertificatekeyfile" id="sslcertificatekeyfile">Directive</a></h2> 452 <table class="directive"> 453 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Server PEM-encoded Private Key file</td></tr> 454 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCertificateKeyFile <em>file-path</em></code></td></tr> 455 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 456 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 457 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 458 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>ECC support is available in Apache 2.2.26 and later</td></tr> 459 </table> 460 <p> 461 This directive points to the PEM-encoded private key file for the 462 server. If the contained private key is encrypted, the pass phrase 463 dialog is forced at startup time.</p> 464 465 <p> 466 The directive can be used up to three times (referencing different filenames) 467 when an RSA, a DSA, and an ECC based private key is used in parallel. For each 468 <code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code> 469 directive, there must be a matching <code class="directive">SSLCertificateFile</code> 470 directive.</p> 471 472 <p> 473 The private key may also be combined with the certificate in the file given by 474 <code class="directive"><a href="#sslcertificatefile">SSLCertificateFile</a></code>, but this practice 475 is highly discouraged.</p> 476 477 <div class="example"><h3>Example</h3><p><code> 478 SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key 479 </code></p></div> 480 481 </div> 482 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 483 <div class="directive-section"><h2><a name="SSLCipherSuite" id="SSLCipherSuite">SSLCipherSuite</a> <a name="sslciphersuite" id="sslciphersuite">Directive</a></h2> 484 <table class="directive"> 485 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Cipher Suite available for negotiation in SSL 486 handshake</td></tr> 487 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCipherSuite <em>cipher-spec</em></code></td></tr> 488 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code></td></tr> 489 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> 490 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 491 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 492 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 493 </table> 494 <p> 495 This complex directive uses a colon-separated <em>cipher-spec</em> string 496 consisting of OpenSSL cipher specifications to configure the Cipher Suite the 497 client is permitted to negotiate in the SSL handshake phase. Notice that this 498 directive can be used both in per-server and per-directory context. In 499 per-server context it applies to the standard SSL handshake when a connection 500 is established. In per-directory context it forces a SSL renegotiation with the 501 reconfigured Cipher Suite after the HTTP request was read but before the HTTP 502 response is sent.</p> 503 <p> 504 An SSL cipher specification in <em>cipher-spec</em> is composed of 4 major 505 attributes plus a few extra minor ones:</p> 506 <ul> 507 <li><em>Key Exchange Algorithm</em>:<br /> 508 RSA or Diffie-Hellman variants. 509 </li> 510 <li><em>Authentication Algorithm</em>:<br /> 511 RSA, Diffie-Hellman, DSS or none. 512 </li> 513 <li><em>Cipher/Encryption Algorithm</em>:<br /> 514 DES, Triple-DES, RC4, RC2, IDEA or none. 515 </li> 516 <li><em>MAC Digest Algorithm</em>:<br /> 517 MD5, SHA or SHA1. 518 </li> 519 </ul> 520 <p>An SSL cipher can also be an export cipher and is either a SSLv2 or SSLv3/TLSv1 521 cipher (here TLSv1 is equivalent to SSLv3). To specify which ciphers to use, 522 one can either specify all the Ciphers, one at a time, or use aliases to 523 specify the preference and order for the ciphers (see <a href="#table1">Table 524 1</a>).</p> 525 526 <table class="bordered"> 527 528 <tr><th><a name="table1">Tag</a></th> <th>Description</th></tr> 529 <tr><td colspan="2"><em>Key Exchange Algorithm:</em></td></tr> 530 <tr><td><code>kRSA</code></td> <td>RSA key exchange</td></tr> 531 <tr><td><code>kDHr</code></td> <td>Diffie-Hellman key exchange with RSA key</td></tr> 532 <tr><td><code>kDHd</code></td> <td>Diffie-Hellman key exchange with DSA key</td></tr> 533 <tr><td><code>kEDH</code></td> <td>Ephemeral (temp.key) Diffie-Hellman key exchange (no cert)</td> </tr> 534 <tr><td colspan="2"><em>Authentication Algorithm:</em></td></tr> 535 <tr><td><code>aNULL</code></td> <td>No authentication</td></tr> 536 <tr><td><code>aRSA</code></td> <td>RSA authentication</td></tr> 537 <tr><td><code>aDSS</code></td> <td>DSS authentication</td> </tr> 538 <tr><td><code>aDH</code></td> <td>Diffie-Hellman authentication</td></tr> 539 <tr><td colspan="2"><em>Cipher Encoding Algorithm:</em></td></tr> 540 <tr><td><code>eNULL</code></td> <td>No encoding</td> </tr> 541 <tr><td><code>DES</code></td> <td>DES encoding</td> </tr> 542 <tr><td><code>3DES</code></td> <td>Triple-DES encoding</td> </tr> 543 <tr><td><code>RC4</code></td> <td>RC4 encoding</td> </tr> 544 <tr><td><code>RC2</code></td> <td>RC2 encoding</td> </tr> 545 <tr><td><code>IDEA</code></td> <td>IDEA encoding</td> </tr> 546 <tr><td colspan="2"><em>MAC Digest Algorithm</em>:</td></tr> 547 <tr><td><code>MD5</code></td> <td>MD5 hash function</td></tr> 548 <tr><td><code>SHA1</code></td> <td>SHA1 hash function</td></tr> 549 <tr><td><code>SHA</code></td> <td>SHA hash function</td> </tr> 550 <tr><td colspan="2"><em>Aliases:</em></td></tr> 551 <tr><td><code>SSLv2</code></td> <td>all SSL version 2.0 ciphers</td></tr> 552 <tr><td><code>SSLv3</code></td> <td>all SSL version 3.0 ciphers</td> </tr> 553 <tr><td><code>TLSv1</code></td> <td>all TLS version 1.0 ciphers</td> </tr> 554 <tr><td><code>EXP</code></td> <td>all export ciphers</td> </tr> 555 <tr><td><code>EXPORT40</code></td> <td>all 40-bit export ciphers only</td> </tr> 556 <tr><td><code>EXPORT56</code></td> <td>all 56-bit export ciphers only</td> </tr> 557 <tr><td><code>LOW</code></td> <td>all low strength ciphers (no export, single DES)</td></tr> 558 <tr><td><code>MEDIUM</code></td> <td>all ciphers with 128 bit encryption</td> </tr> 559 <tr><td><code>HIGH</code></td> <td>all ciphers using Triple-DES</td> </tr> 560 <tr><td><code>RSA</code></td> <td>all ciphers using RSA key exchange</td> </tr> 561 <tr><td><code>DH</code></td> <td>all ciphers using Diffie-Hellman key exchange</td> </tr> 562 <tr><td><code>EDH</code></td> <td>all ciphers using Ephemeral Diffie-Hellman key exchange</td> </tr> 563 <tr><td><code>ADH</code></td> <td>all ciphers using Anonymous Diffie-Hellman key exchange</td> </tr> 564 <tr><td><code>DSS</code></td> <td>all ciphers using DSS authentication</td> </tr> 565 <tr><td><code>NULL</code></td> <td>all ciphers using no encryption</td> </tr> 566 </table> 567 <p> 568 Now where this becomes interesting is that these can be put together 569 to specify the order and ciphers you wish to use. To speed this up 570 there are also aliases (<code>SSLv2, SSLv3, TLSv1, EXP, LOW, MEDIUM, 571 HIGH</code>) for certain groups of ciphers. These tags can be joined 572 together with prefixes to form the <em>cipher-spec</em>. Available 573 prefixes are:</p> 574 <ul> 575 <li>none: add cipher to list</li> 576 <li><code>+</code>: move matching ciphers to the current location in list</li> 577 <li><code>-</code>: remove cipher from list (can be added later again)</li> 578 <li><code>!</code>: kill cipher from list completely (can <strong>not</strong> be added later again)</li> 579 </ul> 580 581 <div class="note"> 582 <h3><code>aNULL</code>, <code>eNULL</code> and <code>EXP</code> 583 ciphers are always disabled</h3> 584 <p>Beginning with version 2.2.30, null and export-grade 585 ciphers are always disabled, as mod_ssl unconditionally prepends any supplied 586 cipher suite string with <code>!aNULL:!eNULL:!EXP:</code> at initialization.</p> 587 </div> 588 589 <p>A simpler way to look at all of this is to use the ``<code>openssl ciphers 590 -v</code>'' command which provides a nice way to successively create the 591 correct <em>cipher-spec</em> string. The default <em>cipher-spec</em> string 592 is ``<code>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code>'' which 593 means the following: first, remove from consideration any ciphers that do not 594 authenticate, i.e. for SSL only the Anonymous Diffie-Hellman ciphers. Next, 595 use ciphers using RC4 and RSA. Next include the high, medium and then the low 596 security ciphers. Finally <em>pull</em> all SSLv2 and export ciphers to the 597 end of the list.</p> 598 <div class="example"><pre>$ openssl ciphers -v 'ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP' 599 NULL-SHA SSLv3 Kx=RSA Au=RSA Enc=None Mac=SHA1 600 NULL-MD5 SSLv3 Kx=RSA Au=RSA Enc=None Mac=MD5 601 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 602 ... ... ... ... ... 603 EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export 604 EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export 605 EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export</pre></div> 606 <p>The complete list of particular RSA & DH ciphers for SSL is given in <a href="#table2">Table 2</a>.</p> 607 <div class="example"><h3>Example</h3><p><code> 608 SSLCipherSuite RSA:!EXP:!NULL:+HIGH:+MEDIUM:-LOW 609 </code></p></div> 610 <table class="bordered"> 611 612 <tr><th><a name="table2">Cipher-Tag</a></th> <th>Protocol</th> <th>Key Ex.</th> <th>Auth.</th> <th>Enc.</th> <th>MAC</th> <th>Type</th> </tr> 613 <tr><td colspan="7"><em>RSA Ciphers:</em></td></tr> 614 <tr><td><code>DES-CBC3-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>3DES(168)</td> <td>SHA1</td> <td /> </tr> 615 <tr><td><code>DES-CBC3-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>3DES(168)</td> <td>MD5</td> <td /> </tr> 616 <tr><td><code>IDEA-CBC-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>IDEA(128)</td> <td>SHA1</td> <td /> </tr> 617 <tr><td><code>RC4-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>RC4(128)</td> <td>SHA1</td> <td /> </tr> 618 <tr><td><code>RC4-MD5</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>RC4(128)</td> <td>MD5</td> <td /> </tr> 619 <tr><td><code>IDEA-CBC-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>IDEA(128)</td> <td>MD5</td> <td /> </tr> 620 <tr><td><code>RC2-CBC-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>RC2(128)</td> <td>MD5</td> <td /> </tr> 621 <tr><td><code>RC4-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>RC4(128)</td> <td>MD5</td> <td /> </tr> 622 <tr><td><code>DES-CBC-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>DES(56)</td> <td>SHA1</td> <td /> </tr> 623 <tr><td><code>RC4-64-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>RC4(64)</td> <td>MD5</td> <td /> </tr> 624 <tr><td><code>DES-CBC-MD5</code></td> <td>SSLv2</td> <td>RSA</td> <td>RSA</td> <td>DES(56)</td> <td>MD5</td> <td /> </tr> 625 <tr><td><code>EXP-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>RSA(512)</td> <td>RSA</td> <td>DES(40)</td> <td>SHA1</td> <td> export</td> </tr> 626 <tr><td><code>EXP-RC2-CBC-MD5</code></td> <td>SSLv3</td> <td>RSA(512)</td> <td>RSA</td> <td>RC2(40)</td> <td>MD5</td> <td> export</td> </tr> 627 <tr><td><code>EXP-RC4-MD5</code></td> <td>SSLv3</td> <td>RSA(512)</td> <td>RSA</td> <td>RC4(40)</td> <td>MD5</td> <td> export</td> </tr> 628 <tr><td><code>EXP-RC2-CBC-MD5</code></td> <td>SSLv2</td> <td>RSA(512)</td> <td>RSA</td> <td>RC2(40)</td> <td>MD5</td> <td> export</td> </tr> 629 <tr><td><code>EXP-RC4-MD5</code></td> <td>SSLv2</td> <td>RSA(512)</td> <td>RSA</td> <td>RC4(40)</td> <td>MD5</td> <td> export</td> </tr> 630 <tr><td><code>NULL-SHA</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>None</td> <td>SHA1</td> <td /> </tr> 631 <tr><td><code>NULL-MD5</code></td> <td>SSLv3</td> <td>RSA</td> <td>RSA</td> <td>None</td> <td>MD5</td> <td /> </tr> 632 <tr><td colspan="7"><em>Diffie-Hellman Ciphers:</em></td></tr> 633 <tr><td><code>ADH-DES-CBC3-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>None</td> <td>3DES(168)</td> <td>SHA1</td> <td /> </tr> 634 <tr><td><code>ADH-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>None</td> <td>DES(56)</td> <td>SHA1</td> <td /> </tr> 635 <tr><td><code>ADH-RC4-MD5</code></td> <td>SSLv3</td> <td>DH</td> <td>None</td> <td>RC4(128)</td> <td>MD5</td> <td /> </tr> 636 <tr><td><code>EDH-RSA-DES-CBC3-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>RSA</td> <td>3DES(168)</td> <td>SHA1</td> <td /> </tr> 637 <tr><td><code>EDH-DSS-DES-CBC3-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>DSS</td> <td>3DES(168)</td> <td>SHA1</td> <td /> </tr> 638 <tr><td><code>EDH-RSA-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>RSA</td> <td>DES(56)</td> <td>SHA1</td> <td /> </tr> 639 <tr><td><code>EDH-DSS-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH</td> <td>DSS</td> <td>DES(56)</td> <td>SHA1</td> <td /> </tr> 640 <tr><td><code>EXP-EDH-RSA-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH(512)</td> <td>RSA</td> <td>DES(40)</td> <td>SHA1</td> <td> export</td> </tr> 641 <tr><td><code>EXP-EDH-DSS-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH(512)</td> <td>DSS</td> <td>DES(40)</td> <td>SHA1</td> <td> export</td> </tr> 642 <tr><td><code>EXP-ADH-DES-CBC-SHA</code></td> <td>SSLv3</td> <td>DH(512)</td> <td>None</td> <td>DES(40)</td> <td>SHA1</td> <td> export</td> </tr> 643 <tr><td><code>EXP-ADH-RC4-MD5</code></td> <td>SSLv3</td> <td>DH(512)</td> <td>None</td> <td>RC4(40)</td> <td>MD5</td> <td> export</td> </tr> 644 </table> 645 646 </div> 647 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 648 <div class="directive-section"><h2><a name="SSLCompression" id="SSLCompression">SSLCompression</a> <a name="sslcompression" id="sslcompression">Directive</a></h2> 649 <table class="directive"> 650 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable compression on the SSL level</td></tr> 651 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCompression on|off</code></td></tr> 652 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLCompression off</code></td></tr> 653 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 654 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 655 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 656 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.2.24 and later, if using OpenSSL 0.9.8 or later; 657 virtual host scope available if using OpenSSL 1.0.0 or later. 658 The default used to be <code>on</code> in versions 2.2.24 to 2.2.25.</td></tr> 659 </table> 660 <p>This directive allows to enable compression on the SSL level.</p> 661 <div class="warning"> 662 <p>Enabling compression causes security issues in most setups (the so called 663 CRIME attack).</p> 664 </div> 665 666 </div> 667 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 668 <div class="directive-section"><h2><a name="SSLCryptoDevice" id="SSLCryptoDevice">SSLCryptoDevice</a> <a name="sslcryptodevice" id="sslcryptodevice">Directive</a></h2> 669 <table class="directive"> 670 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable use of a cryptographic hardware accelerator</td></tr> 671 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLCryptoDevice <em>engine</em></code></td></tr> 672 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLCryptoDevice builtin</code></td></tr> 673 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 674 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 675 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 676 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.1 and later, if using -engine flavor of OpenSSL 677 0.9.6, or OpenSSL 0.9.7 or later</td></tr> 678 </table> 679 <p> 680 This directive enables use of a cryptographic hardware accelerator 681 board to offload some of the SSL processing overhead. This directive 682 can only be used if the SSL toolkit is built with "engine" support; 683 OpenSSL 0.9.7 and later releases have "engine" support by default, the 684 separate "-engine" releases of OpenSSL 0.9.6 must be used.</p> 685 686 <p>To discover which engine names are supported, run the command 687 "<code>openssl engine</code>".</p> 688 689 <div class="example"><h3>Example</h3><p><code> 690 # For a Broadcom accelerator:<br /> 691 SSLCryptoDevice ubsec 692 </code></p></div> 693 694 </div> 695 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 696 <div class="directive-section"><h2><a name="SSLEngine" id="SSLEngine">SSLEngine</a> <a name="sslengine" id="sslengine">Directive</a></h2> 697 <table class="directive"> 698 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>SSL Engine Operation Switch</td></tr> 699 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLEngine on|off|optional</code></td></tr> 700 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLEngine off</code></td></tr> 701 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 702 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 703 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 704 </table> 705 <p> 706 This directive toggles the usage of the SSL/TLS Protocol Engine. This 707 should be used inside a <code class="directive"><a href="../mod/core.html#virtualhost"><VirtualHost></a></code> section to enable SSL/TLS for a 708 that virtual host. By default the SSL/TLS Protocol Engine is 709 disabled for both the main server and all configured virtual hosts.</p> 710 <div class="example"><h3>Example</h3><p><code> 711 <VirtualHost _default_:443><br /> 712 SSLEngine on<br /> 713 ...<br /> 714 </VirtualHost> 715 </code></p></div> 716 <p>In Apache 2.1 and later, <code class="directive">SSLEngine</code> can be set to 717 <code>optional</code>. This enables support for 718 <a href="http://www.ietf.org/rfc/rfc2817.txt">RFC 2817</a>, Upgrading to TLS 719 Within HTTP/1.1. At this time no web browsers support RFC 2817.</p> 720 721 </div> 722 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 723 <div class="directive-section"><h2><a name="SSLFIPS" id="SSLFIPS">SSLFIPS</a> <a name="sslfips" id="sslfips">Directive</a></h2> 724 <table class="directive"> 725 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>SSL FIPS mode Switch</td></tr> 726 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLFIPS on|off</code></td></tr> 727 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLFIPS off</code></td></tr> 728 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 729 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 730 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 731 </table> 732 <p> 733 This directive toggles the usage of the SSL library FIPS_mode flag. 734 It must be set in the global server context and cannot be configured 735 with conflicting settings (SSLFIPS on followed by SSLFIPS off or 736 similar). The mode applies to all SSL library operations. 737 </p> 738 <p> 739 If httpd was compiled against an SSL library which did not support 740 the FIPS_mode flag, <code>SSLFIPS on</code> will fail. Refer to the 741 FIPS 140-2 Security Policy document of the SSL provider library for 742 specific requirements to use mod_ssl in a FIPS 140-2 approved mode 743 of operation; note that mod_ssl itself is not validated, but may be 744 described as using FIPS 140-2 validated cryptographic module, when 745 all components are assembled and operated under the guidelines imposed 746 by the applicable Security Policy. 747 </p> 748 749 </div> 750 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 751 <div class="directive-section"><h2><a name="SSLHonorCipherOrder" id="SSLHonorCipherOrder">SSLHonorCipherOrder</a> <a name="sslhonorcipherorder" id="sslhonorcipherorder">Directive</a></h2> 752 <table class="directive"> 753 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Option to prefer the server's cipher preference order</td></tr> 754 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLHonorCipherOrder <em>flag</em></code></td></tr> 755 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 756 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 757 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 758 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.1 and later, if using OpenSSL 0.9.7 or later</td></tr> 759 </table> 760 <p>When choosing a cipher during an SSLv3 or TLSv1 handshake, normally 761 the client's preference is used. If this directive is enabled, the 762 server's preference will be used instead.</p> 763 <div class="example"><h3>Example</h3><p><code> 764 SSLHonorCipherOrder on 765 </code></p></div> 766 767 </div> 768 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 769 <div class="directive-section"><h2><a name="SSLInsecureRenegotiation" id="SSLInsecureRenegotiation">SSLInsecureRenegotiation</a> <a name="sslinsecurerenegotiation" id="sslinsecurerenegotiation">Directive</a></h2> 770 <table class="directive"> 771 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Option to enable support for insecure renegotiation</td></tr> 772 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLInsecureRenegotiation <em>flag</em></code></td></tr> 773 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLInsecureRenegotiation off</code></td></tr> 774 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 775 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 776 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 777 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.2.15 and later, if using OpenSSL 0.9.8m or later</td></tr> 778 </table> 779 <p>As originally specified, all versions of the SSL and TLS protocols 780 (up to and including TLS/1.2) were vulnerable to a Man-in-the-Middle 781 attack 782 (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555">CVE-2009-3555</a>) 783 during a renegotiation. This vulnerability allowed an attacker to 784 "prefix" a chosen plaintext to the HTTP request as seen by the web 785 server. A protocol extension was developed which fixed this 786 vulnerability if supported by both client and server.</p> 787 788 <p>If <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> is linked against OpenSSL version 0.9.8m 789 or later, by default renegotiation is only supported with 790 clients supporting the new protocol extension. If this directive is 791 enabled, renegotiation will be allowed with old (unpatched) clients, 792 albeit insecurely.</p> 793 794 <div class="warning"><h3>Security warning</h3> 795 <p>If this directive is enabled, SSL connections will be vulnerable to 796 the Man-in-the-Middle prefix attack as described 797 in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555">CVE-2009-3555</a>.</p> 798 </div> 799 800 <div class="example"><h3>Example</h3><p><code> 801 SSLInsecureRenegotiation on 802 </code></p></div> 803 804 <p>The <code>SSL_SECURE_RENEG</code> environment variable can be used 805 from an SSI or CGI script to determine whether secure renegotiation is 806 supported for a given SSL connection.</p> 807 808 809 </div> 810 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 811 <div class="directive-section"><h2><a name="SSLMutex" id="SSLMutex">SSLMutex</a> <a name="sslmutex" id="sslmutex">Directive</a></h2> 812 <table class="directive"> 813 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Semaphore for internal mutual exclusion of 814 operations</td></tr> 815 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLMutex <em>type</em></code></td></tr> 816 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLMutex none</code></td></tr> 817 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 818 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 819 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 820 </table> 821 <p> 822 This configures the SSL engine's semaphore (aka. lock) which is used for mutual 823 exclusion of operations which have to be done in a synchronized way between the 824 pre-forked Apache server processes. This directive can only be used in the 825 global server context because it's only useful to have one global mutex. 826 This directive is designed to closely match the 827 <code class="directive"><a href="../mod/mpm_common.html#acceptmutex">AcceptMutex</a></code> directive.</p> 828 <p> 829 The following Mutex <em>types</em> are available:</p> 830 <ul> 831 <li><code>none | no</code> 832 <p> 833 This is the default where no Mutex is used at all. Use it at your own 834 risk. But because currently the Mutex is mainly used for synchronizing 835 write access to the SSL Session Cache you can live without it as long 836 as you accept a sometimes garbled Session Cache. So it's not recommended 837 to leave this the default. Instead configure a real Mutex.</p></li> 838 <li><code>posixsem</code> 839 <p> 840 This is an elegant Mutex variant where a Posix Semaphore is used when possible. 841 It is only available when the underlying platform 842 and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it.</p></li> 843 <li><code>sysvsem</code> 844 <p> 845 This is a somewhat elegant Mutex variant where a SystemV IPC Semaphore is used when 846 possible. It is possible to "leak" SysV semaphores if processes crash before 847 the semaphore is removed. It is only available when the underlying platform 848 and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it.</p></li> 849 <li><code>sem</code> 850 <p> 851 This directive tells the SSL Module to pick the "best" semaphore implementation 852 available to it, choosing between Posix and SystemV IPC, in that order. It is only 853 available when the underlying platform and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports at least one of the 2.</p></li> 854 <li><code>pthread</code> 855 <p> 856 This directive tells the SSL Module to use Posix thread mutexes. It is only available 857 if the underlying platform and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it.</p></li> 858 <li><code>fcntl:/path/to/mutex</code> 859 <p> 860 This is a portable Mutex variant where a physical (lock-)file and the <code>fcntl()</code> 861 function are used as the Mutex. 862 Always use a local disk filesystem for <code>/path/to/mutex</code> and never a file 863 residing on a NFS- or AFS-filesystem. It is only available when the underlying platform 864 and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it. Note: Internally, the Process ID (PID) of the 865 Apache parent process is automatically appended to 866 <code>/path/to/mutex</code> to make it unique, so you don't have to worry 867 about conflicts yourself. Notice that this type of mutex is not available 868 under the Win32 environment. There you <em>have</em> to use the semaphore 869 mutex.</p></li> 870 <li><code>flock:/path/to/mutex</code> 871 <p> 872 This is similar to the <code>fcntl:/path/to/mutex</code> method with the 873 exception that the <code>flock()</code> function is used to provide file 874 locking. It is only available when the underlying platform 875 and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports it.</p></li> 876 <li><code>file:/path/to/mutex</code> 877 <p> 878 This directive tells the SSL Module to pick the "best" file locking implementation 879 available to it, choosing between <code>fcntl</code> and <code>flock</code>, 880 in that order. It is only available when the underlying platform and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> supports 881 at least one of the 2.</p></li> 882 <li><code>default | yes</code> 883 <p> 884 This directive tells the SSL Module to pick the default locking implementation 885 as determined by the platform and <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a>.</p></li> 886 </ul> 887 <div class="example"><h3>Example</h3><p><code> 888 SSLMutex file:/usr/local/apache/logs/ssl_mutex 889 </code></p></div> 890 891 </div> 892 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 893 <div class="directive-section"><h2><a name="SSLOptions" id="SSLOptions">SSLOptions</a> <a name="ssloptions" id="ssloptions">Directive</a></h2> 894 <table class="directive"> 895 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configure various SSL engine run-time options</td></tr> 896 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLOptions [+|-]<em>option</em> ...</code></td></tr> 897 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> 898 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Options</td></tr> 899 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 900 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 901 </table> 902 <p> 903 This directive can be used to control various run-time options on a 904 per-directory basis. Normally, if multiple <code>SSLOptions</code> 905 could apply to a directory, then the most specific one is taken 906 completely; the options are not merged. However if <em>all</em> the 907 options on the <code>SSLOptions</code> directive are preceded by a 908 plus (<code>+</code>) or minus (<code>-</code>) symbol, the options 909 are merged. Any options preceded by a <code>+</code> are added to the 910 options currently in force, and any options preceded by a 911 <code>-</code> are removed from the options currently in force.</p> 912 <p> 913 The available <em>option</em>s are:</p> 914 <ul> 915 <li><code>StdEnvVars</code> 916 <p> 917 When this option is enabled, the standard set of SSL related CGI/SSI 918 environment variables are created. This per default is disabled for 919 performance reasons, because the information extraction step is a 920 rather expensive operation. So one usually enables this option for 921 CGI and SSI requests only.</p> 922 </li> 923 <li><code>ExportCertData</code> 924 <p> 925 When this option is enabled, additional CGI/SSI environment variables are 926 created: <code>SSL_SERVER_CERT</code>, <code>SSL_CLIENT_CERT</code> and 927 <code>SSL_CLIENT_CERT_CHAIN_</code><em>n</em> (with <em>n</em> = 0,1,2,..). 928 These contain the PEM-encoded X.509 Certificates of server and client for 929 the current HTTPS connection and can be used by CGI scripts for deeper 930 Certificate checking. Additionally all other certificates of the client 931 certificate chain are provided, too. This bloats up the environment a 932 little bit which is why you have to use this option to enable it on 933 demand.</p> 934 </li> 935 <li><code>FakeBasicAuth</code> 936 <p> 937 When this option is enabled, the Subject Distinguished Name (DN) of the 938 Client X509 Certificate is translated into a HTTP Basic Authorization 939 username. This means that the standard Apache authentication methods can 940 be used for access control. The user name is just the Subject of the 941 Client's X509 Certificate (can be determined by running OpenSSL's 942 <code>openssl x509</code> command: <code>openssl x509 -noout -subject -in 943 </code><em>certificate</em><code>.crt</code>). Note that no password is 944 obtained from the user. Every entry in the user file needs this password: 945 ``<code>xxj31ZMTZzkVA</code>'', which is the DES-encrypted version of the 946 word `<code>password</code>''. Those who live under MD5-based encryption 947 (for instance under FreeBSD or BSD/OS, etc.) should use the following MD5 948 hash of the same word: ``<code>$1$OXLyS...$Owx8s2/m9/gfkcRVXzgoE/</code>''.</p> 949 </li> 950 <li><code>StrictRequire</code> 951 <p> 952 This <em>forces</em> forbidden access when <code>SSLRequireSSL</code> or 953 <code>SSLRequire</code> successfully decided that access should be 954 forbidden. Usually the default is that in the case where a ``<code>Satisfy 955 any</code>'' directive is used, and other access restrictions are passed, 956 denial of access due to <code>SSLRequireSSL</code> or 957 <code>SSLRequire</code> is overridden (because that's how the Apache 958 <code>Satisfy</code> mechanism should work.) But for strict access restriction 959 you can use <code>SSLRequireSSL</code> and/or <code>SSLRequire</code> in 960 combination with an ``<code>SSLOptions +StrictRequire</code>''. Then an 961 additional ``<code>Satisfy Any</code>'' has no chance once mod_ssl has 962 decided to deny access.</p> 963 </li> 964 <li><code>OptRenegotiate</code> 965 <p> 966 This enables optimized SSL connection renegotiation handling when SSL 967 directives are used in per-directory context. By default a strict 968 scheme is enabled where <em>every</em> per-directory reconfiguration of 969 SSL parameters causes a <em>full</em> SSL renegotiation handshake. When this 970 option is used mod_ssl tries to avoid unnecessary handshakes by doing more 971 granular (but still safe) parameter checks. Nevertheless these granular 972 checks sometimes maybe not what the user expects, so enable this on a 973 per-directory basis only, please.</p> 974 </li> 975 </ul> 976 <div class="example"><h3>Example</h3><p><code> 977 SSLOptions +FakeBasicAuth -StrictRequire<br /> 978 <Files ~ "\.(cgi|shtml)$"><br /> 979 SSLOptions +StdEnvVars -ExportCertData<br /> 980 <Files> 981 </code></p></div> 982 983 </div> 984 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 985 <div class="directive-section"><h2><a name="SSLPassPhraseDialog" id="SSLPassPhraseDialog">SSLPassPhraseDialog</a> <a name="sslpassphrasedialog" id="sslpassphrasedialog">Directive</a></h2> 986 <table class="directive"> 987 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Type of pass phrase dialog for encrypted private 988 keys</td></tr> 989 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLPassPhraseDialog <em>type</em></code></td></tr> 990 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLPassPhraseDialog builtin</code></td></tr> 991 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 992 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 993 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 994 </table> 995 <p> 996 When Apache starts up it has to read the various Certificate (see 997 <code class="directive"><a href="#sslcertificatefile">SSLCertificateFile</a></code>) and 998 Private Key (see <code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code>) files of the 999 SSL-enabled virtual servers. Because for security reasons the Private 1000 Key files are usually encrypted, mod_ssl needs to query the 1001 administrator for a Pass Phrase in order to decrypt those files. This 1002 query can be done in two ways which can be configured by 1003 <em>type</em>:</p> 1004 <ul> 1005 <li><code>builtin</code> 1006 <p> 1007 This is the default where an interactive terminal dialog occurs at startup 1008 time just before Apache detaches from the terminal. Here the administrator 1009 has to manually enter the Pass Phrase for each encrypted Private Key file. 1010 Because a lot of SSL-enabled virtual hosts can be configured, the 1011 following reuse-scheme is used to minimize the dialog: When a Private Key 1012 file is encrypted, all known Pass Phrases (at the beginning there are 1013 none, of course) are tried. If one of those known Pass Phrases succeeds no 1014 dialog pops up for this particular Private Key file. If none succeeded, 1015 another Pass Phrase is queried on the terminal and remembered for the next 1016 round (where it perhaps can be reused).</p> 1017 <p> 1018 This scheme allows mod_ssl to be maximally flexible (because for N encrypted 1019 Private Key files you <em>can</em> use N different Pass Phrases - but then 1020 you have to enter all of them, of course) while minimizing the terminal 1021 dialog (i.e. when you use a single Pass Phrase for all N Private Key files 1022 this Pass Phrase is queried only once).</p></li> 1023 1024 <li><code>|/path/to/program [args...]</code> 1025 1026 <p>This mode allows an external program to be used which acts as a 1027 pipe to a particular input device; the program is sent the standard 1028 prompt text used for the <code>builtin</code> mode on 1029 <code>stdin</code>, and is expected to write password strings on 1030 <code>stdout</code>. If several passwords are needed (or an 1031 incorrect password is entered), additional prompt text will be 1032 written subsequent to the first password being returned, and more 1033 passwords must then be written back.</p></li> 1034 1035 <li><code>exec:/path/to/program</code> 1036 <p> 1037 Here an external program is configured which is called at startup for each 1038 encrypted Private Key file. It is called with two arguments (the first is 1039 of the form ``<code>servername:portnumber</code>'', the second is either 1040 ``<code>RSA</code>'', ``<code>DSA</code>'', or ``<code>ECC</code>''), which 1041 indicate for which server and algorithm it has to print the corresponding 1042 Pass Phrase to <code>stdout</code>. The intent is that this external 1043 program first runs security checks to make sure that the system is not 1044 compromised by an attacker, and only when these checks were passed 1045 successfully it provides the Pass Phrase.</p> 1046 <p> 1047 Both these security checks, and the way the Pass Phrase is determined, can 1048 be as complex as you like. Mod_ssl just defines the interface: an 1049 executable program which provides the Pass Phrase on <code>stdout</code>. 1050 Nothing more or less! So, if you're really paranoid about security, here 1051 is your interface. Anything else has to be left as an exercise to the 1052 administrator, because local security requirements are so different.</p> 1053 <p> 1054 The reuse-algorithm above is used here, too. In other words: The external 1055 program is called only once per unique Pass Phrase.</p></li> 1056 </ul> 1057 <div class="example"><h3>Example</h3><p><code> 1058 SSLPassPhraseDialog exec:/usr/local/apache/sbin/pp-filter 1059 </code></p></div> 1060 1061 </div> 1062 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1063 <div class="directive-section"><h2><a name="SSLProtocol" id="SSLProtocol">SSLProtocol</a> <a name="sslprotocol" id="sslprotocol">Directive</a></h2> 1064 <table class="directive"> 1065 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configure usable SSL protocol flavors</td></tr> 1066 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProtocol [+|-]<em>protocol</em> ...</code></td></tr> 1067 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProtocol all</code></td></tr> 1068 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1069 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Options</td></tr> 1070 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1071 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1072 </table> 1073 <p> 1074 This directive can be used to control the SSL protocol flavors mod_ssl should 1075 use when establishing its server environment. Clients then can only connect 1076 with one of the provided protocols.</p> 1077 <p> 1078 The available (case-insensitive) <em>protocol</em>s are:</p> 1079 <ul> 1080 <li><code>SSLv2</code> 1081 <p> 1082 This is the Secure Sockets Layer (SSL) protocol, version 2.0. It is the 1083 original SSL protocol as designed by Netscape Corporation. Though its 1084 use has been deprecated, because of weaknesses in the security of the protocol.</p></li> 1085 1086 <li><code>SSLv3</code> 1087 <p> 1088 This is the Secure Sockets Layer (SSL) protocol, version 3.0, from 1089 the Netscape Corporation. 1090 It is the successor to SSLv2 and the predecessor to TLSv1. It's supported by 1091 almost all popular browsers.</p></li> 1092 1093 <li><code>TLSv1</code> 1094 <p> 1095 This is the Transport Layer Security (TLS) protocol, version 1.0. 1096 It is the successor to SSLv3 and is defined in 1097 <a href="http://www.ietf.org/rfc/rfc2246.txt">RFC 2246</a>.</p></li> 1098 1099 <li><code>TLSv1.1</code> (when using OpenSSL 1.0.1 and later) 1100 <p> 1101 A revision of the TLS 1.0 protocol, as defined in 1102 <a href="http://www.ietf.org/rfc/rfc4346.txt">RFC 4346</a>.</p></li> 1103 1104 <li><code>TLSv1.2</code> (when using OpenSSL 1.0.1 and later) 1105 <p> 1106 A revision of the TLS 1.1 protocol, as defined in 1107 <a href="http://www.ietf.org/rfc/rfc5246.txt">RFC 5246</a>.</p></li> 1108 1109 <li><code>All</code> 1110 <p> 1111 This is a shortcut for ``<code>+SSLv2 +SSLv3 +TLSv1</code>'' or 1112 - when using OpenSSL 1.0.1 and later - 1113 ``<code>+SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2</code>'', respectively.</p></li> 1114 </ul> 1115 <div class="example"><h3>Example</h3><p><code> 1116 # enable SSLv3 and all available TLSv1 flavors, but not SSLv2<br /> 1117 SSLProtocol All -SSLv2 1118 </code></p></div> 1119 1120 </div> 1121 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1122 <div class="directive-section"><h2><a name="SSLProxyCACertificateFile" id="SSLProxyCACertificateFile">SSLProxyCACertificateFile</a> <a name="sslproxycacertificatefile" id="sslproxycacertificatefile">Directive</a></h2> 1123 <table class="directive"> 1124 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA Certificates 1125 for Remote Server Auth</td></tr> 1126 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCACertificateFile <em>file-path</em></code></td></tr> 1127 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1128 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1129 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1130 </table> 1131 <p> 1132 This directive sets the <em>all-in-one</em> file where you can assemble the 1133 Certificates of Certification Authorities (CA) whose <em>remote servers</em> you deal 1134 with. These are used for Remote Server Authentication. Such a file is simply the 1135 concatenation of the various PEM-encoded Certificate files, in order of 1136 preference. This can be used alternatively and/or additionally to 1137 <code class="directive"><a href="#sslproxycacertificatepath">SSLProxyCACertificatePath</a></code>.</p> 1138 <div class="example"><h3>Example</h3><p><code> 1139 SSLProxyCACertificateFile /usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt 1140 </code></p></div> 1141 1142 </div> 1143 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1144 <div class="directive-section"><h2><a name="SSLProxyCACertificatePath" id="SSLProxyCACertificatePath">SSLProxyCACertificatePath</a> <a name="sslproxycacertificatepath" id="sslproxycacertificatepath">Directive</a></h2> 1145 <table class="directive"> 1146 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA Certificates for 1147 Remote Server Auth</td></tr> 1148 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCACertificatePath <em>directory-path</em></code></td></tr> 1149 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1150 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1151 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1152 </table> 1153 <p> 1154 This directive sets the directory where you keep the Certificates of 1155 Certification Authorities (CAs) whose remote servers you deal with. These are used to 1156 verify the remote server certificate on Remote Server Authentication.</p> 1157 <p> 1158 The files in this directory have to be PEM-encoded and are accessed through 1159 hash filenames. So usually you can't just place the Certificate files 1160 there: you also have to create symbolic links named 1161 <em>hash-value</em><code>.N</code>. And you should always make sure this directory 1162 contains the appropriate symbolic links.</p> 1163 <div class="example"><h3>Example</h3><p><code> 1164 SSLProxyCACertificatePath /usr/local/apache2/conf/ssl.crt/ 1165 </code></p></div> 1166 1167 </div> 1168 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1169 <div class="directive-section"><h2><a name="SSLProxyCARevocationFile" id="SSLProxyCARevocationFile">SSLProxyCARevocationFile</a> <a name="sslproxycarevocationfile" id="sslproxycarevocationfile">Directive</a></h2> 1170 <table class="directive"> 1171 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA CRLs for 1172 Remote Server Auth</td></tr> 1173 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCARevocationFile <em>file-path</em></code></td></tr> 1174 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1175 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1176 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1177 </table> 1178 <p> 1179 This directive sets the <em>all-in-one</em> file where you can 1180 assemble the Certificate Revocation Lists (CRL) of Certification 1181 Authorities (CA) whose <em>remote servers</em> you deal with. These are used 1182 for Remote Server Authentication. Such a file is simply the concatenation of 1183 the various PEM-encoded CRL files, in order of preference. This can be 1184 used alternatively and/or additionally to <code class="directive"><a href="#sslproxycarevocationpath">SSLProxyCARevocationPath</a></code>.</p> 1185 <div class="example"><h3>Example</h3><p><code> 1186 SSLProxyCARevocationFile /usr/local/apache2/conf/ssl.crl/ca-bundle-remote-server.crl 1187 </code></p></div> 1188 1189 </div> 1190 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1191 <div class="directive-section"><h2><a name="SSLProxyCARevocationPath" id="SSLProxyCARevocationPath">SSLProxyCARevocationPath</a> <a name="sslproxycarevocationpath" id="sslproxycarevocationpath">Directive</a></h2> 1192 <table class="directive"> 1193 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded CA CRLs for 1194 Remote Server Auth</td></tr> 1195 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCARevocationPath <em>directory-path</em></code></td></tr> 1196 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1197 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1198 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1199 </table> 1200 <p> 1201 This directive sets the directory where you keep the Certificate Revocation 1202 Lists (CRL) of Certification Authorities (CAs) whose remote servers you deal with. 1203 These are used to revoke the remote server certificate on Remote Server Authentication.</p> 1204 <p> 1205 The files in this directory have to be PEM-encoded and are accessed through 1206 hash filenames. So usually you have not only to place the CRL files there. 1207 Additionally you have to create symbolic links named 1208 <em>hash-value</em><code>.rN</code>. And you should always make sure this directory 1209 contains the appropriate symbolic links.</p> 1210 <div class="example"><h3>Example</h3><p><code> 1211 SSLProxyCARevocationPath /usr/local/apache2/conf/ssl.crl/ 1212 </code></p></div> 1213 1214 </div> 1215 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1216 <div class="directive-section"><h2><a name="SSLProxyCheckPeerCN" id="SSLProxyCheckPeerCN">SSLProxyCheckPeerCN</a> <a name="sslproxycheckpeercn" id="sslproxycheckpeercn">Directive</a></h2> 1217 <table class="directive"> 1218 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Whether to check the remote server certificates CN field 1219 </td></tr> 1220 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCheckPeerCN on|off</code></td></tr> 1221 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyCheckPeerCN off</code></td></tr> 1222 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1223 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1224 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1225 </table> 1226 <p> 1227 This directive sets whether the remote server certificates CN field is 1228 compared against the hostname of the request URL. If both are not equal 1229 a 502 status code (Bad Gateway) is sent. 1230 </p> 1231 <div class="example"><h3>Example</h3><p><code> 1232 SSLProxyCheckPeerCN on 1233 </code></p></div> 1234 1235 </div> 1236 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1237 <div class="directive-section"><h2><a name="SSLProxyCheckPeerExpire" id="SSLProxyCheckPeerExpire">SSLProxyCheckPeerExpire</a> <a name="sslproxycheckpeerexpire" id="sslproxycheckpeerexpire">Directive</a></h2> 1238 <table class="directive"> 1239 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Whether to check if remote server certificate is expired 1240 </td></tr> 1241 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCheckPeerExpire on|off</code></td></tr> 1242 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyCheckPeerExpire off</code></td></tr> 1243 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1244 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1245 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1246 </table> 1247 <p> 1248 This directive sets whether it is checked if the remote server certificate 1249 is expired or not. If the check fails a 502 status code (Bad Gateway) is 1250 sent. 1251 </p> 1252 <div class="example"><h3>Example</h3><p><code> 1253 SSLProxyCheckPeerExpire on 1254 </code></p></div> 1255 1256 </div> 1257 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1258 <div class="directive-section"><h2><a name="SSLProxyCipherSuite" id="SSLProxyCipherSuite">SSLProxyCipherSuite</a> <a name="sslproxyciphersuite" id="sslproxyciphersuite">Directive</a></h2> 1259 <table class="directive"> 1260 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Cipher Suite available for negotiation in SSL 1261 proxy handshake</td></tr> 1262 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyCipherSuite <em>cipher-spec</em></code></td></tr> 1263 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code></td></tr> 1264 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> 1265 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 1266 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1267 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1268 </table> 1269 <p>Equivalent to <code>SSLCipherSuite</code>, but for the proxy connection. 1270 Please refer to <code class="directive"><a href="#sslciphersuite">SSLCipherSuite</a></code> 1271 for additional information.</p> 1272 1273 </div> 1274 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1275 <div class="directive-section"><h2><a name="SSLProxyEngine" id="SSLProxyEngine">SSLProxyEngine</a> <a name="sslproxyengine" id="sslproxyengine">Directive</a></h2> 1276 <table class="directive"> 1277 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>SSL Proxy Engine Operation Switch</td></tr> 1278 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyEngine on|off</code></td></tr> 1279 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyEngine off</code></td></tr> 1280 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1281 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1282 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1283 </table> 1284 <p> 1285 This directive toggles the usage of the SSL/TLS Protocol Engine for proxy. This 1286 is usually used inside a <code class="directive"><a href="../mod/core.html#virtualhost"><VirtualHost></a></code> section to enable SSL/TLS for proxy 1287 usage in a particular virtual host. By default the SSL/TLS Protocol Engine is 1288 disabled for proxy both for the main server and all configured virtual hosts.</p> 1289 1290 <p>Note that the SSLProxyEngine directive should not, in 1291 general, be included in a virtual host that will be acting as a 1292 forward proxy (using <Proxy> or <ProxyRequest> directives. 1293 SSLProxyEngine is not required to enable a forward proxy server to 1294 proxy SSL/TLS requests.</p> 1295 1296 <div class="example"><h3>Example</h3><p><code> 1297 <VirtualHost _default_:443><br /> 1298 SSLProxyEngine on<br /> 1299 ...<br /> 1300 </VirtualHost> 1301 </code></p></div> 1302 1303 </div> 1304 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1305 <div class="directive-section"><h2><a name="SSLProxyMachineCertificateChainFile" id="SSLProxyMachineCertificateChainFile">SSLProxyMachineCertificateChainFile</a> <a name="sslproxymachinecertificatechainfile" id="sslproxymachinecertificatechainfile">Directive</a></h2> 1306 <table class="directive"> 1307 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate</td></tr> 1308 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyMachineCertificateChainFile <em>filename</em></code></td></tr> 1309 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 1310 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Not applicable</td></tr> 1311 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1312 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1313 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.2.23 and later</td></tr> 1314 </table> 1315 <p> 1316 This directive sets the all-in-one file where you keep the certificate chain 1317 for all of the client certs in use. This directive will be needed if the 1318 remote server presents a list of CA certificates that are not direct signers 1319 of one of the configured client certificates. 1320 </p> 1321 <p> 1322 This referenced file is simply the concatenation of the various PEM-encoded 1323 certificate files. Upon startup, each client certificate configured will 1324 be examined and a chain of trust will be constructed. 1325 </p> 1326 <div class="warning"><h3>Security warning</h3> 1327 <p>If this directive is enabled, all of the certificates in the file will be 1328 trusted as if they were also in <code class="directive"><a href="#sslproxycacertificatefile"> 1329 SSLProxyCACertificateFile</a></code>.</p> 1330 </div> 1331 <div class="example"><h3>Example</h3><p><code> 1332 SSLProxyMachineCertificateChainFile /usr/local/apache2/conf/ssl.crt/proxyCA.pem 1333 </code></p></div> 1334 1335 </div> 1336 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1337 <div class="directive-section"><h2><a name="SSLProxyMachineCertificateFile" id="SSLProxyMachineCertificateFile">SSLProxyMachineCertificateFile</a> <a name="sslproxymachinecertificatefile" id="sslproxymachinecertificatefile">Directive</a></h2> 1338 <table class="directive"> 1339 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>File of concatenated PEM-encoded client certificates and keys to be used by the proxy</td></tr> 1340 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyMachineCertificateFile <em>filename</em></code></td></tr> 1341 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 1342 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Not applicable</td></tr> 1343 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1344 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1345 </table> 1346 <p> 1347 This directive sets the all-in-one file where you keep the certificates and 1348 keys used for authentication of the proxy server to remote servers. 1349 </p> 1350 <p> 1351 This referenced file is simply the concatenation of the various PEM-encoded 1352 certificate files, in order of preference. Use this directive alternatively 1353 or additionally to <code>SSLProxyMachineCertificatePath</code>. 1354 </p> 1355 <div class="warning"> 1356 <p>Currently there is no support for encrypted private keys</p> 1357 </div> 1358 <div class="example"><h3>Example</h3><p><code> 1359 SSLProxyMachineCertificateFile /usr/local/apache2/conf/ssl.crt/proxy.pem 1360 </code></p></div> 1361 1362 </div> 1363 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1364 <div class="directive-section"><h2><a name="SSLProxyMachineCertificatePath" id="SSLProxyMachineCertificatePath">SSLProxyMachineCertificatePath</a> <a name="sslproxymachinecertificatepath" id="sslproxymachinecertificatepath">Directive</a></h2> 1365 <table class="directive"> 1366 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Directory of PEM-encoded client certificates and keys to be used by the proxy</td></tr> 1367 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyMachineCertificatePath <em>directory</em></code></td></tr> 1368 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 1369 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Not applicable</td></tr> 1370 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1371 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1372 </table> 1373 <p> 1374 This directive sets the directory where you keep the certificates and 1375 keys used for authentication of the proxy server to remote servers. 1376 </p> 1377 <p>The files in this directory must be PEM-encoded and are accessed through 1378 hash filenames. Additionally, you must create symbolic links named 1379 <code><em>hash-value</em>.N</code>. And you should always make sure this 1380 directory contains the appropriate symbolic links.</p> 1381 <div class="warning"> 1382 <p>Currently there is no support for encrypted private keys</p> 1383 </div> 1384 <div class="example"><h3>Example</h3><p><code> 1385 SSLProxyMachineCertificatePath /usr/local/apache2/conf/proxy.crt/ 1386 </code></p></div> 1387 1388 </div> 1389 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1390 <div class="directive-section"><h2><a name="SSLProxyProtocol" id="SSLProxyProtocol">SSLProxyProtocol</a> <a name="sslproxyprotocol" id="sslproxyprotocol">Directive</a></h2> 1391 <table class="directive"> 1392 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configure usable SSL protocol flavors for proxy usage</td></tr> 1393 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyProtocol [+|-]<em>protocol</em> ...</code></td></tr> 1394 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyProtocol all</code></td></tr> 1395 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1396 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Options</td></tr> 1397 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1398 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1399 </table> 1400 1401 <p> 1402 This directive can be used to control the SSL protocol flavors mod_ssl should 1403 use when establishing its server environment for proxy . It will only connect 1404 to servers using one of the provided protocols.</p> 1405 <p>Please refer to <code class="directive"><a href="#sslprotocol">SSLProtocol</a></code> 1406 for additional information. 1407 </p> 1408 1409 </div> 1410 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1411 <div class="directive-section"><h2><a name="SSLProxyVerify" id="SSLProxyVerify">SSLProxyVerify</a> <a name="sslproxyverify" id="sslproxyverify">Directive</a></h2> 1412 <table class="directive"> 1413 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Type of remote server Certificate verification</td></tr> 1414 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyVerify <em>level</em></code></td></tr> 1415 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyVerify none</code></td></tr> 1416 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1417 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1418 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1419 </table> 1420 1421 <p>When a proxy is configured to forward requests to a remote SSL 1422 server, this directive can be used to configure certificate 1423 verification of the remote server. </p> 1424 1425 <div class="warning"> 1426 <p>Note that even when certificate verification is enabled, 1427 <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> does <strong>not</strong> check whether the 1428 <code>commonName</code> (hostname) attribute of the server certificate 1429 matches the hostname used to connect to the server. In other words, 1430 the proxy does not guarantee that the SSL connection to the backend 1431 server is "secure" beyond the fact that the certificate is signed by 1432 one of the CAs configured using the 1433 <code class="directive">SSLProxyCACertificatePath</code> and/or 1434 <code class="directive">SSLProxyCACertificateFile</code> directives. 1435 In order to get this check done please have a look at 1436 <code class="directive">SSLProxyCheckPeerCN</code> and 1437 <code class="directive">SSLProxyCheckPeerExpire</code> directives which are off by 1438 default. 1439 </p> 1440 </div> 1441 1442 <p> 1443 The following levels are available for <em>level</em>:</p> 1444 <ul> 1445 <li><strong>none</strong>: 1446 no remote server Certificate is required at all</li> 1447 <li><strong>optional</strong>: 1448 the remote server <em>may</em> present a valid Certificate</li> 1449 <li><strong>require</strong>: 1450 the remote server <em>has to</em> present a valid Certificate</li> 1451 <li><strong>optional_no_ca</strong>: 1452 the remote server may present a valid Certificate<br /> 1453 but it need not to be (successfully) verifiable.</li> 1454 </ul> 1455 <p>In practice only levels <strong>none</strong> and 1456 <strong>require</strong> are really interesting, because level 1457 <strong>optional</strong> doesn't work with all servers and level 1458 <strong>optional_no_ca</strong> is actually against the idea of 1459 authentication (but can be used to establish SSL test pages, etc.)</p> 1460 <div class="example"><h3>Example</h3><p><code> 1461 SSLProxyVerify require 1462 </code></p></div> 1463 1464 </div> 1465 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1466 <div class="directive-section"><h2><a name="SSLProxyVerifyDepth" id="SSLProxyVerifyDepth">SSLProxyVerifyDepth</a> <a name="sslproxyverifydepth" id="sslproxyverifydepth">Directive</a></h2> 1467 <table class="directive"> 1468 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Maximum depth of CA Certificates in Remote Server 1469 Certificate verification</td></tr> 1470 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLProxyVerifyDepth <em>number</em></code></td></tr> 1471 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLProxyVerifyDepth 1</code></td></tr> 1472 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1473 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 1474 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1475 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1476 </table> 1477 <p> 1478 This directive sets how deeply mod_ssl should verify before deciding that the 1479 remote server does not have a valid certificate. </p> 1480 <p> 1481 The depth actually is the maximum number of intermediate certificate issuers, 1482 i.e. the number of CA certificates which are max allowed to be followed while 1483 verifying the remote server certificate. A depth of 0 means that self-signed 1484 remote server certificates are accepted only, the default depth of 1 means 1485 the remote server certificate can be self-signed or has to be signed by a CA 1486 which is directly known to the server (i.e. the CA's certificate is under 1487 <code class="directive"><a href="#sslproxycacertificatepath">SSLProxyCACertificatePath</a></code>), etc.</p> 1488 <div class="example"><h3>Example</h3><p><code> 1489 SSLProxyVerifyDepth 10 1490 </code></p></div> 1491 1492 </div> 1493 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1494 <div class="directive-section"><h2><a name="SSLRandomSeed" id="SSLRandomSeed">SSLRandomSeed</a> <a name="sslrandomseed" id="sslrandomseed">Directive</a></h2> 1495 <table class="directive"> 1496 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Pseudo Random Number Generator (PRNG) seeding 1497 source</td></tr> 1498 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRandomSeed <em>context</em> <em>source</em> 1499 [<em>bytes</em>]</code></td></tr> 1500 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 1501 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1502 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1503 </table> 1504 <p> 1505 This configures one or more sources for seeding the Pseudo Random Number 1506 Generator (PRNG) in OpenSSL at startup time (<em>context</em> is 1507 <code>startup</code>) and/or just before a new SSL connection is established 1508 (<em>context</em> is <code>connect</code>). This directive can only be used 1509 in the global server context because the PRNG is a global facility.</p> 1510 <p> 1511 The following <em>source</em> variants are available:</p> 1512 <ul> 1513 <li><code>builtin</code> 1514 <p> This is the always available builtin seeding source. Its usage 1515 consumes minimum CPU cycles under runtime and hence can be always used 1516 without drawbacks. The source used for seeding the PRNG contains of the 1517 current time, the current process id and (when applicable) a randomly 1518 chosen 1KB extract of the inter-process scoreboard structure of Apache. 1519 The drawback is that this is not really a strong source and at startup 1520 time (where the scoreboard is still not available) this source just 1521 produces a few bytes of entropy. So you should always, at least for the 1522 startup, use an additional seeding source.</p></li> 1523 <li><code>file:/path/to/source</code> 1524 <p> 1525 This variant uses an external file <code>/path/to/source</code> as the 1526 source for seeding the PRNG. When <em>bytes</em> is specified, only the 1527 first <em>bytes</em> number of bytes of the file form the entropy (and 1528 <em>bytes</em> is given to <code>/path/to/source</code> as the first 1529 argument). When <em>bytes</em> is not specified the whole file forms the 1530 entropy (and <code>0</code> is given to <code>/path/to/source</code> as 1531 the first argument). Use this especially at startup time, for instance 1532 with an available <code>/dev/random</code> and/or 1533 <code>/dev/urandom</code> devices (which usually exist on modern Unix 1534 derivatives like FreeBSD and Linux).</p> 1535 <p> 1536 <em>But be careful</em>: Usually <code>/dev/random</code> provides only as 1537 much entropy data as it actually has, i.e. when you request 512 bytes of 1538 entropy, but the device currently has only 100 bytes available two things 1539 can happen: On some platforms you receive only the 100 bytes while on 1540 other platforms the read blocks until enough bytes are available (which 1541 can take a long time). Here using an existing <code>/dev/urandom</code> is 1542 better, because it never blocks and actually gives the amount of requested 1543 data. The drawback is just that the quality of the received data may not 1544 be the best.</p> 1545 <p> 1546 On some platforms like FreeBSD one can even control how the entropy is 1547 actually generated, i.e. by which system interrupts. More details one can 1548 find under <em>rndcontrol(8)</em> on those platforms. Alternatively, when 1549 your system lacks such a random device, you can use a tool 1550 like <a href="http://www.lothar.com/tech/crypto/">EGD</a> 1551 (Entropy Gathering Daemon) and run its client program with the 1552 <code>exec:/path/to/program/</code> variant (see below) or use 1553 <code>egd:/path/to/egd-socket</code> (see below).</p></li> 1554 1555 <li><code>exec:/path/to/program</code> 1556 <p> 1557 This variant uses an external executable 1558 <code>/path/to/program</code> as the source for seeding the 1559 PRNG. When <em>bytes</em> is specified, only the first 1560 <em>bytes</em> number of bytes of its <code>stdout</code> contents 1561 form the entropy. When <em>bytes</em> is not specified, the 1562 entirety of the data produced on <code>stdout</code> form the 1563 entropy. Use this only at startup time when you need a very strong 1564 seeding with the help of an external program (for instance as in 1565 the example above with the <code>truerand</code> utility you can 1566 find in the mod_ssl distribution which is based on the AT&T 1567 <em>truerand</em> library). Using this in the connection context 1568 slows down the server too dramatically, of course. So usually you 1569 should avoid using external programs in that context.</p></li> 1570 <li><code>egd:/path/to/egd-socket</code> (Unix only) 1571 <p> 1572 This variant uses the Unix domain socket of the 1573 external Entropy Gathering Daemon (EGD) (see <a href="http://www.lothar.com/tech/crypto/">http://www.lothar.com/tech 1574 /crypto/</a>) to seed the PRNG. Use this if no random device exists 1575 on your platform.</p></li> 1576 </ul> 1577 <div class="example"><h3>Example</h3><p><code> 1578 SSLRandomSeed startup builtin<br /> 1579 SSLRandomSeed startup file:/dev/random<br /> 1580 SSLRandomSeed startup file:/dev/urandom 1024<br /> 1581 SSLRandomSeed startup exec:/usr/local/bin/truerand 16<br /> 1582 SSLRandomSeed connect builtin<br /> 1583 SSLRandomSeed connect file:/dev/random<br /> 1584 SSLRandomSeed connect file:/dev/urandom 1024<br /> 1585 </code></p></div> 1586 1587 </div> 1588 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1589 <div class="directive-section"><h2><a name="SSLRenegBufferSize" id="SSLRenegBufferSize">SSLRenegBufferSize</a> <a name="sslrenegbuffersize" id="sslrenegbuffersize">Directive</a></h2> 1590 <table class="directive"> 1591 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Set the size for the SSL renegotiation buffer</td></tr> 1592 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRenegBufferSize <var>bytes</var></code></td></tr> 1593 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLRenegBufferSize 131072</code></td></tr> 1594 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> 1595 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 1596 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1597 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1598 </table> 1599 1600 <p>If an SSL renegotiation is required in per-location context, for 1601 example, any use of <code class="directive"><a href="#sslverifyclient">SSLVerifyClient</a></code> in a Directory or 1602 Location block, then <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> must buffer any HTTP 1603 request body into memory until the new SSL handshake can be performed. 1604 This directive can be used to set the amount of memory that will be 1605 used for this buffer. </p> 1606 1607 <div class="warning"><p> 1608 Note that in many configurations, the client sending the request body 1609 will be untrusted so a denial of service attack by consumption of 1610 memory must be considered when changing this configuration setting. 1611 </p></div> 1612 1613 <div class="example"><h3>Example</h3><p><code> 1614 SSLRenegBufferSize 262144 1615 </code></p></div> 1616 1617 </div> 1618 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1619 <div class="directive-section"><h2><a name="SSLRequire" id="SSLRequire">SSLRequire</a> <a name="sslrequire" id="sslrequire">Directive</a></h2> 1620 <table class="directive"> 1621 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Allow access only when an arbitrarily complex 1622 boolean expression is true</td></tr> 1623 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRequire <em>expression</em></code></td></tr> 1624 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> 1625 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 1626 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1627 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1628 </table> 1629 <p> 1630 This directive specifies a general access requirement which has to be 1631 fulfilled in order to allow access. It is a very powerful directive because the 1632 requirement specification is an arbitrarily complex boolean expression 1633 containing any number of access checks.</p> 1634 <div class="warning"> 1635 <p>The implementation of <code>SSLRequire</code> is not thread safe. 1636 Using <code>SSLRequire</code> inside <code>.htaccess</code> files 1637 on a threaded <a href="../mpm.html">MPM</a> may cause random crashes. 1638 </p> 1639 </div> 1640 <p> 1641 The <em>expression</em> must match the following syntax (given as a BNF 1642 grammar notation):</p> 1643 <blockquote> 1644 <pre>expr ::= "<strong>true</strong>" | "<strong>false</strong>" 1645 | "<strong>!</strong>" expr 1646 | expr "<strong>&&</strong>" expr 1647 | expr "<strong>||</strong>" expr 1648 | "<strong>(</strong>" expr "<strong>)</strong>" 1649 | comp 1650 1651 comp ::= word "<strong>==</strong>" word | word "<strong>eq</strong>" word 1652 | word "<strong>!=</strong>" word | word "<strong>ne</strong>" word 1653 | word "<strong><</strong>" word | word "<strong>lt</strong>" word 1654 | word "<strong><=</strong>" word | word "<strong>le</strong>" word 1655 | word "<strong>></strong>" word | word "<strong>gt</strong>" word 1656 | word "<strong>>=</strong>" word | word "<strong>ge</strong>" word 1657 | word "<strong>in</strong>" "<strong>{</strong>" wordlist "<strong>}</strong>" 1658 | word "<strong>in</strong>" "<strong>OID(</strong>" word "<strong>)</strong>" 1659 | word "<strong>=~</strong>" regex 1660 | word "<strong>!~</strong>" regex 1661 1662 wordlist ::= word 1663 | wordlist "<strong>,</strong>" word 1664 1665 word ::= digit 1666 | cstring 1667 | variable 1668 | function 1669 1670 digit ::= [0-9]+ 1671 cstring ::= "..." 1672 variable ::= "<strong>%{</strong>" varname "<strong>}</strong>" 1673 function ::= funcname "<strong>(</strong>" funcargs "<strong>)</strong>"</pre> 1674 </blockquote> 1675 <p>while for <code>varname</code> any variable from <a href="#table3">Table 3</a> can be used. Finally for 1676 <code>funcname</code> the following functions are available:</p> 1677 <ul> 1678 <li><code>file(</code><em>filename</em><code>)</code> 1679 <p> 1680 This function takes one string argument and expands to the contents of the 1681 file. This is especially useful for matching this contents against a 1682 regular expression, etc.</p> 1683 </li> 1684 </ul> 1685 <p>Notice that <em>expression</em> is first parsed into an internal machine 1686 representation and then evaluated in a second step. Actually, in Global and 1687 Per-Server Class context <em>expression</em> is parsed at startup time and 1688 at runtime only the machine representation is executed. For Per-Directory 1689 context, specifically in a .htaccess context, this is different: here <em> 1690 expression</em> has to be parsed and immediately executed for every request.</p> 1691 <div class="example"><h3>Example</h3><p><code> 1692 SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \<br /> 1693 and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \<br /> 1694 and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \<br /> 1695 and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \<br /> 1696 and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \<br /> 1697 or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ 1698 </code></p></div> 1699 <p>The <code>OID()</code> function expects to find zero or more instances 1700 of the given OID in the client certificate, and compares the left-hand side 1701 string against the value of matching OID attributes. Every matching OID is 1702 checked, until a match is found. 1703 </p> 1704 1705 <p><em>Standard CGI/1.0 and Apache variables:</em></p> 1706 <pre>HTTP_USER_AGENT PATH_INFO AUTH_TYPE 1707 HTTP_REFERER QUERY_STRING SERVER_SOFTWARE 1708 HTTP_COOKIE REMOTE_HOST API_VERSION 1709 HTTP_FORWARDED REMOTE_IDENT TIME_YEAR 1710 HTTP_HOST IS_SUBREQ TIME_MON 1711 HTTP_PROXY_CONNECTION DOCUMENT_ROOT TIME_DAY 1712 HTTP_ACCEPT SERVER_ADMIN TIME_HOUR 1713 HTTP:headername SERVER_NAME TIME_MIN 1714 THE_REQUEST SERVER_PORT TIME_SEC 1715 REQUEST_METHOD SERVER_PROTOCOL TIME_WDAY 1716 REQUEST_SCHEME REMOTE_ADDR TIME 1717 REQUEST_URI REMOTE_USER ENV:<strong>variablename</strong> 1718 REQUEST_FILENAME</pre> 1719 <p><em>SSL-related variables:</em></p> 1720 <pre>HTTPS SSL_CLIENT_M_VERSION SSL_SERVER_M_VERSION 1721 SSL_CLIENT_M_SERIAL SSL_SERVER_M_SERIAL 1722 SSL_PROTOCOL SSL_CLIENT_V_START SSL_SERVER_V_START 1723 SSL_SESSION_ID SSL_CLIENT_V_END SSL_SERVER_V_END 1724 SSL_CIPHER SSL_CLIENT_S_DN SSL_SERVER_S_DN 1725 SSL_CIPHER_EXPORT SSL_CLIENT_S_DN_C SSL_SERVER_S_DN_C 1726 SSL_CIPHER_ALGKEYSIZE SSL_CLIENT_S_DN_ST SSL_SERVER_S_DN_ST 1727 SSL_CIPHER_USEKEYSIZE SSL_CLIENT_S_DN_L SSL_SERVER_S_DN_L 1728 SSL_VERSION_LIBRARY SSL_CLIENT_S_DN_O SSL_SERVER_S_DN_O 1729 SSL_VERSION_INTERFACE SSL_CLIENT_S_DN_OU SSL_SERVER_S_DN_OU 1730 SSL_CLIENT_S_DN_CN SSL_SERVER_S_DN_CN 1731 SSL_CLIENT_S_DN_T SSL_SERVER_S_DN_T 1732 SSL_CLIENT_S_DN_I SSL_SERVER_S_DN_I 1733 SSL_CLIENT_S_DN_G SSL_SERVER_S_DN_G 1734 SSL_CLIENT_S_DN_S SSL_SERVER_S_DN_S 1735 SSL_CLIENT_S_DN_D SSL_SERVER_S_DN_D 1736 SSL_CLIENT_S_DN_UID SSL_SERVER_S_DN_UID 1737 SSL_CLIENT_S_DN_Email SSL_SERVER_S_DN_Email 1738 SSL_CLIENT_I_DN SSL_SERVER_I_DN 1739 SSL_CLIENT_I_DN_C SSL_SERVER_I_DN_C 1740 SSL_CLIENT_I_DN_ST SSL_SERVER_I_DN_ST 1741 SSL_CLIENT_I_DN_L SSL_SERVER_I_DN_L 1742 SSL_CLIENT_I_DN_O SSL_SERVER_I_DN_O 1743 SSL_CLIENT_I_DN_OU SSL_SERVER_I_DN_OU 1744 SSL_CLIENT_I_DN_CN SSL_SERVER_I_DN_CN 1745 SSL_CLIENT_I_DN_T SSL_SERVER_I_DN_T 1746 SSL_CLIENT_I_DN_I SSL_SERVER_I_DN_I 1747 SSL_CLIENT_I_DN_G SSL_SERVER_I_DN_G 1748 SSL_CLIENT_I_DN_S SSL_SERVER_I_DN_S 1749 SSL_CLIENT_I_DN_D SSL_SERVER_I_DN_D 1750 SSL_CLIENT_I_DN_UID SSL_SERVER_I_DN_UID 1751 SSL_CLIENT_I_DN_Email SSL_SERVER_I_DN_Email 1752 SSL_CLIENT_A_SIG SSL_SERVER_A_SIG 1753 SSL_CLIENT_A_KEY SSL_SERVER_A_KEY 1754 SSL_CLIENT_CERT SSL_SERVER_CERT 1755 SSL_CLIENT_CERT_CHAIN_<strong>n</strong> 1756 SSL_CLIENT_VERIFY SSL_TLS_SNI</pre> 1757 1758 </div> 1759 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1760 <div class="directive-section"><h2><a name="SSLRequireSSL" id="SSLRequireSSL">SSLRequireSSL</a> <a name="sslrequiressl" id="sslrequiressl">Directive</a></h2> 1761 <table class="directive"> 1762 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Deny access when SSL is not used for the 1763 HTTP request</td></tr> 1764 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRequireSSL</code></td></tr> 1765 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> 1766 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 1767 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1768 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1769 </table> 1770 <p> 1771 This directive forbids access unless HTTP over SSL (i.e. HTTPS) is enabled for 1772 the current connection. This is very handy inside the SSL-enabled virtual 1773 host or directories for defending against configuration errors that expose 1774 stuff that should be protected. When this directive is present all requests 1775 are denied which are not using SSL.</p> 1776 <div class="example"><h3>Example</h3><p><code> 1777 SSLRequireSSL 1778 </code></p></div> 1779 1780 </div> 1781 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1782 <div class="directive-section"><h2><a name="SSLSessionCache" id="SSLSessionCache">SSLSessionCache</a> <a name="sslsessioncache" id="sslsessioncache">Directive</a></h2> 1783 <table class="directive"> 1784 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Type of the global/inter-process SSL Session 1785 Cache</td></tr> 1786 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLSessionCache <em>type</em></code></td></tr> 1787 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLSessionCache none</code></td></tr> 1788 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 1789 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1790 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1791 </table> 1792 <p> 1793 This configures the storage type of the global/inter-process SSL Session 1794 Cache. This cache is an optional facility which speeds up parallel request 1795 processing. For requests to the same server process (via HTTP keep-alive), 1796 OpenSSL already caches the SSL session information locally. But because modern 1797 clients request inlined images and other data via parallel requests (usually 1798 up to four parallel requests are common) those requests are served by 1799 <em>different</em> pre-forked server processes. Here an inter-process cache 1800 helps to avoid unnecessary session handshakes.</p> 1801 <p> 1802 The following four storage <em>type</em>s are currently supported:</p> 1803 <ul> 1804 <li><code>none</code> 1805 1806 <p>This disables the global/inter-process Session Cache. This 1807 will incur a noticeable speed penalty and may cause problems if 1808 using certain browsers, particularly if client certificates are 1809 enabled. This setting is not recommended.</p></li> 1810 1811 <li><code>nonenotnull</code> 1812 1813 <p>This disables any global/inter-process Session Cache. However 1814 it does force OpenSSL to send a non-null session ID to 1815 accommodate buggy clients that require one.</p></li> 1816 1817 <li><code>dbm:/path/to/datafile</code> 1818 1819 <p>This makes use of a DBM hashfile on the local disk to 1820 synchronize the local OpenSSL memory caches of the server 1821 processes. This session cache may suffer reliability issues under 1822 high load.</p></li> 1823 1824 <li><code>shm:/path/to/datafile</code>[<code>(</code><em>size</em><code>)</code>] 1825 1826 <p>This makes use of a high-performance cyclic buffer 1827 (approx. <em>size</em> bytes in size) inside a shared memory 1828 segment in RAM (established via <code>/path/to/datafile</code>) to 1829 synchronize the local OpenSSL memory caches of the server 1830 processes. This is the recommended session cache.</p></li> 1831 1832 <li><code>dc:UNIX:/path/to/socket</code> 1833 1834 <p>This makes use of the <a href="http://www.distcache.org/">distcache</a> distributed session 1835 caching libraries. The argument should specify the location of 1836 the server or proxy to be used using the distcache address syntax; 1837 for example, <code>UNIX:/path/to/socket</code> specifies a UNIX 1838 domain socket (typically a local dc_client proxy); 1839 <code>IP:server.example.com:9001</code> specifies an IP 1840 address.</p></li> 1841 1842 </ul> 1843 <div class="example"><h3>Examples</h3><p><code> 1844 SSLSessionCache dbm:/usr/local/apache/logs/ssl_gcache_data<br /> 1845 SSLSessionCache shm:/usr/local/apache/logs/ssl_gcache_data(512000) 1846 </code></p></div> 1847 1848 </div> 1849 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1850 <div class="directive-section"><h2><a name="SSLSessionCacheTimeout" id="SSLSessionCacheTimeout">SSLSessionCacheTimeout</a> <a name="sslsessioncachetimeout" id="sslsessioncachetimeout">Directive</a></h2> 1851 <table class="directive"> 1852 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Number of seconds before an SSL session expires 1853 in the Session Cache</td></tr> 1854 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLSessionCacheTimeout <em>seconds</em></code></td></tr> 1855 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLSessionCacheTimeout 300</code></td></tr> 1856 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1857 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1858 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1859 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Applies also to RFC 5077 TLS session resumption in Apache 2.2.28 and later</td></tr> 1860 </table> 1861 <p> 1862 This directive sets the timeout in seconds for the information stored in the 1863 global/inter-process SSL Session Cache, the OpenSSL internal memory cache and 1864 for sessions resumed by TLS session resumption (RFC 5077). 1865 It can be set as low as 15 for testing, but should be set to higher 1866 values like 300 in real life.</p> 1867 <div class="example"><h3>Example</h3><p><code> 1868 SSLSessionCacheTimeout 600 1869 </code></p></div> 1870 1871 </div> 1872 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1873 <div class="directive-section"><h2><a name="SSLSessionTicketKeyFile" id="SSLSessionTicketKeyFile">SSLSessionTicketKeyFile</a> <a name="sslsessionticketkeyfile" id="sslsessionticketkeyfile">Directive</a></h2> 1874 <table class="directive"> 1875 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Persistent encryption/decryption key for TLS session tickets</td></tr> 1876 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLSessionTicketKeyFile <em>file-path</em></code></td></tr> 1877 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1878 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1879 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1880 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.2.30 and later, if using OpenSSL 0.9.8h or later</td></tr> 1881 </table> 1882 <p>Optionally configures a secret key for encrypting and decrypting 1883 TLS session tickets, as defined in 1884 <a href="http://www.ietf.org/rfc/rfc5077.txt">RFC 5077</a>. 1885 Primarily suitable for clustered environments where TLS sessions information 1886 should be shared between multiple nodes. For single-instance httpd setups, 1887 it is recommended to <em>not</em> configure a ticket key file, but to 1888 rely on (random) keys generated by mod_ssl at startup, instead.</p> 1889 <p>The ticket key file must contain 48 bytes of random data, 1890 preferrably created from a high-entropy source. On a Unix-based system, 1891 a ticket key file can be created as follows:</p> 1892 1893 <div class="example"><p><code> 1894 dd if=/dev/random of=/path/to/file.tkey bs=1 count=48 1895 </code></p></div> 1896 1897 <p>Ticket keys should be rotated (replaced) on a frequent basis, 1898 as this is the only way to invalidate an existing session ticket - 1899 OpenSSL currently doesn't allow to specify a limit for ticket lifetimes. 1900 A new ticket key only gets used after restarting the web server. 1901 All existing session tickets become invalid after a restart.</p> 1902 1903 <div class="warning"> 1904 <p>The ticket key file contains sensitive keying material and should 1905 be protected with file permissions similar to those used for 1906 <code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code>.</p> 1907 </div> 1908 1909 </div> 1910 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1911 <div class="directive-section"><h2><a name="SSLSessionTickets" id="SSLSessionTickets">SSLSessionTickets</a> <a name="sslsessiontickets" id="sslsessiontickets">Directive</a></h2> 1912 <table class="directive"> 1913 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable or disable use of TLS session tickets</td></tr> 1914 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLSessionTickets on|off</code></td></tr> 1915 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLSessionTickets on</code></td></tr> 1916 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1917 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1918 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1919 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.2.30 and later, if using OpenSSL 0.9.8f 1920 or later.</td></tr> 1921 </table> 1922 <p>This directive allows to enable or disable the use of TLS session tickets 1923 (RFC 5077).</p> 1924 <div class="warning"> 1925 <p>TLS session tickets are enabled by default. Using them without restarting 1926 the web server with an appropriate frequency (e.g. daily) compromises perfect 1927 forward secrecy.</p> 1928 </div> 1929 1930 </div> 1931 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1932 <div class="directive-section"><h2><a name="SSLStrictSNIVHostCheck" id="SSLStrictSNIVHostCheck">SSLStrictSNIVHostCheck</a> <a name="sslstrictsnivhostcheck" id="sslstrictsnivhostcheck">Directive</a></h2> 1933 <table class="directive"> 1934 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Whether to allow non SNI clients to access a name based virtual 1935 host. 1936 </td></tr> 1937 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLStrictSNIVHostCheck on|off</code></td></tr> 1938 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLStrictSNIVHostCheck off</code></td></tr> 1939 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr> 1940 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1941 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1942 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.2.12 and later</td></tr> 1943 </table> 1944 <p> 1945 This directive sets whether a non SNI client is allowed to access a name based 1946 virtual host. If set to <code>on</code> in the non default name based virtual 1947 host, non SNI clients are not allowed to access this particular virtual host. 1948 If set to <code>on</code> in the default name based virtual host, non SNI 1949 clients are not allowed to access any name based virtual host belonging to 1950 this IP / port combination. 1951 </p> 1952 1953 <div class="warning"><p> 1954 This option is only available if httpd was compiled against an SNI capable 1955 version of OpenSSL. 1956 </p></div> 1957 1958 <div class="example"><h3>Example</h3><p><code> 1959 SSLStrictSNIVHostCheck on 1960 </code></p></div> 1961 1962 </div> 1963 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1964 <div class="directive-section"><h2><a name="SSLUserName" id="SSLUserName">SSLUserName</a> <a name="sslusername" id="sslusername">Directive</a></h2> 1965 <table class="directive"> 1966 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Variable name to determine user name</td></tr> 1967 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLUserName <em>varname</em></code></td></tr> 1968 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, directory, .htaccess</td></tr> 1969 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 1970 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1971 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1972 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.0.51 and later</td></tr> 1973 </table> 1974 <p> 1975 This directive sets the "user" field in the Apache request object. 1976 This is used by lower modules to identify the user with a character 1977 string. In particular, this may cause the environment variable 1978 <code>REMOTE_USER</code> to be set. The <em>varname</em> can be 1979 any of the <a href="#envvars">SSL environment variables</a>.</p> 1980 1981 <p>Note that this directive has no effect if the 1982 <code>FakeBasicAuth</code> option is used (see <a href="#ssloptions">SSLOptions</a>).</p> 1983 1984 <div class="example"><h3>Example</h3><p><code> 1985 SSLUserName SSL_CLIENT_S_DN_CN 1986 </code></p></div> 1987 1988 </div> 1989 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 1990 <div class="directive-section"><h2><a name="SSLVerifyClient" id="SSLVerifyClient">SSLVerifyClient</a> <a name="sslverifyclient" id="sslverifyclient">Directive</a></h2> 1991 <table class="directive"> 1992 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Type of Client Certificate verification</td></tr> 1993 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLVerifyClient <em>level</em></code></td></tr> 1994 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLVerifyClient none</code></td></tr> 1995 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> 1996 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 1997 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 1998 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 1999 </table> 2000 <p> 2001 This directive sets the Certificate verification level for the Client 2002 Authentication. Notice that this directive can be used both in per-server and 2003 per-directory context. In per-server context it applies to the client 2004 authentication process used in the standard SSL handshake when a connection is 2005 established. In per-directory context it forces a SSL renegotiation with the 2006 reconfigured client verification level after the HTTP request was read but 2007 before the HTTP response is sent.</p> 2008 <p> 2009 The following levels are available for <em>level</em>:</p> 2010 <ul> 2011 <li><strong>none</strong>: 2012 no client Certificate is required at all</li> 2013 <li><strong>optional</strong>: 2014 the client <em>may</em> present a valid Certificate</li> 2015 <li><strong>require</strong>: 2016 the client <em>has to</em> present a valid Certificate</li> 2017 <li><strong>optional_no_ca</strong>: 2018 the client may present a valid Certificate<br /> 2019 but it need not to be (successfully) verifiable.</li> 2020 </ul> 2021 <p>In practice only levels <strong>none</strong> and 2022 <strong>require</strong> are really interesting, because level 2023 <strong>optional</strong> doesn't work with all browsers and level 2024 <strong>optional_no_ca</strong> is actually against the idea of 2025 authentication (but can be used to establish SSL test pages, etc.)</p> 2026 <div class="example"><h3>Example</h3><p><code> 2027 SSLVerifyClient require 2028 </code></p></div> 2029 2030 </div> 2031 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 2032 <div class="directive-section"><h2><a name="SSLVerifyDepth" id="SSLVerifyDepth">SSLVerifyDepth</a> <a name="sslverifydepth" id="sslverifydepth">Directive</a></h2> 2033 <table class="directive"> 2034 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Maximum depth of CA Certificates in Client 2035 Certificate verification</td></tr> 2036 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLVerifyDepth <em>number</em></code></td></tr> 2037 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLVerifyDepth 1</code></td></tr> 2038 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> 2039 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 2040 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 2041 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr> 2042 </table> 2043 <p> 2044 This directive sets how deeply mod_ssl should verify before deciding that the 2045 clients don't have a valid certificate. Notice that this directive can be 2046 used both in per-server and per-directory context. In per-server context it 2047 applies to the client authentication process used in the standard SSL 2048 handshake when a connection is established. In per-directory context it forces 2049 a SSL renegotiation with the reconfigured client verification depth after the 2050 HTTP request was read but before the HTTP response is sent.</p> 2051 <p> 2052 The depth actually is the maximum number of intermediate certificate issuers, 2053 i.e. the number of CA certificates which are max allowed to be followed while 2054 verifying the client certificate. A depth of 0 means that self-signed client 2055 certificates are accepted only, the default depth of 1 means the client 2056 certificate can be self-signed or has to be signed by a CA which is directly 2057 known to the server (i.e. the CA's certificate is under 2058 <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code>), etc.</p> 2059 <div class="example"><h3>Example</h3><p><code> 2060 SSLVerifyDepth 10 2061 </code></p></div> 2062 2063 </div> 2064 </div> 2065 <div class="bottomlang"> 2066 <p><span>Available Languages: </span><a href="../en/mod/mod_ssl.html" title="English"> en </a></p> 2067 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> 2068 <script type="text/javascript"><!--//--><![CDATA[//><!-- 2069 var comments_shortname = 'httpd'; 2070 var comments_identifier = 'http://httpd.apache.org/docs/2.2/mod/mod_ssl.html'; 2071 (function(w, d) { 2072 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 2073 d.write('<div id="comments_thread"><\/div>'); 2074 var s = d.createElement('script'); 2075 s.type = 'text/javascript'; 2076 s.async = true; 2077 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 2078 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 2079 } 2080 else { 2081 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 2082 } 2083 })(window, document); 2084 //--><!]]></script></div><div id="footer"> 2085 <p class="apache">Copyright 2017 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 2086 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 2087 if (typeof(prettyPrint) !== 'undefined') { 2088 prettyPrint(); 2089 } 2090 //--><!]]></script> 2091 </body></html>