mirror of
https://github.com/apache/httpd.git
synced 2025-07-30 20:03:10 +03:00
Begin adding the SSL doc to the httpd-2.0 tree. Start with the html files.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@91752 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Bill Stoddard
223
docs/manual/ssl/index.html
Normal file
223
docs/manual/ssl/index.html
Normal file
@ -0,0 +1,223 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>mod_ssl: Title Page</title>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions
|
||||||
|
are met:
|
||||||
|
|
||||||
|
1. Redistributions of source code must retain the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer.
|
||||||
|
|
||||||
|
2. Redistributions in binary form must reproduce the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer in the documentation and/or other materials
|
||||||
|
provided with the distribution.
|
||||||
|
|
||||||
|
3. All advertising materials mentioning features or use of this
|
||||||
|
software must display the following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
4. The name "mod_ssl" must not be used to endorse or promote
|
||||||
|
products derived from this software without prior written
|
||||||
|
permission.
|
||||||
|
|
||||||
|
5. Redistributions of any form whatsoever must retain the
|
||||||
|
following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY
|
||||||
|
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S. ENGELSCHALL OR
|
||||||
|
HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||||
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||||
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||||
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||||
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||||
|
OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
-->
|
||||||
|
<style type="text/css"><!--
|
||||||
|
A:link {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:active {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:visited {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
#sf {
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H1 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 24pt;
|
||||||
|
line-height: 24pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H2 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 18pt;
|
||||||
|
line-height: 18pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H3 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 14pt;
|
||||||
|
line-height: 14pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H4 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 12pt;
|
||||||
|
line-height: 12pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#H {
|
||||||
|
}
|
||||||
|
#D {
|
||||||
|
background-color: #f0f0f0;
|
||||||
|
}
|
||||||
|
#faq {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#howto {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#term {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
--></style>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
function ro_imgNormal(imgName) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_n.src');
|
||||||
|
self.status = '';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function ro_imgOver(imgName, descript) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_o.src');
|
||||||
|
self.status = descript;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_unknown1_n = new Image();
|
||||||
|
ro_img_unknown1_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_unknown1_o = new Image();
|
||||||
|
ro_img_unknown1_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body bgcolor="#ffffff" text="#000000" link="#333399" alink="#9999ff" vlink="#000066">
|
||||||
|
<div align="center">
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<br>
|
||||||
|
<table cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<img
|
||||||
|
src="ssl_cover_title.jpg"
|
||||||
|
alt="User Manual"
|
||||||
|
width="421" height="73">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<font face="Arial,Helvetica">mod_ssl version 2.8</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<a
|
||||||
|
href="http://www.modssl.org/"
|
||||||
|
><img
|
||||||
|
src="ssl_cover_logo.jpg"
|
||||||
|
alt="mod_ssl - The Apache Interface to OpenSSL"
|
||||||
|
border="0"
|
||||||
|
width="504" height="231"></a>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<table summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<tt>Ralf S. Engelschall</tt><br>
|
||||||
|
<tt>rse@engelschall.com</tt><br>
|
||||||
|
<tt>www.engelschall.com</tt><br>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
|
||||||
|
</td>
|
||||||
|
<td align="right" valign="bottom">
|
||||||
|
<a href="ssl_overview.html" onmouseover="ro_imgOver('ro_img_unknown1', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_unknown1'); return true" onfocus="ro_imgOver('ro_img_unknown1', 'next page'); return true" onblur="ro_imgNormal('ro_img_unknown1'); return true"><img name="ro_img_unknown1" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br>Overview
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="30" height="1" align="bottom" border="0">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
223
docs/manual/ssl/index.html.en
Normal file
223
docs/manual/ssl/index.html.en
Normal file
@ -0,0 +1,223 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>mod_ssl: Title Page</title>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions
|
||||||
|
are met:
|
||||||
|
|
||||||
|
1. Redistributions of source code must retain the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer.
|
||||||
|
|
||||||
|
2. Redistributions in binary form must reproduce the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer in the documentation and/or other materials
|
||||||
|
provided with the distribution.
|
||||||
|
|
||||||
|
3. All advertising materials mentioning features or use of this
|
||||||
|
software must display the following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
4. The name "mod_ssl" must not be used to endorse or promote
|
||||||
|
products derived from this software without prior written
|
||||||
|
permission.
|
||||||
|
|
||||||
|
5. Redistributions of any form whatsoever must retain the
|
||||||
|
following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY
|
||||||
|
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S. ENGELSCHALL OR
|
||||||
|
HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||||
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||||
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||||
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||||
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||||
|
OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
-->
|
||||||
|
<style type="text/css"><!--
|
||||||
|
A:link {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:active {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:visited {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
#sf {
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H1 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 24pt;
|
||||||
|
line-height: 24pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H2 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 18pt;
|
||||||
|
line-height: 18pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H3 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 14pt;
|
||||||
|
line-height: 14pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H4 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 12pt;
|
||||||
|
line-height: 12pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#H {
|
||||||
|
}
|
||||||
|
#D {
|
||||||
|
background-color: #f0f0f0;
|
||||||
|
}
|
||||||
|
#faq {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#howto {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#term {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
--></style>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
function ro_imgNormal(imgName) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_n.src');
|
||||||
|
self.status = '';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function ro_imgOver(imgName, descript) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_o.src');
|
||||||
|
self.status = descript;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_unknown1_n = new Image();
|
||||||
|
ro_img_unknown1_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_unknown1_o = new Image();
|
||||||
|
ro_img_unknown1_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body bgcolor="#ffffff" text="#000000" link="#333399" alink="#9999ff" vlink="#000066">
|
||||||
|
<div align="center">
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<br>
|
||||||
|
<table cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<img
|
||||||
|
src="ssl_cover_title.jpg"
|
||||||
|
alt="User Manual"
|
||||||
|
width="421" height="73">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<font face="Arial,Helvetica">mod_ssl version 2.8</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<a
|
||||||
|
href="http://www.modssl.org/"
|
||||||
|
><img
|
||||||
|
src="ssl_cover_logo.jpg"
|
||||||
|
alt="mod_ssl - The Apache Interface to OpenSSL"
|
||||||
|
border="0"
|
||||||
|
width="504" height="231"></a>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<table summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<tt>Ralf S. Engelschall</tt><br>
|
||||||
|
<tt>rse@engelschall.com</tt><br>
|
||||||
|
<tt>www.engelschall.com</tt><br>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
|
||||||
|
</td>
|
||||||
|
<td align="right" valign="bottom">
|
||||||
|
<a href="ssl_overview.html" onmouseover="ro_imgOver('ro_img_unknown1', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_unknown1'); return true" onfocus="ro_imgOver('ro_img_unknown1', 'next page'); return true" onblur="ro_imgNormal('ro_img_unknown1'); return true"><img name="ro_img_unknown1" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br>Overview
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="30" height="1" align="bottom" border="0">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
551
docs/manual/ssl/ssl_compat.html
Normal file
551
docs/manual/ssl/ssl_compat.html
Normal file
@ -0,0 +1,551 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>mod_ssl: Compatibility</title>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions
|
||||||
|
are met:
|
||||||
|
|
||||||
|
1. Redistributions of source code must retain the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer.
|
||||||
|
|
||||||
|
2. Redistributions in binary form must reproduce the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer in the documentation and/or other materials
|
||||||
|
provided with the distribution.
|
||||||
|
|
||||||
|
3. All advertising materials mentioning features or use of this
|
||||||
|
software must display the following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
4. The name "mod_ssl" must not be used to endorse or promote
|
||||||
|
products derived from this software without prior written
|
||||||
|
permission.
|
||||||
|
|
||||||
|
5. Redistributions of any form whatsoever must retain the
|
||||||
|
following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY
|
||||||
|
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S. ENGELSCHALL OR
|
||||||
|
HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||||
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||||
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||||
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||||
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||||
|
OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
-->
|
||||||
|
<style type="text/css"><!--
|
||||||
|
A:link {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:active {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:visited {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
#sf {
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H1 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 24pt;
|
||||||
|
line-height: 24pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H2 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 18pt;
|
||||||
|
line-height: 18pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H3 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 14pt;
|
||||||
|
line-height: 14pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H4 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 12pt;
|
||||||
|
line-height: 12pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#H {
|
||||||
|
}
|
||||||
|
#D {
|
||||||
|
background-color: #f0f0f0;
|
||||||
|
}
|
||||||
|
#faq {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#howto {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#term {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
--></style>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
function ro_imgNormal(imgName) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_n.src');
|
||||||
|
self.status = '';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function ro_imgOver(imgName, descript) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_o.src');
|
||||||
|
self.status = descript;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_top_n = new Image();
|
||||||
|
ro_img_prev_top_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_top_o = new Image();
|
||||||
|
ro_img_prev_top_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_bot_n = new Image();
|
||||||
|
ro_img_prev_bot_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_bot_o = new Image();
|
||||||
|
ro_img_prev_bot_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_next_top_n = new Image();
|
||||||
|
ro_img_next_top_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_next_top_o = new Image();
|
||||||
|
ro_img_next_top_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_next_bot_n = new Image();
|
||||||
|
ro_img_next_bot_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_next_bot_o = new Image();
|
||||||
|
ro_img_next_bot_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body bgcolor="#ffffff" text="#000000" link="#333399" alink="#9999ff" vlink="#000066">
|
||||||
|
<div align="center">
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="600" height="1" align="bottom" border="0"><br>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left" valign="bottom">
|
||||||
|
<font face="Arial,Helvetica" size="+2"><b>mod_ssl</b></font>
|
||||||
|
</td>
|
||||||
|
<td align="right">
|
||||||
|
<img src="ssl_template.head-chapter.gif" alt="Chapter" width="175" height="94"> <img src="ssl_template.head-num-4.gif" alt="4" width="74" height="89">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="ssl_reference.html" onmouseover="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_top'); return true" onfocus="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_top'); return true"><img name="ro_img_prev_top" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Reference</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
<a href="ssl_howto.html" onmouseover="ro_imgOver('ro_img_next_top', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_top'); return true" onfocus="ro_imgOver('ro_img_next_top', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_top'); return true"><img name="ro_img_next_top" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">HowTo</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<br>
|
||||||
|
<img src="ssl_template.title-compat.gif" alt="Compatibility" width="456" height="60">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="0" width="200" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<em>
|
||||||
|
All PCs are compatible. But some of
|
||||||
|
them are more compatible than others.
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<font size="-1">
|
||||||
|
Unknown
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
<table cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr valign="bottom">
|
||||||
|
<td>
|
||||||
|
<img src="ssl_compat.gfont000.gif" alt="H" width="40" height="34" border="0" align="left">
|
||||||
|
ere we talk about backward compatibility to other SSL solutions. As you
|
||||||
|
perhaps know, mod_ssl is not the only existing SSL solution for Apache.
|
||||||
|
Actually there are four additional major products available on the market: Ben
|
||||||
|
Laurie's freely available <a href="http://www.apache-ssl.org/">Apache-SSL</a>
|
||||||
|
(from where mod_ssl were originally derived in 1998), RedHat's commercial <a
|
||||||
|
href="http://www.redhat.com/products/product-details.phtml?id=rhsa">Secure Web
|
||||||
|
Server</a> (which is based on mod_ssl), Covalent's commercial <a
|
||||||
|
href="http://raven.covalent.net/">Raven SSL Module</a> (also based on mod_ssl)
|
||||||
|
and finally C2Net's commercial product <a
|
||||||
|
href="http://www.c2.net/products/stronghold/">Stronghold</a> (based on a
|
||||||
|
different evolution branch named Sioux up to Stronghold 2.x and based on
|
||||||
|
mod_ssl since Stronghold 3.x).
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="5" border="0" bgcolor="#ccccff" summary="">
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#333399">
|
||||||
|
<font face="Arial,Helvetica" color="#ccccff">
|
||||||
|
<b>Table Of Contents</b>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<font face="Arial,Helvetica" size="-1">
|
||||||
|
<a href="#ToC1"><strong>Configuration Directives</strong></a><br>
|
||||||
|
<a href="#ToC2"><strong>Environment Variables</strong></a><br>
|
||||||
|
<a href="#ToC3"><strong>Custom Log Functions</strong></a><br>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
The idea in mod_ssl is mainly the following: because mod_ssl provides mostly a
|
||||||
|
superset of the functionality of all other solutions we can easily provide
|
||||||
|
backward compatibility for most of the cases. Actually there are three
|
||||||
|
compatibility areas we currently address: configuration directives,
|
||||||
|
environment variables and custom log functions.
|
||||||
|
<h2><a name="ToC1">Configuration Directives</a></h2>
|
||||||
|
For backward compatibility to the configuration directives of other SSL
|
||||||
|
solutions we do an on-the-fly mapping: directives which have a direct
|
||||||
|
counterpart in mod_ssl are mapped silently while other directives lead to a
|
||||||
|
warning message in the logfiles. The currently implemented directive mapping
|
||||||
|
is listed in <a href="#table1">Table 1</a>. Currently full backward
|
||||||
|
compatibilty is provided only for Apache-SSL 1.x and mod_ssl 2.0.x.
|
||||||
|
Compatibility to Sioux 1.x and Stronghold 2.x is only partial because of
|
||||||
|
special functionality in these interfaces which mod_ssl (still) doesn't
|
||||||
|
provide.
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="table1"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Table 1: Configuration Directive Mapping</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="0" cellpadding="2" width="598" summary="">
|
||||||
|
<tr id="D">
|
||||||
|
<td><strong>Old Directive</strong></td>
|
||||||
|
<td><strong>mod_ssl Directive</strong></td>
|
||||||
|
<td><strong>Comment</strong></td>
|
||||||
|
</tr>
|
||||||
|
<tr id="H"><td colspan="3"><b>Apache-SSL 1.x & mod_ssl 2.0.x compatibility:</b></td></tr>
|
||||||
|
<tr id="D"><td><code>SSLEnable</code></td><td><code>SSLEngine on</code></td><td>compactified</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLDisable</code></td><td><code>SSLEngine off</code></td><td>compactified</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLLogFile</code> <em>file</em></td><td><code>SSLLog</code> <em>file</em></td><td>compactified</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLRequiredCiphers</code> <em>spec</em></td><td><code>SSLCipherSuite</code> <em>spec</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLRequireCipher</code> <em>c1</em> ...</td><td><code>SSLRequire %{SSL_CIPHER} in {"</code><em>c1</em><code>", ...}</code></td><td>generalized</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLBanCipher</code> <em>c1</em> ...</td><td><code>SSLRequire not (%{SSL_CIPHER} in {"</code><em>c1</em><code>", ...})</code></td><td>generalized</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLFakeBasicAuth</td><td><code>SSLOptions +FakeBasicAuth</code></td><td>merged</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLCacheServerPath</code> <em>dir</em></td><td>-</td><td>functionality removed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLCacheServerPort</code> <em>integer</em></td><td>-</td><td>functionality removed</td></tr>
|
||||||
|
<tr id="H"><td colspan="3"><b>Apache-SSL 1.x compatibility:</b></td></tr>
|
||||||
|
<tr id="D"><td><code>SSLExportClientCertificates</td><td><code>SSLOptions +ExportCertData</code></td><td>merged</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLCacheServerRunDir</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="D"><td colspan="3"><b>Sioux 1.x compatibility:</b></td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CertFile</code> <em>file</em></td><td><code>SSLCertificateFile</code> <em>file</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_KeyFile</code> <em>file</em></td><td><code>SSLCertificateKeyFile</code> <em>file</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CipherSuite</code> <em>arg</em></td><td><code>SSLCipherSuite</code> <em>arg</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_X509VerifyDir</code> <em>arg</em></td><td><code>SSLCACertificatePath</code> <em>arg</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_Log</code> <em>file</em></td><td><code>SSLLogFile</code> <em>file</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_Connect</code> <em>flag</em></td><td><code>SSLEngine</code> <em>flag</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_ClientAuth</code> <em>arg</em></td><td><code>SSLVerifyClient</code> <em>arg</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_X509VerifyDepth</code> <em>arg</em></td><td><code>SSLVerifyDepth</code> <em>arg</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_FetchKeyPhraseFrom</code> <em>arg</em></td><td>-</td><td>not directly mappable; use SSLPassPhraseDialog</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SessionDir</code> <em>dir</em></td><td>-</td><td>not directly mappable; use SSLSessionCache</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_Require</code> <em>expr</em></td><td>-</td><td>not directly mappable; use SSLRequire</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CertFileType</code> <em>arg</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_KeyFileType</code> <em>arg</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_X509VerifyPolicy</code> <em>arg</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_LogX509Attributes</code> <em>arg</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="D"><td colspan="3"><b>Stronghold 2.x compatibility:</b></td></tr>
|
||||||
|
<tr id="H"><td><code>StrongholdAccelerator</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>StrongholdKey</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>StrongholdLicenseFile</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLFlag</code> <em>flag</em></td><td><code>SSLEngine</code> <em>flag</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLSessionLockFile</code> <em>file</em></td><td><code>SSLMutex</code> <em>file</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLCipherList</code> <em>spec</em></td><td><code>SSLCipherSuite</code> <em>spec</em></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>RequireSSL</code></td><td><code>SSLRequireSSL</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLErrorFile</code> <em>file</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLRoot</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CertificateLogDir</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>AuthCertDir</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_Group</code> <em>name</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLProxyMachineCertPath</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLProxyMachineCertFile</code> <em>file</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLProxyCACertificatePath</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLProxyCACertificateFile</code> <em>file</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="H"><td><code>SSLProxyVerifyDepth</code> <em>number</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLProxyCipherList</code> <em>spec</em></td><td>-</td><td>functionality not supported</td></tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
<br>
|
||||||
|
<h2><a name="ToC2">Environment Variables</a></h2>
|
||||||
|
When you use ``<code>SSLOptions +CompatEnvVars</code>'' additional environment
|
||||||
|
variables are generated. They all correspond to existing official mod_ssl
|
||||||
|
variables. The currently implemented variable derivation is listed in <a
|
||||||
|
href="#table2">Table 2</a>.
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="table2"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Table 2: Environment Variable Derivation</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="0" cellpadding="2" width="598" summary="">
|
||||||
|
<tr id="D">
|
||||||
|
<td><strong>Old Variable</strong></td>
|
||||||
|
<td><strong>mod_ssl Variable</strong></td>
|
||||||
|
<td><strong>Comment</strong></td>
|
||||||
|
</tr>
|
||||||
|
<tr id="H"><td><code>SSL_PROTOCOL_VERSION</code></td><td><code>SSL_PROTOCOL</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSLEAY_VERSION</code></td><td><code>SSL_VERSION_LIBRARY</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>HTTPS_SECRETKEYSIZE</code></td><td><code>SSL_CIPHER_USEKEYSIZE</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>HTTPS_KEYSIZE</code></td><td><code>SSL_CIPHER_ALGKEYSIZE</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>HTTPS_CIPHER</code></td><td><code>SSL_CIPHER</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>HTTPS_EXPORT</code></td><td><code>SSL_CIPHER_EXPORT</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_KEY_SIZE</code></td><td><code>SSL_CIPHER_ALGKEYSIZE</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_CERTIFICATE</code></td><td><code>SSL_SERVER_CERT</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_CERT_START</code></td><td><code>SSL_SERVER_V_START</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_CERT_END</code></td><td><code>SSL_SERVER_V_END</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_CERT_SERIAL</code></td><td><code>SSL_SERVER_M_SERIAL</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_SIGNATURE_ALGORITHM</code></td><td><code>SSL_SERVER_A_SIG</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_DN</code></td><td><code>SSL_SERVER_S_DN</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_CN</code></td><td><code>SSL_SERVER_S_DN_CN</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_EMAIL</code></td><td><code>SSL_SERVER_S_DN_Email</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_O</code></td><td><code>SSL_SERVER_S_DN_O</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_OU</code></td><td><code>SSL_SERVER_S_DN_OU</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_C</code></td><td><code>SSL_SERVER_S_DN_C</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_SP</code></td><td><code>SSL_SERVER_S_DN_SP</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_L</code></td><td><code>SSL_SERVER_S_DN_L</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_IDN</code></td><td><code>SSL_SERVER_I_DN</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_ICN</code></td><td><code>SSL_SERVER_I_DN_CN</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_IEMAIL</code></td><td><code>SSL_SERVER_I_DN_Email</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_IO</code></td><td><code>SSL_SERVER_I_DN_O</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_IOU</code></td><td><code>SSL_SERVER_I_DN_OU</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_IC</code></td><td><code>SSL_SERVER_I_DN_C</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_ISP</code></td><td><code>SSL_SERVER_I_DN_SP</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_IL</code></td><td><code>SSL_SERVER_I_DN_L</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_CERTIFICATE</code></td><td><code>SSL_CLIENT_CERT</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_CERT_START</code></td><td><code>SSL_CLIENT_V_START</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_CERT_END</code></td><td><code>SSL_CLIENT_V_END</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_CERT_SERIAL</code></td><td><code>SSL_CLIENT_M_SERIAL</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_SIGNATURE_ALGORITHM</code></td><td><code>SSL_CLIENT_A_SIG</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_DN</code></td><td><code>SSL_CLIENT_S_DN</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_CN</code></td><td><code>SSL_CLIENT_S_DN_CN</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_EMAIL</code></td><td><code>SSL_CLIENT_S_DN_Email</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_O</code></td><td><code>SSL_CLIENT_S_DN_O</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_OU</code></td><td><code>SSL_CLIENT_S_DN_OU</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_C</code></td><td><code>SSL_CLIENT_S_DN_C</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_SP</code></td><td><code>SSL_CLIENT_S_DN_SP</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_L</code></td><td><code>SSL_CLIENT_S_DN_L</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_IDN</code></td><td><code>SSL_CLIENT_I_DN</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_ICN</code></td><td><code>SSL_CLIENT_I_DN_CN</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_IEMAIL</code></td><td><code>SSL_CLIENT_I_DN_Email</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_IO</code></td><td><code>SSL_CLIENT_I_DN_O</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_IOU</code></td><td><code>SSL_CLIENT_I_DN_OU</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_IC</code></td><td><code>SSL_CLIENT_I_DN_C</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_ISP</code></td><td><code>SSL_CLIENT_I_DN_SP</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_IL</code></td><td><code>SSL_CLIENT_I_DN_L</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_EXPORT</code></td><td><code>SSL_CIPHER_EXPORT</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_KEYSIZE</code></td><td><code>SSL_CIPHER_ALGKEYSIZE</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SECKEYSIZE</code></td><td><code>SSL_CIPHER_USEKEYSIZE</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SSLEAY_VERSION</code></td><td><code>SSL_VERSION_LIBRARY</code></td><td>renamed</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_STRONG_CRYPTO</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_KEY_EXP</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_KEY_ALGORITHM</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_KEY_SIZE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_SESSIONDIR</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_CERTIFICATELOGDIR</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_CERTFILE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_SERVER_KEYFILE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_SERVER_KEYFILETYPE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_KEY_EXP</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="H"><td><code>SSL_CLIENT_KEY_ALGORITHM</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
<tr id="D"><td><code>SSL_CLIENT_KEY_SIZE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
<br>
|
||||||
|
<h2><a name="ToC3">Custom Log Functions</a></h2>
|
||||||
|
When mod_ssl is built into Apache or at least loaded (under DSO situation)
|
||||||
|
additional functions exist for the <a
|
||||||
|
href="../mod_log_config.html#formats">Custom Log Format</a> of <a
|
||||||
|
href="../mod_log_config.html">mod_log_config</a> as documented in the Reference
|
||||||
|
Chapter. Beside the ``<code>%{</code><em>varname</em><code>}x</code>''
|
||||||
|
eXtension format function which can be used to expand any variables provided
|
||||||
|
by any module, an additional Cryptography
|
||||||
|
``<code>%{</code><em>name</em><code>}c</code>'' cryptography format function
|
||||||
|
exists for backward compatibility. The currently implemented function calls
|
||||||
|
are listed in <a href="#table3">Table 3</a>.
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="table3"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Table 3: Custom Log Cryptography Function</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="0" cellpadding="2" width="598" summary="">
|
||||||
|
<tr id="H">
|
||||||
|
<td><strong>Function Call</strong></td>
|
||||||
|
<td><strong>Description</strong></td>
|
||||||
|
</tr>
|
||||||
|
<tr id="D"><td><code>%...{version}c</code></td> <td>SSL protocol version</td></tr>
|
||||||
|
<tr id="H"><td><code>%...{cipher}c</code></td> <td>SSL cipher</td></tr>
|
||||||
|
<tr id="D"><td><code>%...{subjectdn}c</code></td> <td>Client Certificate Subject Distinguished Name</td></tr>
|
||||||
|
<tr id="H"><td><code>%...{issuerdn}c</code></td> <td>Client Certificate Issuer Distinguished Name</td></tr>
|
||||||
|
<tr id="D"><td><code>%...{errcode}c</code></td> <td>Certificate Verification Error (numerical)</td></tr>
|
||||||
|
<tr id="H"><td><code>%...{errstr}c</code></td> <td>Certificate Verification Error (string)</td></tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
<br>
|
||||||
|
<table summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="ssl_reference.html" onmouseover="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_bot'); return true" onfocus="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_bot'); return true"><img name="ro_img_prev_bot" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Reference</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
<a href="ssl_howto.html" onmouseover="ro_imgOver('ro_img_next_bot', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_bot'); return true" onfocus="ro_imgOver('ro_img_next_bot', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_bot'); return true"><img name="ro_img_next_bot" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">HowTo</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><table width="598" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left"><font face="Arial,Helvetica">
|
||||||
|
<a href="http://www.modssl.org/">mod_ssl</a> 2.8, User Manual<br>
|
||||||
|
The Apache Interface to OpenSSL
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
<td align="right"><font face="Arial,Helvetica">
|
||||||
|
Copyright © 1998-2001
|
||||||
|
<a href="http://www.engelschall.com/">Ralf S. Engelschall</a><br>
|
||||||
|
All Rights Reserved<br>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
1643
docs/manual/ssl/ssl_faq.html
Normal file
1643
docs/manual/ssl/ssl_faq.html
Normal file
File diff suppressed because it is too large
Load Diff
413
docs/manual/ssl/ssl_glossary.html
Normal file
413
docs/manual/ssl/ssl_glossary.html
Normal file
@ -0,0 +1,413 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>mod_ssl: Glossary</title>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions
|
||||||
|
are met:
|
||||||
|
|
||||||
|
1. Redistributions of source code must retain the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer.
|
||||||
|
|
||||||
|
2. Redistributions in binary form must reproduce the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer in the documentation and/or other materials
|
||||||
|
provided with the distribution.
|
||||||
|
|
||||||
|
3. All advertising materials mentioning features or use of this
|
||||||
|
software must display the following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
4. The name "mod_ssl" must not be used to endorse or promote
|
||||||
|
products derived from this software without prior written
|
||||||
|
permission.
|
||||||
|
|
||||||
|
5. Redistributions of any form whatsoever must retain the
|
||||||
|
following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY
|
||||||
|
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S. ENGELSCHALL OR
|
||||||
|
HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||||
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||||
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||||
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||||
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||||
|
OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
-->
|
||||||
|
<style type="text/css"><!--
|
||||||
|
A:link {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:active {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:visited {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
#sf {
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H1 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 24pt;
|
||||||
|
line-height: 24pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H2 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 18pt;
|
||||||
|
line-height: 18pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H3 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 14pt;
|
||||||
|
line-height: 14pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H4 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 12pt;
|
||||||
|
line-height: 12pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#H {
|
||||||
|
}
|
||||||
|
#D {
|
||||||
|
background-color: #f0f0f0;
|
||||||
|
}
|
||||||
|
#faq {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#howto {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#term {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
--></style>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
function ro_imgNormal(imgName) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_n.src');
|
||||||
|
self.status = '';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function ro_imgOver(imgName, descript) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_o.src');
|
||||||
|
self.status = descript;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_top_n = new Image();
|
||||||
|
ro_img_prev_top_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_top_o = new Image();
|
||||||
|
ro_img_prev_top_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_bot_n = new Image();
|
||||||
|
ro_img_prev_bot_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_bot_o = new Image();
|
||||||
|
ro_img_prev_bot_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body bgcolor="#ffffff" text="#000000" link="#333399" alink="#9999ff" vlink="#000066">
|
||||||
|
<div align="center">
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="600" height="1" align="bottom" border="0"><br>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left" valign="bottom">
|
||||||
|
<font face="Arial,Helvetica" size="+2"><b>mod_ssl</b></font>
|
||||||
|
</td>
|
||||||
|
<td align="right">
|
||||||
|
<img src="ssl_template.head-chapter.gif" alt="Chapter" width="175" height="94"> <img src="ssl_template.head-num-7.gif" alt="7" width="74" height="89">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="ssl_faq.html" onmouseover="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_top'); return true" onfocus="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_top'); return true"><img name="ro_img_prev_top" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">F.A.Q. List</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<br>
|
||||||
|
<img src="ssl_template.title-gloss.gif" alt="Glossary" width="456" height="60">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="0" width="300" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<em>
|
||||||
|
``I know you believe you understand what you think I said, but I am not sure you
|
||||||
|
realize that what you heard is not what I meant.''
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<font size="-1">
|
||||||
|
Richard Nixon
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
<dl>
|
||||||
|
<dt><div id="term">Authentication</div>
|
||||||
|
<dd>The positive identification of a network entity such as a server, a
|
||||||
|
client, or a user. In SSL context the server and client
|
||||||
|
<em>Certificate</em> verification process.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Access Control</div>
|
||||||
|
<dd>The restriction of access to network realms. In Apache context
|
||||||
|
usually the restriction of access to certain <em>URLs</em>.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Algorithm</div>
|
||||||
|
<dd>An unambiguous formula or set of rules for solving a problem in a finite
|
||||||
|
number of steps. Algorithms for encryption are usually called <em>Ciphers</em>.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Certificate</div>
|
||||||
|
<dd>A data record used for authenticating network entities such
|
||||||
|
as a server or a client. A certificate contains X.509 information pieces
|
||||||
|
about its owner (called the subject) and the signing <em>Certificate
|
||||||
|
Authority</em> (called the issuer), plus the owner's public key and the
|
||||||
|
signature made by the CA. Network entities verify these signatures using
|
||||||
|
CA certificates.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Certification Authority (CA)</div>
|
||||||
|
<dd>A trusted third party whose purpose is to sign certificates for network
|
||||||
|
entities it has authenticated using secure means. Other network entities
|
||||||
|
can check the signature to verify that a CA has authenticated the bearer
|
||||||
|
of a certificate.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Certificate Signing Request (CSR)</div>
|
||||||
|
<dd>An unsigned certificate for submission to a <em>Certification Authority</em>,
|
||||||
|
which signs it with the <em>Private Key</em> of their CA <em>Certificate</em>. Once
|
||||||
|
the CSR is signed, it becomes a real certificate.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Cipher</div>
|
||||||
|
<dd>An algorithm or system for data encryption. Examples are DES, IDEA, RC4, etc.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Ciphertext</div>
|
||||||
|
<dd>The result after a <em>Plaintext</em> passed a <em>Cipher</em>.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Configuration Directive</div>
|
||||||
|
<dd>A configuration command that controls one or more aspects of a program's
|
||||||
|
behavior. In Apache context these are all the command names in the first
|
||||||
|
column of the configuration files.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">CONNECT</div>
|
||||||
|
<dd>A HTTP command for proxying raw data channels over HTTP. It can be used to
|
||||||
|
encapsulate other protocols, such as the SSL protocol.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Digital Signature</div>
|
||||||
|
<dd>An encrypted text block that validates a certificate or other file. A
|
||||||
|
<em>Certification Authority</em> creates a signature by generating a
|
||||||
|
hash of the <em>Public Key</em> embedded in a <em>Certificate</em>, then
|
||||||
|
encrypting the hash with its own <em>Private Key</em>. Only the CA's
|
||||||
|
public key can decrypt the signature, verifying that the CA has
|
||||||
|
authenticated the network entity that owns the <em>Certificate</em>.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Export-Crippled</div>
|
||||||
|
<dd>Diminished in cryptographic strength (and security) in order to comply
|
||||||
|
with the United States' Export Administration Regulations (EAR).
|
||||||
|
Export-crippled cryptographic software is limited to a small key size,
|
||||||
|
resulting in <em>Ciphertext</em> which usually can be decrypted by brute
|
||||||
|
force.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Fully-Qualified Domain-Name (FQDN)</div>
|
||||||
|
<dd>The unique name of a network entity, consisting of a hostname and a domain
|
||||||
|
name that can resolve to an IP address. For example, <code>www</code> is a
|
||||||
|
hostname, <code>whatever.com</code> is a domain name, and
|
||||||
|
<code>www.whatever.com</code> is a fully-qualified domain name.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">HyperText Transfer Protocol (HTTP)</div>
|
||||||
|
<dd>The HyperText Transport Protocol is the standard transmission protocol used
|
||||||
|
on the World Wide Web.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">HTTPS</div>
|
||||||
|
<dd>The HyperText Transport Protocol (Secure), the standard encrypted
|
||||||
|
communication mechanism on the World Wide Web. This is actually just HTTP
|
||||||
|
over SSL.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Message Digest</div>
|
||||||
|
<dd>A hash of a message, which can be used to verify that the contents of
|
||||||
|
the message have not been altered in transit.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">OpenSSL</div>
|
||||||
|
<dd>The Open Source toolkit for SSL/TLS;
|
||||||
|
see <a href="http://www.openssl.org/">http://www.openssl.org/</a>
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Pass Phrase</div>
|
||||||
|
<dd>The word or phrase that protects private key files.
|
||||||
|
It prevents unauthorized users from encrypting them. Usually it's just
|
||||||
|
the secret encryption/decryption key used for <em>Ciphers</em>.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Plaintext</div>
|
||||||
|
<dd>The unencrypted text.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Private Key</div>
|
||||||
|
<dd>The secret key in a <em>Public Key Cryptography</em> system, used to
|
||||||
|
decrypt incoming messages and sign outgoing ones.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Public Key</div>
|
||||||
|
<dd>The publically available key in a <em>Public Key Cryptography</em> system, used to
|
||||||
|
encrypt messages bound for its owner and to decrypt signatures made by its
|
||||||
|
owner.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Public Key Cryptography</div>
|
||||||
|
<dd>The study and application of asymmetric encryption systems, which use one
|
||||||
|
key for encryption and another for decryption. A corresponding pair of
|
||||||
|
such keys constitutes a key pair. Also called Asymmetric Crypography.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Secure Sockets Layer (SSL)</div>
|
||||||
|
<dd>A protocol created by Netscape Communications Corporation for
|
||||||
|
general communication authentication and encryption over TCP/IP networks.
|
||||||
|
The most popular usage is <em>HTTPS</em>, i.e. the HyperText Transfer
|
||||||
|
Protocol (HTTP) over SSL.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Session</div>
|
||||||
|
<dd>The context information of an SSL communication.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">SSLeay</div>
|
||||||
|
<dd>The original SSL/TLS implementation library developed by
|
||||||
|
Eric A. Young <eay@aus.rsa.com>;
|
||||||
|
see <a href="http://www.ssleay.org/">http://www.ssleay.org/</a>
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Symmetric Cryptography</div>
|
||||||
|
<dd>The study and application of <em>Ciphers</em> that use a single secret key
|
||||||
|
for both encryption and decryption operations.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Transport Layer Security (TLS)</div>
|
||||||
|
<dd>The successor protocol to SSL, created by the Internet Engineering Task
|
||||||
|
Force (IETF) for general communication authentication and encryption over
|
||||||
|
TCP/IP networks. TLS version 1 and is nearly identical with SSL version 3.
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">Uniform Resource Locator (URL)</div>
|
||||||
|
<dd>The formal identifier to locate various resources on the World Wide Web.
|
||||||
|
The most popular URL scheme is <code>http</code>. SSL uses the
|
||||||
|
scheme <code>https</code>
|
||||||
|
<p>
|
||||||
|
<dt><div id="term">X.509</div>
|
||||||
|
<dd>An authentication certificate scheme recommended by the International
|
||||||
|
Telecommunication Union (ITU-T) which is used for SSL/TLS authentication.
|
||||||
|
</dl>
|
||||||
|
<p>
|
||||||
|
<br>
|
||||||
|
<table summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="ssl_faq.html" onmouseover="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_bot'); return true" onfocus="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_bot'); return true"><img name="ro_img_prev_bot" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">F.A.Q. List</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><table width="598" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left"><font face="Arial,Helvetica">
|
||||||
|
<a href="http://www.modssl.org/">mod_ssl</a> 2.8, User Manual<br>
|
||||||
|
The Apache Interface to OpenSSL
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
<td align="right"><font face="Arial,Helvetica">
|
||||||
|
Copyright © 1998-2001
|
||||||
|
<a href="http://www.engelschall.com/">Ralf S. Engelschall</a><br>
|
||||||
|
All Rights Reserved<br>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
929
docs/manual/ssl/ssl_howto.html
Normal file
929
docs/manual/ssl/ssl_howto.html
Normal file
@ -0,0 +1,929 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>mod_ssl: HowTo</title>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions
|
||||||
|
are met:
|
||||||
|
|
||||||
|
1. Redistributions of source code must retain the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer.
|
||||||
|
|
||||||
|
2. Redistributions in binary form must reproduce the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer in the documentation and/or other materials
|
||||||
|
provided with the distribution.
|
||||||
|
|
||||||
|
3. All advertising materials mentioning features or use of this
|
||||||
|
software must display the following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
4. The name "mod_ssl" must not be used to endorse or promote
|
||||||
|
products derived from this software without prior written
|
||||||
|
permission.
|
||||||
|
|
||||||
|
5. Redistributions of any form whatsoever must retain the
|
||||||
|
following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY
|
||||||
|
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S. ENGELSCHALL OR
|
||||||
|
HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||||
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||||
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||||
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||||
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||||
|
OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
-->
|
||||||
|
<style type="text/css"><!--
|
||||||
|
A:link {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:active {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:visited {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
#sf {
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H1 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 24pt;
|
||||||
|
line-height: 24pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H2 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 18pt;
|
||||||
|
line-height: 18pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H3 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 14pt;
|
||||||
|
line-height: 14pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H4 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 12pt;
|
||||||
|
line-height: 12pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#H {
|
||||||
|
}
|
||||||
|
#D {
|
||||||
|
background-color: #f0f0f0;
|
||||||
|
}
|
||||||
|
#faq {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#howto {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#term {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
--></style>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
function ro_imgNormal(imgName) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_n.src');
|
||||||
|
self.status = '';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function ro_imgOver(imgName, descript) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_o.src');
|
||||||
|
self.status = descript;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_top_n = new Image();
|
||||||
|
ro_img_prev_top_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_top_o = new Image();
|
||||||
|
ro_img_prev_top_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_bot_n = new Image();
|
||||||
|
ro_img_prev_bot_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_bot_o = new Image();
|
||||||
|
ro_img_prev_bot_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_next_top_n = new Image();
|
||||||
|
ro_img_next_top_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_next_top_o = new Image();
|
||||||
|
ro_img_next_top_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_next_bot_n = new Image();
|
||||||
|
ro_img_next_bot_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_next_bot_o = new Image();
|
||||||
|
ro_img_next_bot_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body bgcolor="#ffffff" text="#000000" link="#333399" alink="#9999ff" vlink="#000066">
|
||||||
|
<div align="center">
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="600" height="1" align="bottom" border="0"><br>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left" valign="bottom">
|
||||||
|
<font face="Arial,Helvetica" size="+2"><b>mod_ssl</b></font>
|
||||||
|
</td>
|
||||||
|
<td align="right">
|
||||||
|
<img src="ssl_template.head-chapter.gif" alt="Chapter" width="175" height="94"> <img src="ssl_template.head-num-5.gif" alt="5" width="74" height="89">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="ssl_compat.html" onmouseover="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_top'); return true" onfocus="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_top'); return true"><img name="ro_img_prev_top" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Compatibility</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
<a href="ssl_faq.html" onmouseover="ro_imgOver('ro_img_next_top', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_top'); return true" onfocus="ro_imgOver('ro_img_next_top', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_top'); return true"><img name="ro_img_next_top" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">F.A.Q. List</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<br>
|
||||||
|
<img src="ssl_template.title-howto.gif" alt="HowTo" width="456" height="60">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="0" width="200" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<em>
|
||||||
|
``The solution of this problem is trivial
|
||||||
|
and is left as an exercise for the reader.''
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<font size="-1">
|
||||||
|
Standard textbook cookie
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
<table cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr valign="bottom">
|
||||||
|
<td>
|
||||||
|
<img src="ssl_howto.gfont000.gif" alt="H" width="40" height="34" border="0" align="left">
|
||||||
|
ow to solve particular security constraints for an SSL-aware webserver
|
||||||
|
is not always obvious because of the coherences between SSL, HTTP and Apache's
|
||||||
|
way of processing requests. This chapter gives instructions on how to solve
|
||||||
|
such typical situations. Treat is as a first step to find out the final
|
||||||
|
solution, but always try to understand the stuff before you use it. Nothing is
|
||||||
|
worse than using a security solution without knowing it's restrictions and
|
||||||
|
coherences.
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="5" border="0" bgcolor="#ccccff" width="300" summary="">
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#333399">
|
||||||
|
<font face="Arial,Helvetica" color="#ccccff">
|
||||||
|
<b>Table Of Contents</b>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<font face="Arial,Helvetica" size="-1">
|
||||||
|
<a href="#ToC1"><strong>Cipher Suites and Enforced Strong Security</strong></a><br>
|
||||||
|
<a href="#ToC2"><strong>SSLv2 only server</strong></a><br>
|
||||||
|
<a href="#ToC3"><strong>strong encryption only server</strong></a><br>
|
||||||
|
<a href="#ToC4"><strong>server gated cryptography</strong></a><br>
|
||||||
|
<a href="#ToC5"><strong>stronger per-directory requirements</strong></a><br>
|
||||||
|
<a href="#ToC6"><strong>Client Authentication and Access Control</strong></a><br>
|
||||||
|
<a href="#ToC7"><strong>simple certificate-based client authentication</strong></a><br>
|
||||||
|
<a href="#ToC8"><strong>selective certificate-based client authentication</strong></a><br>
|
||||||
|
<a href="#ToC9"><strong>particular certificate-based client authentication</strong></a><br>
|
||||||
|
<a href="#ToC10"><strong>intranet vs. internet authentication</strong></a><br>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<h2><a name="ToC1">Cipher Suites and Enforced Strong Security</a></h2>
|
||||||
|
<ul>
|
||||||
|
<p>
|
||||||
|
<li><a name="ToC2"></a>
|
||||||
|
<a name="cipher-sslv2"></a>
|
||||||
|
<strong id="howto">
|
||||||
|
How can I create a real SSLv2-only server?
|
||||||
|
</strong>
|
||||||
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#cipher-sslv2"><b>L</b></a>]
|
||||||
|
<p>
|
||||||
|
The following creates an SSL server which speaks only the SSLv2 protocol and
|
||||||
|
its ciphers.
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
SSLProtocol -all +SSLv2
|
||||||
|
SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
<li><a name="ToC3"></a>
|
||||||
|
<a name="cipher-strong"></a>
|
||||||
|
<strong id="howto">
|
||||||
|
How can I create an SSL server which accepts strong encryption only?
|
||||||
|
</strong>
|
||||||
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#cipher-strong"><b>L</b></a>]
|
||||||
|
<p>
|
||||||
|
The following enables only the seven strongest ciphers:
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
SSLProtocol all
|
||||||
|
SSLCipherSuite HIGH:MEDIUM
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
<li><a name="ToC4"></a>
|
||||||
|
<a name="cipher-sgc"></a>
|
||||||
|
<strong id="howto">
|
||||||
|
How can I create an SSL server which accepts strong encryption only,
|
||||||
|
but allows export browsers to upgrade to stronger encryption?
|
||||||
|
</strong>
|
||||||
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#cipher-sgc"><b>L</b></a>]
|
||||||
|
<p>
|
||||||
|
This facility is called Server Gated Cryptography (SGC) and details you can
|
||||||
|
find in the <code>README.GlobalID</code> document in the mod_ssl distribution.
|
||||||
|
In short: The server has a Global ID server certificate, signed by a special
|
||||||
|
CA certificate from Verisign which enables strong encryption in export
|
||||||
|
browsers. This works as following: The browser connects with an export cipher,
|
||||||
|
the server sends it's Global ID certificate, the browser verifies it and
|
||||||
|
subsequently upgrades the cipher suite before any HTTP communication takes
|
||||||
|
place. The question now is: How can we allow this upgrade, but enforce strong
|
||||||
|
encryption. Or in other words: Browser either have to initially connect with
|
||||||
|
strong encryption or have to upgrade to strong encryption, but are not allowed
|
||||||
|
to keep the export ciphers. The following does the trick:
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
# allow all ciphers for the inital handshake,
|
||||||
|
# so export browsers can upgrade via SGC facility
|
||||||
|
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
|
||||||
|
<Directory /usr/local/apache/htdocs>
|
||||||
|
# but finally deny all browsers which haven't upgraded
|
||||||
|
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
<li><a name="ToC5"></a>
|
||||||
|
<a name="cipher-perdir"></a>
|
||||||
|
<strong id="howto">
|
||||||
|
How can I create an SSL server which accepts all types of ciphers in general,
|
||||||
|
but requires a strong ciphers for access to a particular URL?
|
||||||
|
</strong>
|
||||||
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#cipher-perdir"><b>L</b></a>]
|
||||||
|
<p>
|
||||||
|
Obviously you cannot just use a server-wide <code>SSLCipherSuite</code> which
|
||||||
|
restricts the ciphers to the strong variants. But mod_ssl allows you to
|
||||||
|
reconfigure the cipher suite in per-directory context and automatically forces
|
||||||
|
a renegotiation of the SSL parameters to meet the new configuration. So, the
|
||||||
|
solution is:
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
# be liberal in general
|
||||||
|
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
|
||||||
|
<Location /strong/area>
|
||||||
|
# but https://hostname/strong/area/ and below requires strong ciphers
|
||||||
|
SSLCipherSuite HIGH:MEDIUM
|
||||||
|
</Location>
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</ul>
|
||||||
|
<h2><a name="ToC6">Client Authentication and Access Control</a></h2>
|
||||||
|
<ul>
|
||||||
|
<p>
|
||||||
|
<li><a name="ToC7"></a>
|
||||||
|
<a name="auth-simple"></a>
|
||||||
|
<strong id="howto">
|
||||||
|
How can I authenticate clients based on certificates when I know all my
|
||||||
|
clients?
|
||||||
|
</strong>
|
||||||
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#auth-simple"><b>L</b></a>]
|
||||||
|
<p>
|
||||||
|
When you know your user community (i.e. a closed user group situation), as
|
||||||
|
it's the case for instance in an Intranet, you can use plain certificate
|
||||||
|
authentication. All you have to do is to create client certificates signed by
|
||||||
|
your own CA certificate <code>ca.crt</code> and then verifiy the clients
|
||||||
|
against this certificate.
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
# require a client certificate which has to be directly
|
||||||
|
# signed by our CA certificate in ca.crt
|
||||||
|
SSLVerifyClient require
|
||||||
|
SSLVerifyDepth 1
|
||||||
|
SSLCACertificateFile conf/ssl.crt/ca.crt
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
<li><a name="ToC8"></a>
|
||||||
|
<a name="auth-selective"></a>
|
||||||
|
<strong id="howto">
|
||||||
|
How can I authenticate my clients for a particular URL based on certificates
|
||||||
|
but still allow arbitrary clients to access the remaining parts of the server?
|
||||||
|
</strong>
|
||||||
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#auth-selective"><b>L</b></a>]
|
||||||
|
<p>
|
||||||
|
For this we again use the per-directory reconfiguration feature of mod_ssl:
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
SSLVerifyClient none
|
||||||
|
SSLCACertificateFile conf/ssl.crt/ca.crt
|
||||||
|
<Location /secure/area>
|
||||||
|
SSLVerifyClient require
|
||||||
|
SSLVerifyDepth 1
|
||||||
|
</Location>
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
<li><a name="ToC9"></a>
|
||||||
|
<a name="auth-particular"></a>
|
||||||
|
<strong id="howto">
|
||||||
|
How can I authenticate only particular clients for a some URLs based
|
||||||
|
on certificates but still allow arbitrary clients to access the remaining
|
||||||
|
parts of the server?
|
||||||
|
</strong>
|
||||||
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#auth-particular"><b>L</b></a>]
|
||||||
|
<p>
|
||||||
|
The key is to check for various ingredients of the client certficate. Usually
|
||||||
|
this means to check the whole or part of the Distinguished Name (DN) of the
|
||||||
|
Subject. For this two methods exists: The <code>mod_auth</code> based variant
|
||||||
|
and the <code>SSLRequire</code> variant. The first method is good when the
|
||||||
|
clients are of totally different type, i.e. when their DNs have no common
|
||||||
|
fields (usually the organisation, etc.). In this case you've to establish a
|
||||||
|
password database containing <em>all</em> clients. The second method is better
|
||||||
|
when your clients are all part of a common hierarchy which is encoded into the
|
||||||
|
DN. Then you can match them more easily.
|
||||||
|
<p>
|
||||||
|
The first method:
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">/usr/local/apache/conf/httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
SSLVerifyClient none
|
||||||
|
<Directory /usr/local/apache/htdocs/secure/area>
|
||||||
|
SSLVerifyClient require
|
||||||
|
SSLVerifyDepth 5
|
||||||
|
SSLCACertificateFile conf/ssl.crt/ca.crt
|
||||||
|
SSLCACertificatePath conf/ssl.crt
|
||||||
|
SSLOptions +FakeBasicAuth
|
||||||
|
SSLRequireSSL
|
||||||
|
AuthName "Snake Oil Authentication"
|
||||||
|
AuthType Basic
|
||||||
|
AuthUserFile /usr/local/apache/conf/httpd.passwd
|
||||||
|
require valid-user
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">/usr/local/apache/conf/httpd.passwd</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
/C=DE/L=Munich/O=Snake Oil, Ltd./OU=Staff/CN=Foo:xxj31ZMTZzkVA
|
||||||
|
/C=US/L=S.F./O=Snake Oil, Ltd./OU=CA/CN=Bar:xxj31ZMTZzkVA
|
||||||
|
/C=US/L=L.A./O=Snake Oil, Ltd./OU=Dev/CN=Quux:xxj31ZMTZzkVA
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
The second method:
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
SSLVerifyClient none
|
||||||
|
<Directory /usr/local/apache/htdocs/secure/area>
|
||||||
|
SSLVerifyClient require
|
||||||
|
SSLVerifyDepth 5
|
||||||
|
SSLCACertificateFile conf/ssl.crt/ca.crt
|
||||||
|
SSLCACertificatePath conf/ssl.crt
|
||||||
|
SSLOptions +FakeBasicAuth
|
||||||
|
SSLRequireSSL
|
||||||
|
SSLRequire %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." and \
|
||||||
|
%{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"}
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
<li><a name="ToC10"></a>
|
||||||
|
<a name="auth-intranet"></a>
|
||||||
|
<strong id="howto"> How can
|
||||||
|
I require HTTPS with strong ciphers and either basic authentication or client
|
||||||
|
certificates for access to a subarea on the Intranet website for clients
|
||||||
|
coming from the Internet but still allow plain HTTP access for clients on the
|
||||||
|
Intranet?
|
||||||
|
</strong>
|
||||||
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#auth-intranet"><b>L</b></a>]
|
||||||
|
<p>
|
||||||
|
Let us assume the Intranet can be distinguished through the IP network
|
||||||
|
192.160.1.0/24 and the subarea on the Intranet website has the URL
|
||||||
|
<tt>/subarea</tt>. Then configure the following outside your HTTPS virtual
|
||||||
|
host (so it applies to both HTTPS and HTTP):
|
||||||
|
<p>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="8" align="bottom" border="0"></td>
|
||||||
|
<td rowspan="3"> <font face="Arial,Helvetica" color="#999999">httpd.conf</font> </td>
|
||||||
|
<td colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc" colspan="2"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="40" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#ffffff"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="300" height="1" align="bottom" border="0"></td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="5" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
<td colspan="3" bgcolor="#ffffff">
|
||||||
|
<table border="0" cellspacing="4" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<pre>
|
||||||
|
|
||||||
|
SSLCACertificateFile conf/ssl.crt/company-ca.crt
|
||||||
|
|
||||||
|
<Directory /usr/local/apache/htdocs>
|
||||||
|
# Outside the subarea only Intranet access is granted
|
||||||
|
Order deny,allow
|
||||||
|
Deny from all
|
||||||
|
Allow from 192.168.1.0/24
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
<Directory /usr/local/apache/htdocs/subarea>
|
||||||
|
# Inside the subarea any Intranet access is allowed
|
||||||
|
# but from the Internet only HTTPS + Strong-Cipher + Password
|
||||||
|
# or the alternative HTTPS + Strong-Cipher + Client-Certificate
|
||||||
|
|
||||||
|
# If HTTPS is used, make sure a strong cipher is used.
|
||||||
|
# Additionally allow client certs as alternative to basic auth.
|
||||||
|
SSLVerifyClient optional
|
||||||
|
SSLVerifyDepth 1
|
||||||
|
SSLOptions +FakeBasicAuth +StrictRequire
|
||||||
|
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
|
||||||
|
|
||||||
|
# Force clients from the Internet to use HTTPS
|
||||||
|
RewriteEngine on
|
||||||
|
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$
|
||||||
|
RewriteCond %{HTTPS} !=on
|
||||||
|
RewriteRule .* - [F]
|
||||||
|
|
||||||
|
# Allow Network Access and/or Basic Auth
|
||||||
|
Satisfy any
|
||||||
|
|
||||||
|
# Network Access Control
|
||||||
|
Order deny,allow
|
||||||
|
Deny from all
|
||||||
|
Allow 192.168.1.0/24
|
||||||
|
|
||||||
|
# HTTP Basic Authentication
|
||||||
|
AuthType basic
|
||||||
|
AuthName "Protected Intranet Area"
|
||||||
|
AuthUserFile conf/protected.passwd
|
||||||
|
Require valid-user
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
<td bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td colspan="5" bgcolor="#cccccc"><img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="1" height="1" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</ul>
|
||||||
|
<p>
|
||||||
|
<br>
|
||||||
|
<table summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="ssl_compat.html" onmouseover="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_bot'); return true" onfocus="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_bot'); return true"><img name="ro_img_prev_bot" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Compatibility</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
<a href="ssl_faq.html" onmouseover="ro_imgOver('ro_img_next_bot', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_bot'); return true" onfocus="ro_imgOver('ro_img_next_bot', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_bot'); return true"><img name="ro_img_next_bot" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">F.A.Q. List</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><table width="598" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left"><font face="Arial,Helvetica">
|
||||||
|
<a href="http://www.modssl.org/">mod_ssl</a> 2.8, User Manual<br>
|
||||||
|
The Apache Interface to OpenSSL
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
<td align="right"><font face="Arial,Helvetica">
|
||||||
|
Copyright © 1998-2001
|
||||||
|
<a href="http://www.engelschall.com/">Ralf S. Engelschall</a><br>
|
||||||
|
All Rights Reserved<br>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
919
docs/manual/ssl/ssl_intro.html
Normal file
919
docs/manual/ssl/ssl_intro.html
Normal file
@ -0,0 +1,919 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>mod_ssl: Introduction</title>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions
|
||||||
|
are met:
|
||||||
|
|
||||||
|
1. Redistributions of source code must retain the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer.
|
||||||
|
|
||||||
|
2. Redistributions in binary form must reproduce the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer in the documentation and/or other materials
|
||||||
|
provided with the distribution.
|
||||||
|
|
||||||
|
3. All advertising materials mentioning features or use of this
|
||||||
|
software must display the following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
4. The name "mod_ssl" must not be used to endorse or promote
|
||||||
|
products derived from this software without prior written
|
||||||
|
permission.
|
||||||
|
|
||||||
|
5. Redistributions of any form whatsoever must retain the
|
||||||
|
following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY
|
||||||
|
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S. ENGELSCHALL OR
|
||||||
|
HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||||
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||||
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||||
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||||
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||||
|
OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
-->
|
||||||
|
<style type="text/css"><!--
|
||||||
|
A:link {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:active {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:visited {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
#sf {
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H1 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 24pt;
|
||||||
|
line-height: 24pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H2 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 18pt;
|
||||||
|
line-height: 18pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H3 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 14pt;
|
||||||
|
line-height: 14pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H4 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 12pt;
|
||||||
|
line-height: 12pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#H {
|
||||||
|
}
|
||||||
|
#D {
|
||||||
|
background-color: #f0f0f0;
|
||||||
|
}
|
||||||
|
#faq {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#howto {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#term {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
--></style>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
function ro_imgNormal(imgName) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_n.src');
|
||||||
|
self.status = '';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function ro_imgOver(imgName, descript) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_o.src');
|
||||||
|
self.status = descript;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_top_n = new Image();
|
||||||
|
ro_img_prev_top_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_top_o = new Image();
|
||||||
|
ro_img_prev_top_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_bot_n = new Image();
|
||||||
|
ro_img_prev_bot_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_bot_o = new Image();
|
||||||
|
ro_img_prev_bot_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_next_top_n = new Image();
|
||||||
|
ro_img_next_top_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_next_top_o = new Image();
|
||||||
|
ro_img_next_top_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_next_bot_n = new Image();
|
||||||
|
ro_img_next_bot_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_next_bot_o = new Image();
|
||||||
|
ro_img_next_bot_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body bgcolor="#ffffff" text="#000000" link="#333399" alink="#9999ff" vlink="#000066">
|
||||||
|
<div align="center">
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="600" height="1" align="bottom" border="0"><br>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left" valign="bottom">
|
||||||
|
<font face="Arial,Helvetica" size="+2"><b>mod_ssl</b></font>
|
||||||
|
</td>
|
||||||
|
<td align="right">
|
||||||
|
<img src="ssl_template.head-chapter.gif" alt="Chapter" width="175" height="94"> <img src="ssl_template.head-num-2.gif" alt="2" width="74" height="89">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="ssl_overview.html" onmouseover="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_top'); return true" onfocus="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_top'); return true"><img name="ro_img_prev_top" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Overview</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
<a href="ssl_reference.html" onmouseover="ro_imgOver('ro_img_next_top', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_top'); return true" onfocus="ro_imgOver('ro_img_next_top', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_top'); return true"><img name="ro_img_next_top" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">Reference</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<br>
|
||||||
|
<img src="ssl_template.title-intro.gif" alt="Introduction" width="456" height="60">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="0" width="400" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<em>
|
||||||
|
``The nice thing about standards is that there are so many to choose from.
|
||||||
|
And if you really don't like all the standards you just have to wait another
|
||||||
|
year until the one arises you are looking for.''
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<font size="-1">
|
||||||
|
A. Tanenbaum, ``Introduction to Computer Networks''
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
<table cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr valign="bottom">
|
||||||
|
<td>
|
||||||
|
<img src="ssl_intro.gfont000.gif" alt="A" width="37" height="35" border="0" align="left">
|
||||||
|
s an introduction this chapter is aimed at readers who are familiar
|
||||||
|
with the Web, HTTP, and Apache, but are not security experts. It is not
|
||||||
|
intended to be a definitive guide to the SSL protocol, nor does it discuss
|
||||||
|
specific techniques for managing certificates in an organization, or the
|
||||||
|
important legal issues of patents and import and export restrictions. Rather,
|
||||||
|
it is intended to provide a common background to mod_ssl users by pulling
|
||||||
|
together various concepts, definitions, and examples as a starting point for
|
||||||
|
further exploration.
|
||||||
|
<p>
|
||||||
|
The presented content is mainly derived, with permission by the author, from
|
||||||
|
the article <a
|
||||||
|
href="http://www.ultranet.com/~fhirsch/Papers/wwwj/index.html"><em>Introducing SSL
|
||||||
|
and Certificates using SSLeay</em></a> from <a
|
||||||
|
href="http://www.ultranet.com/~fhirsch/">Frederick J. Hirsch</a>, of The Open
|
||||||
|
Group Research Institute, which was published in <a
|
||||||
|
href="http://www.ora.com/catalog/wjsum97/"><em>Web Security: A Matter of
|
||||||
|
Trust</em></a>, World Wide Web Journal, Volume 2, Issue 3, Summer 1997.
|
||||||
|
Please send any postive feedback to <a
|
||||||
|
href="mailto:fjh@alum.mit.edu">Frederick Hirsch</a> (the original
|
||||||
|
article author) and all negative feedback to <a
|
||||||
|
href="mailto:rse@engelschall.com">Ralf S. Engelschall</a> (the mod_ssl
|
||||||
|
author).
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="5" border="0" bgcolor="#ccccff" summary="">
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#333399">
|
||||||
|
<font face="Arial,Helvetica" color="#ccccff">
|
||||||
|
<b>Table Of Contents</b>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<font face="Arial,Helvetica" size="-1">
|
||||||
|
<a href="#ToC1"><strong>Cryptographic Techniques</strong></a><br>
|
||||||
|
<a href="#ToC2"><strong>Cryptographic Algorithms</strong></a><br>
|
||||||
|
<a href="#ToC3"><strong>Message Digests</strong></a><br>
|
||||||
|
<a href="#ToC4"><strong>Digital Signatures</strong></a><br>
|
||||||
|
<a href="#ToC5"><strong>Certificates</strong></a><br>
|
||||||
|
<a href="#ToC6"><strong>Certificate Contents</strong></a><br>
|
||||||
|
<a href="#ToC7"><strong>Certificate Authorities</strong></a><br>
|
||||||
|
<a href="#ToC8"><strong>Certificate Chains</strong></a><br>
|
||||||
|
<a href="#ToC9"><strong>Creating a Root-Level CA</strong></a><br>
|
||||||
|
<a href="#ToC10"><strong>Certificate Management</strong></a><br>
|
||||||
|
<a href="#ToC11"><strong>Secure Sockets Layer (SSL)</strong></a><br>
|
||||||
|
<a href="#ToC12"><strong>Session Establishment</strong></a><br>
|
||||||
|
<a href="#ToC13"><strong>Key Exchange Method</strong></a><br>
|
||||||
|
<a href="#ToC14"><strong>Cipher for Data Transfer</strong></a><br>
|
||||||
|
<a href="#ToC15"><strong>Digest Function</strong></a><br>
|
||||||
|
<a href="#ToC16"><strong>Handshake Sequence Protocol</strong></a><br>
|
||||||
|
<a href="#ToC17"><strong>Data Transfer</strong></a><br>
|
||||||
|
<a href="#ToC18"><strong>Securing HTTP Communication</strong></a><br>
|
||||||
|
<a href="#ToC19"><strong>References</strong></a><br>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<h2><a name="ToC1">Cryptographic Techniques</a></h2>
|
||||||
|
Understanding SSL requires an understanding of cryptographic algorithms,
|
||||||
|
message digest functions (aka. one-way or hash functions), and digital
|
||||||
|
signatures. These techniques are the subject of entire books (see for instance
|
||||||
|
[<a href="#AC96">AC96</a>]) and provide the basis for privacy, integrity, and
|
||||||
|
authentication.
|
||||||
|
<h3><a name="ToC2">Cryptographic Algorithms</a></h3>
|
||||||
|
Suppose Alice wants to send a message to her bank to transfer some money.
|
||||||
|
Alice would like the message to be private, since it will include information
|
||||||
|
such as her account number and transfer amount. One solution is to use a
|
||||||
|
cryptographic algorithm, a technique that would transform her message into an
|
||||||
|
encrypted form, unreadable except by those it is intended for. Once in this
|
||||||
|
form, the message may only be interpreted through the use of a secret key.
|
||||||
|
Without the key the message is useless: good cryptographic algorithms make it
|
||||||
|
so difficult for intruders to decode the original text that it isn't worth
|
||||||
|
their effort.
|
||||||
|
<p>
|
||||||
|
There are two categories of cryptographic algorithms:
|
||||||
|
conventional and public key.
|
||||||
|
<ul>
|
||||||
|
<li><em>Conventional cryptography</em>, also known as symmetric
|
||||||
|
cryptography, requires the sender and receiver to share a key: a secret
|
||||||
|
piece of information that may be used to encrypt or decrypt a message.
|
||||||
|
If this key is secret, then nobody other than the sender or receiver may
|
||||||
|
read the message. If Alice and the bank know a secret key, then they
|
||||||
|
may send each other private messages. The task of privately choosing a key
|
||||||
|
before communicating, however, can be problematic.
|
||||||
|
<p>
|
||||||
|
<li><em>Public key cryptography</em>, also known as asymmetric cryptography,
|
||||||
|
solves the key exchange problem by defining an algorithm which uses two keys,
|
||||||
|
each of which may be used to encrypt a message. If one key is used to encrypt
|
||||||
|
a message then the other must be used to decrypt it. This makes it possible
|
||||||
|
to receive secure messages by simply publishing one key (the public key) and
|
||||||
|
keeping the other secret (the private key).
|
||||||
|
<p>
|
||||||
|
Anyone may encrypt a message using the public key, but only the owner of the
|
||||||
|
private key will be able to read it. In this way, Alice may send private
|
||||||
|
messages to the owner of a key-pair (the bank), by encrypting it using their
|
||||||
|
public key. Only the bank will be able to decrypt it.
|
||||||
|
</ul>
|
||||||
|
<h3><a name="ToC3">Message Digests</a></h3>
|
||||||
|
Although Alice may encrypt her message to make it private, there is still a
|
||||||
|
concern that someone might modify her original message or substitute
|
||||||
|
it with a different one, in order to transfer the money to themselves, for
|
||||||
|
instance. One way of guaranteeing the integrity of Alice's message is to
|
||||||
|
create a concise summary of her message and send this to the bank as well.
|
||||||
|
Upon receipt of the message, the bank creates its own summary and compares it
|
||||||
|
with the one Alice sent. If they agree then the message was received intact.
|
||||||
|
<p>
|
||||||
|
A summary such as this is called a <em>message digest</em>, <em>one-way
|
||||||
|
function</em> or <em>hash function</em>. Message digests are used to create
|
||||||
|
short, fixed-length representations of longer, variable-length messages.
|
||||||
|
Digest algorithms are designed to produce unique digests for different
|
||||||
|
messages. Message digests are designed to make it too difficult to determine
|
||||||
|
the message from the digest, and also impossible to find two different
|
||||||
|
messages which create the same digest -- thus eliminating the possibility of
|
||||||
|
substituting one message for another while maintaining the same digest.
|
||||||
|
<p>
|
||||||
|
Another challenge that Alice faces is finding a way to send the digest to the
|
||||||
|
bank securely; when this is achieved, the integrity of the associated message
|
||||||
|
is assured. One way to to this is to include the digest in a digital
|
||||||
|
signature.
|
||||||
|
<h3><a name="ToC4">Digital Signatures</a></h3>
|
||||||
|
When Alice sends a message to the bank, the bank needs to ensure that the
|
||||||
|
message is really from her, so an intruder does not request a transaction
|
||||||
|
involving her account. A <em>digital signature</em>, created by Alice and
|
||||||
|
included with the message, serves this purpose.
|
||||||
|
<p>
|
||||||
|
Digital signatures are created by encrypting a digest of the message,
|
||||||
|
and other information (such as a sequence number) with the sender's
|
||||||
|
private key. Though anyone may <em>decrypt</em> the signature using the public
|
||||||
|
key, only the signer knows the private key. This means that only they may
|
||||||
|
have signed it. Including the digest in the signature means the signature is
|
||||||
|
only good for that message; it also ensures the integrity of the message since
|
||||||
|
no one can change the digest and still sign it.
|
||||||
|
<p>
|
||||||
|
To guard against interception and reuse of the signature by an intruder at a
|
||||||
|
later date, the signature contains a unique sequence number. This protects
|
||||||
|
the bank from a fraudulent claim from Alice that she did not send the message
|
||||||
|
-- only she could have signed it (non-repudiation).
|
||||||
|
<h2><a name="ToC5">Certificates</a></h2>
|
||||||
|
Although Alice could have sent a private message to the bank, signed it, and
|
||||||
|
ensured the integrity of the message, she still needs to be sure that she is
|
||||||
|
really communicating with the bank. This means that she needs to be sure that
|
||||||
|
the public key she is using corresponds to the bank's private key. Similarly,
|
||||||
|
the bank also needs to verify that the message signature really corresponds to
|
||||||
|
Alice's signature.
|
||||||
|
<p>
|
||||||
|
If each party has a certificate which validates the other's identity, confirms
|
||||||
|
the public key, and is signed by a trusted agency, then they both will be
|
||||||
|
assured that they are communicating with whom they think they are. Such a
|
||||||
|
trusted agency is called a <em>Certificate Authority</em>, and certificates are
|
||||||
|
used for authentication.
|
||||||
|
<h3><a name="ToC6">Certificate Contents</a></h3>
|
||||||
|
A certificate associates a public key with the real identity of an individual,
|
||||||
|
server, or other entity, known as the subject. As shown in <a
|
||||||
|
href="#table1">Table 1</a>, information about the subject includes identifying
|
||||||
|
information (the distinguished name), and the public key. It also includes
|
||||||
|
the identification and signature of the Certificate Authority that issued the
|
||||||
|
certificate, and the period of time during which the certificate is valid. It
|
||||||
|
may have additional information (or extensions) as well as administrative
|
||||||
|
information for the Certificate Authority's use, such as a serial number.
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="table1"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Table 1: Certificate Information</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<table summary="">
|
||||||
|
<tr valign="top"><td><b>Subject:</b></td>
|
||||||
|
<td>Distinguished Name, Public Key</td></tr>
|
||||||
|
<tr valign="top"><td><b>Issuer:</b></td>
|
||||||
|
<td>Distinguished Name, Signature</td></tr>
|
||||||
|
<tr><td><b>Period of Validity:</b></td>
|
||||||
|
<td>Not Before Date, Not After Date</td></tr>
|
||||||
|
<tr><td><b>Administrative Information:</b></td>
|
||||||
|
<td>Version, Serial Number</td></TR>
|
||||||
|
<tr><td><b>Extended Information:</b></td>
|
||||||
|
<td>Basic Contraints, Netscape Flags, etc.</td></TR>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
A distinguished name is used to provide an identity in a specific context --
|
||||||
|
for instance, an individual might have a personal certificate as well as one
|
||||||
|
for their identity as an employee. Distinguished names are defined by the
|
||||||
|
X.509 standard [<a href="#X509">X509</A>], which defines the fields, field
|
||||||
|
names, and abbreviations used to refer to the fields
|
||||||
|
(see <a href="#table2">Table 2</a>).
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="table2"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Table 2: Distinguished Name Information</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<table summary="">
|
||||||
|
<tr valign="top"><td><b>DN Field:</b></td><td><b>Abbrev.:</b></td><td><b>Description:</b></td>
|
||||||
|
<td><b>Example:</b></td>
|
||||||
|
</t>
|
||||||
|
<tr valign="top"><td>Common Name</td><td>CN</td>
|
||||||
|
<td>Name being certified</td><td>CN=Joe Average</td></tr>
|
||||||
|
<tr valign="top"><td>Organization or Company</td><td>O</td>
|
||||||
|
<td>Name is associated with this<br>organization</td><td>O=Snake Oil, Ltd.</td></tr>
|
||||||
|
<tr valign="top"><td>Organizational Unit</td><td>OU</td>
|
||||||
|
<td>Name is associated with this <br>organization unit, such as a department</td><td>OU=Research Institute</td></tr>
|
||||||
|
<tr valign="top"><td>City/Locality</td><td>L</td>
|
||||||
|
<td>Name is located in this City</td><td>L=Snake City</td></tr>
|
||||||
|
<tr valign="top"><td>State/Province</td><td>ST</td>
|
||||||
|
<td>Name is located in this State/Province</td><td>ST=Desert</td></tr>
|
||||||
|
<tr valign="top"><td>Country</td><td>C</td>
|
||||||
|
<td>Name is located in this Country (ISO code)</td><td>C=XZ</td></tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
A Certificate Authority may define a policy specifying which distinguished
|
||||||
|
field names are optional, and which are required. It may also place
|
||||||
|
requirements upon the field contents, as may users of certificates. As an
|
||||||
|
example, a Netscape browser requires that the Common Name for a certificate
|
||||||
|
representing a server has a name which matches a wildcard pattern for the
|
||||||
|
domain name of that server, such as <code>*.snakeoil.com</code>.
|
||||||
|
<p>
|
||||||
|
The binary format of a certificate is defined using the ASN.1 notation [ <a
|
||||||
|
href="#X208">X208</a>] [<a href="#PKCS">PKCS</a>]. This notation defines how to
|
||||||
|
specify the contents, and encoding rules define how this information is
|
||||||
|
translated into binary form. The binary encoding of the certificate is
|
||||||
|
defined using Distinguished Encoding Rules (DER), which are based on the more
|
||||||
|
general Basic Encoding Rules (BER). For those transmissions which cannot
|
||||||
|
handle binary, the binary form may be translated into an ASCII form by using
|
||||||
|
Base64 encoding [<a href="#MIME">MIME</a>]. This encoded version is called PEM
|
||||||
|
encoded (the name comes from "Privacy Enhanced Mail"), when placed between
|
||||||
|
begin and end delimiter lines as illustrated in <a href="#table3">Table 3</a>.
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="table3"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Table 3: Example of a PEM-encoded certificate (snakeoil.crt)</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<table cellspacing="0" cellpadding="0" summary=""><tr><td>
|
||||||
|
<div class="code"><pre>
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIC7jCCAlegAwIBAgIBATANBgkqhkiG9w0BAQQFADCBqTELMAkGA1UEBhMCWFkx
|
||||||
|
FTATBgNVBAgTDFNuYWtlIERlc2VydDETMBEGA1UEBxMKU25ha2UgVG93bjEXMBUG
|
||||||
|
A1UEChMOU25ha2UgT2lsLCBMdGQxHjAcBgNVBAsTFUNlcnRpZmljYXRlIEF1dGhv
|
||||||
|
cml0eTEVMBMGA1UEAxMMU25ha2UgT2lsIENBMR4wHAYJKoZIhvcNAQkBFg9jYUBz
|
||||||
|
bmFrZW9pbC5kb20wHhcNOTgxMDIxMDg1ODM2WhcNOTkxMDIxMDg1ODM2WjCBpzEL
|
||||||
|
MAkGA1UEBhMCWFkxFTATBgNVBAgTDFNuYWtlIERlc2VydDETMBEGA1UEBxMKU25h
|
||||||
|
a2UgVG93bjEXMBUGA1UEChMOU25ha2UgT2lsLCBMdGQxFzAVBgNVBAsTDldlYnNl
|
||||||
|
cnZlciBUZWFtMRkwFwYDVQQDExB3d3cuc25ha2VvaWwuZG9tMR8wHQYJKoZIhvcN
|
||||||
|
AQkBFhB3d3dAc25ha2VvaWwuZG9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
|
||||||
|
gQDH9Ge/s2zcH+da+rPTx/DPRp3xGjHZ4GG6pCmvADIEtBtKBFAcZ64n+Dy7Np8b
|
||||||
|
vKR+yy5DGQiijsH1D/j8HlGE+q4TZ8OFk7BNBFazHxFbYI4OKMiCxdKzdif1yfaa
|
||||||
|
lWoANFlAzlSdbxeGVHoT0K+gT5w3UxwZKv2DLbCTzLZyPwIDAQABoyYwJDAPBgNV
|
||||||
|
HRMECDAGAQH/AgEAMBEGCWCGSAGG+EIBAQQEAwIAQDANBgkqhkiG9w0BAQQFAAOB
|
||||||
|
gQAZUIHAL4D09oE6Lv2k56Gp38OBDuILvwLg1v1KL8mQR+KFjghCrtpqaztZqcDt
|
||||||
|
2q2QoyulCgSzHbEGmi0EsdkPfg6mp0penssIFePYNI+/8u9HT4LuKMJX15hxBam7
|
||||||
|
dUHzICxBVC1lnHyYGjDuAMhe396lYAn8bCld1/L4NMGBCQ==
|
||||||
|
-----END CERTIFICATE-----</pre></div>
|
||||||
|
</td></tr></table>
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<h3><a name="ToC7">Certificate Authorities</a></h3>
|
||||||
|
By first verifying the information in a certificate request before granting
|
||||||
|
the certificate, the Certificate Authority assures the identity of the private
|
||||||
|
key owner of a key-pair. For instance, if Alice requests a personal
|
||||||
|
certificate, the Certificate Authority must first make sure that Alice really
|
||||||
|
is the person the certificate request claims.
|
||||||
|
<h4><a name="ToC8">Certificate Chains</a></h4>
|
||||||
|
A Certificate Authority may also issue a certificate for another Certificate
|
||||||
|
Authority. When examining a certificate, Alice may need to examine the
|
||||||
|
certificate of the issuer, for each parent Certificate Authority, until
|
||||||
|
reaching one which she has confidence in. She may decide to trust only
|
||||||
|
certificates with a limited chain of issuers, to reduce her risk of a "bad"
|
||||||
|
certificate in the chain.
|
||||||
|
<h4><a name="ToC9">Creating a Root-Level CA</a></h4>
|
||||||
|
As noted earlier, each certificate requires an issuer to assert the validity
|
||||||
|
of the identity of the certificate subject, up to the top-level Certificate
|
||||||
|
Authority (CA). This presents a problem: Since this is who vouches for the
|
||||||
|
certificate of the top-level authority, which has no issuer?
|
||||||
|
In this unique case, the certificate is "self-signed", so the issuer of the
|
||||||
|
certificate is the same as the subject. As a result, one must exercise extra
|
||||||
|
care in trusting a self-signed certificate. The wide publication of a public
|
||||||
|
key by the root authority reduces the risk in trusting this key -- it would be
|
||||||
|
obvious if someone else publicized a key claiming to be the authority.
|
||||||
|
Browsers are preconfigured to trust well-known certificate authorities.
|
||||||
|
<p>
|
||||||
|
A number of companies, such as <a href="http://www.thawte.com/">Thawte</a> and
|
||||||
|
<a href="http://www.verisign.com/">VeriSign</a> have established themselves as
|
||||||
|
Certificate Authorities. These companies provide the following services:
|
||||||
|
<ul>
|
||||||
|
<li>Verifying certificate requests
|
||||||
|
<li>Processing certificate requests
|
||||||
|
<li>Issuing and managing certificates
|
||||||
|
</ul>
|
||||||
|
<p>
|
||||||
|
It is also possible to create your own Certificate Authority. Although risky
|
||||||
|
in the Internet environment, it may be useful within an Intranet where the
|
||||||
|
organization can easily verify the identities of individuals and servers.
|
||||||
|
<h4><a name="ToC10">Certificate Management</a></h4>
|
||||||
|
Establishing a Certificate Authority is a responsibility which requires a
|
||||||
|
solid administrative, technical, and management framework.
|
||||||
|
Certificate Authorities not only issue certificates, they also manage them --
|
||||||
|
that is, they determine how long certificates are valid, they renew them, and
|
||||||
|
they keep lists of certificates that have already been issued but are no
|
||||||
|
longer valid (Certificate Revocation Lists, or CRLs).
|
||||||
|
Say Alice is entitled to a certificate as an employee of a company. Say too,
|
||||||
|
that the certificate needs to be revoked when Alice leaves the company. Since
|
||||||
|
certificates are objects that get passed around, it is impossible to tell from
|
||||||
|
the certificate alone that it has been revoked.
|
||||||
|
When examining certificates for validity, therefore, it is necessary to
|
||||||
|
contact the issuing Certificate Authority to check CRLs -- this is not usually
|
||||||
|
an automated part of the process.
|
||||||
|
<p>
|
||||||
|
<div align="center"><B>Note:</B></div>
|
||||||
|
If you use a Certificate Authority that is not configured into browsers by
|
||||||
|
default, it is necessary to load the Certificate Authority certificate into
|
||||||
|
the browser, enabling the browser to validate server certificates signed by
|
||||||
|
that Certificate Authority. Doing so may be dangerous, since once loaded, the
|
||||||
|
browser will accept all certificates signed by that Certificate Authority.
|
||||||
|
<h2><a name="ToC11">Secure Sockets Layer (SSL)</a></h2>
|
||||||
|
The Secure Sockets Layer protocol is a protocol layer which may be placed
|
||||||
|
between a reliable connection-oriented network layer protocol (e.g. TCP/IP)
|
||||||
|
and the application protocol layer (e.g. HTTP). SSL provides for secure
|
||||||
|
communication between client and server by allowing mutual authentication, the
|
||||||
|
use of digital signatures for integrity, and encryption for privacy.
|
||||||
|
<p>
|
||||||
|
The protocol is designed to support a range of choices for specific algorithms
|
||||||
|
used for cryptography, digests, and signatures. This allows algorithm
|
||||||
|
selection for specific servers to be made based on legal, export or other
|
||||||
|
concerns, and also enables the protocol to take advantage of new algorithms.
|
||||||
|
Choices are negotiated between client and server at the start of establishing
|
||||||
|
a protocol session.
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="table4"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Table 4: Versions of the SSL protocol</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<table summary="">
|
||||||
|
<tr valign="top">
|
||||||
|
<td><b>Version:</b></td>
|
||||||
|
<td><b>Source:</b></td>
|
||||||
|
<td><b>Description:</b></td>
|
||||||
|
<td><b>Browser Support:</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr valign="top">
|
||||||
|
<td>SSL v2.0</td>
|
||||||
|
<td>Vendor Standard (from Netscape Corp.) [<a href="#SSL2">SSL2</a>]</td>
|
||||||
|
<td>First SSL protocol for which implementations exists</td>
|
||||||
|
<td>- NS Navigator 1.x/2.x<br>
|
||||||
|
- MS IE 3.x<br>
|
||||||
|
- Lynx/2.8+OpenSSL
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr valign="top">
|
||||||
|
<td>SSL v3.0</td>
|
||||||
|
<td>Expired Internet Draft (from Netscape Corp.) [<a href="#SSL3">SSL3</a>]</td>
|
||||||
|
<td>Revisions to prevent specific security attacks, add non-RSA ciphers, and support for certificate chains</td>
|
||||||
|
<td>- NS Navigator 2.x/3.x/4.x<br>
|
||||||
|
- MS IE 3.x/4.x<br>
|
||||||
|
- Lynx/2.8+OpenSSL
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr valign="top">
|
||||||
|
<td>TLS v1.0</td>
|
||||||
|
<td>Proposed Internet Standard (from IETF) [<a href="#TLS1">TLS1</a>]</td>
|
||||||
|
<td>Revision of SSL 3.0 to update the MAC layer to HMAC, add block padding for
|
||||||
|
block ciphers, message order standardization and more alert messages.
|
||||||
|
</td>
|
||||||
|
<td>- Lynx/2.8+OpenSSL</td>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
There are a number of versions of the SSL protocol, as shown in <a
|
||||||
|
href="#table4">Table 4</a>. As noted there, one of the benefits in SSL 3.0 is
|
||||||
|
that it adds support of certificate chain loading. This feature allows a
|
||||||
|
server to pass a server certificate along with issuer certificates to the
|
||||||
|
browser. Chain loading also permits the browser to validate the server
|
||||||
|
certificate, even if Certificate Authority certificates are not installed for
|
||||||
|
the intermediate issuers, since they are included in the certificate chain.
|
||||||
|
SSL 3.0 is the basis for the Transport Layer Security [<A
|
||||||
|
HREF="#TLS1">TLS</A>] protocol standard, currently in development by the
|
||||||
|
Internet Engineering Task Force (IETF).
|
||||||
|
<h3><a name="ToC12">Session Establishment</a></h3>
|
||||||
|
The SSL session is established by following a <I>handshake sequence</I>
|
||||||
|
between client and server, as shown in <a href="#figure1">Figure 1</a>. This
|
||||||
|
sequence may vary, depending on whether the server is configured to provide a
|
||||||
|
server certificate or request a client certificate. Though cases exist where
|
||||||
|
additional handshake steps are required for management of cipher information,
|
||||||
|
this article summarizes one common scenario: see the SSL specification for the
|
||||||
|
full range of possibilities.
|
||||||
|
<p>
|
||||||
|
<div align="center"><b>Note</b></div>
|
||||||
|
Once an SSL session has been established it may be reused, thus avoiding the
|
||||||
|
performance penalty of repeating the many steps needed to start a session.
|
||||||
|
For this the server assigns each SSL session a unique session identifier which
|
||||||
|
is cached in the server and which the client can use on forthcoming
|
||||||
|
connections to reduce the handshake (until the session identifer expires in
|
||||||
|
the cache of the server).
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="figure1"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Figure 1: Simplified SSL Handshake Sequence</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<img src="ssl_intro_fig1.gif" alt="" width="423" height="327">
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
The elements of the handshake sequence, as used by the client and server, are
|
||||||
|
listed below:
|
||||||
|
<ol>
|
||||||
|
<li>Negotiate the Cipher Suite to be used during data transfer
|
||||||
|
<li>Establish and share a session key between client and server
|
||||||
|
<li>Optionally authenticate the server to the client
|
||||||
|
<li>Optionally authenticate the client to the server
|
||||||
|
</ol>
|
||||||
|
<p>
|
||||||
|
The first step, Cipher Suite Negotiation, allows the client and server to
|
||||||
|
choose a Cipher Suite supportable by both of them. The SSL3.0 protocol
|
||||||
|
specification defines 31 Cipher Suites. A Cipher Suite is defined by the
|
||||||
|
following components:
|
||||||
|
<ul>
|
||||||
|
<li>Key Exchange Method
|
||||||
|
<li>Cipher for Data Transfer
|
||||||
|
<li>Message Digest for creating the Message Authentication Code (MAC)
|
||||||
|
</ul>
|
||||||
|
These three elements are described in the sections that follow.
|
||||||
|
<h3><a name="ToC13">Key Exchange Method</a></h3>
|
||||||
|
The key exchange method defines how the shared secret symmetric cryptography
|
||||||
|
key used for application data transfer will be agreed upon by client and
|
||||||
|
server. SSL 2.0 uses RSA key exchange only, while SSL 3.0 supports a choice of
|
||||||
|
key exchange algorithms including the RSA key exchange when certificates are
|
||||||
|
used, and Diffie-Hellman key exchange for exchanging keys without certificates
|
||||||
|
and without prior communication between client and server.
|
||||||
|
<p>
|
||||||
|
One variable in the choice of key exchange methods is digital signatures --
|
||||||
|
whether or not to use them, and if so, what kind of signatures to use.
|
||||||
|
Signing with a private key provides assurance against a
|
||||||
|
man-in-the-middle-attack during the information exchange used in generating
|
||||||
|
the shared key [<a href="#AC96">AC96</a>, p516].
|
||||||
|
<h3><a name="ToC14">Cipher for Data Transfer</a></h3>
|
||||||
|
SSL uses the conventional cryptography algorithm (symmetric cryptography)
|
||||||
|
described earlier for encrypting messages in a session. There are nine
|
||||||
|
choices, including the choice to perform no encryption:
|
||||||
|
<ul>
|
||||||
|
<li>No encryption
|
||||||
|
<li>Stream Ciphers
|
||||||
|
<ul>
|
||||||
|
<li>RC4 with 40-bit keys
|
||||||
|
<li>RC4 with 128-bit keys
|
||||||
|
</ul>
|
||||||
|
<li>CBC Block Ciphers
|
||||||
|
<ul>
|
||||||
|
<li>RC2 with 40 bit key
|
||||||
|
<li>DES with 40 bit key
|
||||||
|
<li>DES with 56 bit key
|
||||||
|
<li>Triple-DES with 168 bit key
|
||||||
|
<li>Idea (128 bit key)
|
||||||
|
<li>Fortezza (96 bit key)
|
||||||
|
</ul>
|
||||||
|
</ul>
|
||||||
|
Here "CBC" refers to Cipher Block Chaining, which means that a portion of the
|
||||||
|
previously encrypted cipher text is used in the encryption of the current
|
||||||
|
block. "DES" refers to the Data Encryption Standard [<a href="#AC96">AC96</a>,
|
||||||
|
ch12], which has a number of variants (including DES40 and 3DES_EDE). "Idea"
|
||||||
|
is one of the best and cryptographically strongest available algorithms, and
|
||||||
|
"RC2" is a proprietary algorithm from RSA DSI [<a href="#AC96">AC96</a>,
|
||||||
|
ch13].
|
||||||
|
<h3><a name="ToC15">Digest Function</a></h3>
|
||||||
|
The choice of digest function determines how a digest is created from a record
|
||||||
|
unit. SSL supports the following:
|
||||||
|
<ul>
|
||||||
|
<li>No digest (Null choice)
|
||||||
|
<li>MD5, a 128-bit hash
|
||||||
|
<li>Secure Hash Algorithm (SHA-1), a 160-bit hash
|
||||||
|
</ul>
|
||||||
|
The message digest is used to create a Message Authentication Code (MAC) which
|
||||||
|
is encrypted with the message to provide integrity and to prevent against
|
||||||
|
replay attacks.
|
||||||
|
<h3><a name="ToC16">Handshake Sequence Protocol</a></h3>
|
||||||
|
The handshake sequence uses three protocols:
|
||||||
|
<ul>
|
||||||
|
<li>The <em>SSL Handshake Protocol</em>
|
||||||
|
for performing the client and server SSL session establishment.
|
||||||
|
<li>The <em>SSL Change Cipher Spec Protocol</em> for actually establishing agreement
|
||||||
|
on the Cipher Suite for the session.
|
||||||
|
<li>The <em>SSL Alert Protocol</em> for
|
||||||
|
conveying SSL error messages between client and server.
|
||||||
|
</ul>
|
||||||
|
These protocols, as well as application protocol data, are encapsulated in the
|
||||||
|
<em>SSL Record Protocol</em>, as shown in <a href="#figure2">Figure 2</a>. An
|
||||||
|
encapsulated protocol is transferred as data by the lower layer protocol,
|
||||||
|
which does not examine the data. The encapsulated protocol has no knowledge of
|
||||||
|
the underlying protocol.
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="figure2"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Figure 2: SSL Protocol Stack</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<img src="ssl_intro_fig2.gif" alt="" width="428" height="217">
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
The encapsulation of SSL control protocols by the record protocol means that
|
||||||
|
if an active session is renegotiated the control protocols will be transmitted
|
||||||
|
securely. If there were no session before, then the Null cipher suite is
|
||||||
|
used, which means there is no encryption and messages have no integrity
|
||||||
|
digests until the session has been established.
|
||||||
|
<h3><a name="ToC17">Data Transfer</a></h3>
|
||||||
|
The SSL Record Protocol, shown in <a href="#figure3">Figure 3</a>, is used to
|
||||||
|
transfer application and SSL Control data between the client and server,
|
||||||
|
possibly fragmenting this data into smaller units, or combining multiple
|
||||||
|
higher level protocol data messages into single units. It may compress, attach
|
||||||
|
digest signatures, and encrypt these units before transmitting them using the
|
||||||
|
underlying reliable transport protocol (Note: currently all major SSL
|
||||||
|
implementations lack support for compression).
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="figure3"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Figure 3: SSL Record Protocol</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<img src="ssl_intro_fig3.gif" alt="" width="423" height="323">
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<h3><a name="ToC18">Securing HTTP Communication</a></h3>
|
||||||
|
One common use of SSL is to secure Web HTTP communication between a browser
|
||||||
|
and a webserver. This case does not preclude the use of non-secured HTTP. The
|
||||||
|
secure version is mainly plain HTTP over SSL (named HTTPS), but with one major
|
||||||
|
difference: it uses the URL scheme <code>https</code> rather than
|
||||||
|
<code>http</code> and a different server port (by default 443). This mainly
|
||||||
|
is what mod_ssl provides to you for the Apache webserver...
|
||||||
|
<h2><a name="ToC19">References</a></h2>
|
||||||
|
<ul>
|
||||||
|
<p>
|
||||||
|
<li><a name="AC96"></a>
|
||||||
|
[AC96] Bruce Schneier, <em>Applied Cryptography</em>, 2nd Edition, Wiley,
|
||||||
|
1996. See <a href="http://www.counterpane.com/">http://www.counterpane.com/</a> for
|
||||||
|
various other materials by Bruce Schneier.
|
||||||
|
<p>
|
||||||
|
<li><a name="X208"></a>
|
||||||
|
[X208] ITU-T Recommendation X.208, <em>Specification of Abstract Syntax Notation
|
||||||
|
One (ASN.1)</em>, 1988. See for instance <a
|
||||||
|
href="ftp://ftp.neda.com/pub/itu/x.series/x208.ps">
|
||||||
|
ftp://ftp.neda.com/pub/itu/x.series/x208.ps</a>.
|
||||||
|
<p>
|
||||||
|
<li><a name="X509"></a>
|
||||||
|
[X509] ITU-T Recommendation X.509, <em>The Directory - Authentication
|
||||||
|
Framework</em>, 1988. See for instance <a
|
||||||
|
href="ftp://ftp.bull.com/pub/OSIdirectory/ITUnov96/X.509/97x509final.doc">
|
||||||
|
ftp://ftp.bull.com/pub/OSIdirectory/ITUnov96/X.509/97x509final.doc</a>.
|
||||||
|
<p>
|
||||||
|
<li><a name="PKCS"></a>
|
||||||
|
[PKCS] Kaliski, Burton S., Jr., <em>An Overview of the PKCS Standards</em>, An RSA
|
||||||
|
Laboratories Technical Note, revised November 1, 1993.
|
||||||
|
See <a href="http://www.rsa.com/rsalabs/pubs/PKCS/">
|
||||||
|
http://www.rsa.com/rsalabs/pubs/PKCS/</a>.
|
||||||
|
<p>
|
||||||
|
<li><a name="MIME"></a>
|
||||||
|
[MIME] N. Freed, N. Borenstein, <em>Multipurpose Internet Mail Extensions
|
||||||
|
(MIME) Part One: Format of Internet Message Bodies</em>, RFC2045.
|
||||||
|
See for instance <a href="ftp://ftp.isi.edu/in-notes/rfc2045.txt">
|
||||||
|
ftp://ftp.isi.edu/in-notes/rfc2045.txt</a>.
|
||||||
|
<p>
|
||||||
|
<li><a name="SSL2"></a>
|
||||||
|
[SSL2] Kipp E.B. Hickman, <em>The SSL Protocol</em>, 1995.
|
||||||
|
See <a href="http://www.netscape.com/eng/security/SSL_2.html">
|
||||||
|
http://www.netscape.com/eng/security/SSL_2.html</a>.
|
||||||
|
<p>
|
||||||
|
<li><a name="SSL3"></a>
|
||||||
|
[SSL3] Alan O. Freier, Philip Karlton, Paul C. Kocher, <em>The SSL Protocol
|
||||||
|
Version 3.0</em>, 1996. See <a
|
||||||
|
href="http://www.netscape.com/eng/ssl3/draft302.txt">
|
||||||
|
http://www.netscape.com/eng/ssl3/draft302.txt</a>.
|
||||||
|
<p>
|
||||||
|
<li><a name="TLS1"></a>
|
||||||
|
[TLS1] Tim Dierks, Christopher Allen, <em>The TLS Protocol Version 1.0</em>,
|
||||||
|
1997. See <a
|
||||||
|
href="ftp://ftp.ietf.org/internet-drafts/draft-ietf-tls-protocol-06.txt">
|
||||||
|
ftp://ftp.ietf.org/internet-drafts/draft-ietf-tls-protocol-06.txt</a>.
|
||||||
|
</ul>
|
||||||
|
<p>
|
||||||
|
<br>
|
||||||
|
<table summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="ssl_overview.html" onmouseover="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_bot'); return true" onfocus="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_bot'); return true"><img name="ro_img_prev_bot" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Overview</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
<a href="ssl_reference.html" onmouseover="ro_imgOver('ro_img_next_bot', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_bot'); return true" onfocus="ro_imgOver('ro_img_next_bot', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_bot'); return true"><img name="ro_img_next_bot" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">Reference</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><table width="598" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left"><font face="Arial,Helvetica">
|
||||||
|
<a href="http://www.modssl.org/">mod_ssl</a> 2.8, User Manual<br>
|
||||||
|
The Apache Interface to OpenSSL
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
<td align="right"><font face="Arial,Helvetica">
|
||||||
|
Copyright © 1998-2001
|
||||||
|
<a href="http://www.engelschall.com/">Ralf S. Engelschall</a><br>
|
||||||
|
All Rights Reserved<br>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
476
docs/manual/ssl/ssl_overview.html
Normal file
476
docs/manual/ssl/ssl_overview.html
Normal file
@ -0,0 +1,476 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>mod_ssl: Preface</title>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions
|
||||||
|
are met:
|
||||||
|
|
||||||
|
1. Redistributions of source code must retain the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer.
|
||||||
|
|
||||||
|
2. Redistributions in binary form must reproduce the above
|
||||||
|
copyright notice, this list of conditions and the following
|
||||||
|
disclaimer in the documentation and/or other materials
|
||||||
|
provided with the distribution.
|
||||||
|
|
||||||
|
3. All advertising materials mentioning features or use of this
|
||||||
|
software must display the following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
4. The name "mod_ssl" must not be used to endorse or promote
|
||||||
|
products derived from this software without prior written
|
||||||
|
permission.
|
||||||
|
|
||||||
|
5. Redistributions of any form whatsoever must retain the
|
||||||
|
following acknowledgment:
|
||||||
|
"This product includes software developed by
|
||||||
|
Ralf S. Engelschall <rse@engelschall.com> for use in the
|
||||||
|
mod_ssl project (http://www.modssl.org/)."
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY
|
||||||
|
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S. ENGELSCHALL OR
|
||||||
|
HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||||
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||||
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||||
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||||
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||||
|
OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
-->
|
||||||
|
<style type="text/css"><!--
|
||||||
|
A:link {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:active {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
A:visited {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #6666cc;
|
||||||
|
}
|
||||||
|
#sf {
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H1 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 24pt;
|
||||||
|
line-height: 24pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H2 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 18pt;
|
||||||
|
line-height: 18pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H3 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 14pt;
|
||||||
|
line-height: 14pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
H4 {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 12pt;
|
||||||
|
line-height: 12pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#H {
|
||||||
|
}
|
||||||
|
#D {
|
||||||
|
background-color: #f0f0f0;
|
||||||
|
}
|
||||||
|
#faq {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#howto {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
#term {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 16pt;
|
||||||
|
line-height: 16pt;
|
||||||
|
font-family: arial,helvetica;
|
||||||
|
font-variant: normal;
|
||||||
|
font-style: normal;
|
||||||
|
}
|
||||||
|
--></style>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
function ro_imgNormal(imgName) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_n.src');
|
||||||
|
self.status = '';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function ro_imgOver(imgName, descript) {
|
||||||
|
if (document.images) {
|
||||||
|
document[imgName].src = eval(imgName + '_o.src');
|
||||||
|
self.status = descript;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_top_n = new Image();
|
||||||
|
ro_img_prev_top_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_top_o = new Image();
|
||||||
|
ro_img_prev_top_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_prev_bot_n = new Image();
|
||||||
|
ro_img_prev_bot_n.src = 'ssl_template.navbut-prev-n.gif';
|
||||||
|
ro_img_prev_bot_o = new Image();
|
||||||
|
ro_img_prev_bot_o.src = 'ssl_template.navbut-prev-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_next_top_n = new Image();
|
||||||
|
ro_img_next_top_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_next_top_o = new Image();
|
||||||
|
ro_img_next_top_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript" language="JavaScript">
|
||||||
|
<!-- Hiding the code
|
||||||
|
if (document.images) {
|
||||||
|
ro_img_next_bot_n = new Image();
|
||||||
|
ro_img_next_bot_n.src = 'ssl_template.navbut-next-n.gif';
|
||||||
|
ro_img_next_bot_o = new Image();
|
||||||
|
ro_img_next_bot_o.src = 'ssl_template.navbut-next-s.gif';
|
||||||
|
}
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body bgcolor="#ffffff" text="#000000" link="#333399" alink="#9999ff" vlink="#000066">
|
||||||
|
<div align="center">
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<img src="ssl_template.imgdot-1x1-transp.gif" alt="" width="600" height="1" align="bottom" border="0"><br>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left" valign="bottom">
|
||||||
|
<font face="Arial,Helvetica" size="+2"><b>mod_ssl</b></font>
|
||||||
|
</td>
|
||||||
|
<td align="right">
|
||||||
|
<img src="ssl_template.head-chapter.gif" alt="Chapter" width="175" height="94"> <img src="ssl_template.head-num-1.gif" alt="1" width="74" height="89">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="index.html" onmouseover="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_top'); return true" onfocus="ro_imgOver('ro_img_prev_top', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_top'); return true"><img name="ro_img_prev_top" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Cover</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
<a href="ssl_intro.html" onmouseover="ro_imgOver('ro_img_next_top', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_top'); return true" onfocus="ro_imgOver('ro_img_next_top', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_top'); return true"><img name="ro_img_next_top" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">Introduction</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<br>
|
||||||
|
<img src="ssl_template.title-over.gif" alt="Preface" width="456" height="60">
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="0" width="300" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<em>
|
||||||
|
``Ralf Engelschall has released an
|
||||||
|
excellent module that integrates
|
||||||
|
Apache and SSLeay.''
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td align="right">
|
||||||
|
<font size="-1">
|
||||||
|
Tim J. Hudson, SSLeay F.A.Q.
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
<table cellspacing="0" cellpadding="0" border="0" summary="">
|
||||||
|
<tr valign="bottom">
|
||||||
|
<td>
|
||||||
|
<img src="ssl_overview.gfont000.gif" alt="T" width="34" height="34" border="0" align="left">
|
||||||
|
his module provides strong cryptography for the <A
|
||||||
|
HREF="http://www.apache.org/">Apache</A> (v1.3) webserver via the <A
|
||||||
|
HREF="http://www.netscape.com/newsref/std/SSL.html">Secure Socket Layer</A>
|
||||||
|
(SSL v2/v3) and <A HREF="http://www.consensus.com/ietf-tls/">Transport Layer
|
||||||
|
Security</A> (TLS v1) protocols by the help of the excellent SSL/TLS
|
||||||
|
implementation library <A HREF="http://www.openssl.org/">OpenSSL</A> from <A
|
||||||
|
HREF="mailto:eay@aus.rsa.com">Eric A. Young</A> and <A
|
||||||
|
HREF="mailto:tjh@cryptsoft.com">Tim Hudson</A>.
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<div align="right">
|
||||||
|
<table cellspacing="0" cellpadding="5" border="0" bgcolor="#ccccff" summary="">
|
||||||
|
<tr>
|
||||||
|
<td bgcolor="#333399">
|
||||||
|
<font face="Arial,Helvetica" color="#ccccff">
|
||||||
|
<b>Global Table Of Contents</b>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<font face="Arial,Helvetica" size="-1">
|
||||||
|
<b>
|
||||||
|
<a href="ssl_overview.html">Chapter 1: Preface</a><br>
|
||||||
|
<a href="ssl_intro.html">Chapter 2: Introduction</a><br>
|
||||||
|
<a href="ssl_reference.html">Chapter 3: Reference</a><br>
|
||||||
|
<a href="ssl_compat.html">Chapter 4: Compatibility</a><br>
|
||||||
|
<a href="ssl_howto.html">Chapter 5: HowTo</a><br>
|
||||||
|
<a href="ssl_faq.html">Chapter 6: F.A.Q. List</a><br>
|
||||||
|
<a href="ssl_glossary.html">Chapter 7: Glossary</a><br>
|
||||||
|
</b>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<p>
|
||||||
|
The <A HREF="http://www.modssl.org/">mod_ssl</A> package was
|
||||||
|
created in April 1998 by <A HREF="mailto:rse@engelschall.com">Ralf S.
|
||||||
|
Engelschall</A> and was originally derived from the <A
|
||||||
|
HREF="http://www.apache-ssl.org/">Apache-SSL</A> package developed by <A
|
||||||
|
HREF="mailto:ben@algroup.co.uk">Ben Laurie</A>. It stays under a BSD-style
|
||||||
|
license which is equivalent to the license used by <A
|
||||||
|
HREF="http://www.apache.org/">The Apache Group</a> for the Apache webserver
|
||||||
|
itself. This means, in short, that you are free to use it both for commercial
|
||||||
|
and non-commercial purposes as long as you retain the authors' copyright
|
||||||
|
notices and give the proper credit.
|
||||||
|
<h2>Legalese</h2>
|
||||||
|
Although the above conditions also apply to Apache and OpenSSL in general (both
|
||||||
|
are freely available and useable software packages), you should be aware that
|
||||||
|
especially the cryptographic algorithms used inside OpenSSL stay under
|
||||||
|
certain patents and perhaps import/export/use restrictions in some countries
|
||||||
|
of the world. So whether you can actually use the combination
|
||||||
|
Apache+mod_ssl+OpenSSL in your country depends mainly on your local state laws.
|
||||||
|
The authors of neither Apache nor mod_ssl nor OpenSSL are liable for any
|
||||||
|
violations you make here.
|
||||||
|
<p>
|
||||||
|
If you're not sure what law details apply to your country you're strongly
|
||||||
|
advised to first determine them by consulting an attorney before using this
|
||||||
|
module. A lot of hints you can find in the <a
|
||||||
|
href="http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm">International Law
|
||||||
|
Crypto Survey</a> which is a really comprehensive resource on this topic. At
|
||||||
|
least two countries with heavy cryptography restrictions are well known:
|
||||||
|
In the United States (USA) it's not allowed to (re-)export mod_ssl
|
||||||
|
or OpenSSL And inside France it's not allowed to use any cryptography at all
|
||||||
|
when keys with more than 40 bits are used.
|
||||||
|
<p>
|
||||||
|
<table cellspacing="0" cellpadding="1" bgcolor="#cccccc" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table bgcolor="white" cellspacing="0" cellpadding="10" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<font face="Arial,Helvetica">
|
||||||
|
This software package uses strong cryptography, so while it is created,
|
||||||
|
maintained and distributed from Germany and Switzerland (where it is legal to
|
||||||
|
do this), it falls under certain export/import and/or use restrictions in some
|
||||||
|
other parts of the world.
|
||||||
|
<p>
|
||||||
|
PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY
|
||||||
|
SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING TECHNICAL
|
||||||
|
DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD.
|
||||||
|
SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM
|
||||||
|
THERE OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE
|
||||||
|
AUTHOR OR OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO
|
||||||
|
ANY EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHOR OF MOD_SSL
|
||||||
|
IS NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFULLY YOURSELF, IT
|
||||||
|
IS YOUR RESPONSIBILITY.
|
||||||
|
</font>
|
||||||
|
<p>
|
||||||
|
<font face="Arial,Helvetica">
|
||||||
|
CREDIT INFORMATION:
|
||||||
|
This product includes software developed by Ben Laurie for use in the
|
||||||
|
Apache-SSL HTTP server project, software developed by Larry Wall and David
|
||||||
|
MacKenzie for use in the GNU project of the FSF and software developed by Dr.
|
||||||
|
Stephen N. Henson as a companion to OpenSSL.
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
<h2>Module Architecture</h2>
|
||||||
|
The mod_ssl package consists of the SSL module (part 1 in <a
|
||||||
|
href="#figure1">Figure 1</a>) and a set of source patches for Apache adding the
|
||||||
|
Extended API (EAPI) (part 2 in <a href="#figure1">Figure 1</a>) which is an
|
||||||
|
essential prerequisite in order to use mod_ssl. In other words: you can only
|
||||||
|
use the mod_ssl module when Apache's core code contains the Extended API. But
|
||||||
|
because when applying mod_ssl to the Apache source tree the Extended API is
|
||||||
|
also automatically added you usually don't have to think about this. It's
|
||||||
|
mainly important for package vendors who want to build separate packages for
|
||||||
|
Apache and mod_ssl. For more details on how to apply mod_ssl to the Apache
|
||||||
|
source tree please follow the <code>INSTALL</code> file in the mod_ssl
|
||||||
|
distribution.
|
||||||
|
<p>
|
||||||
|
<div align="center">
|
||||||
|
<a name="figure1"></a>
|
||||||
|
<table width="600" cellspacing="0" cellpadding="1" border="0" summary="">
|
||||||
|
<caption align="bottom" id="sf">Figure 1: Module Architecture</caption>
|
||||||
|
<tr><td bgcolor="#cccccc">
|
||||||
|
<table width="598" cellpadding="5" cellspacing="0" border="0" summary="">
|
||||||
|
<tr><td valign="top" align="center" bgcolor="#ffffff">
|
||||||
|
<img src="ssl_overview_fig1.gif" alt="" width="382" height="281">
|
||||||
|
</td>
|
||||||
|
</tr></table>
|
||||||
|
</td></tr></table>
|
||||||
|
</div>
|
||||||
|
<h2>Module Building</h2>
|
||||||
|
The SSL module (mod_ssl) resides under the <CODE>src/modules/ssl/</CODE>
|
||||||
|
subdirectory inside the Apache source tree and is a regular Apache module. This
|
||||||
|
means that you can configure, build and install it like any other Apache module.
|
||||||
|
Usually this is done by using the APACI command
|
||||||
|
<blockquote>
|
||||||
|
<pre>
|
||||||
|
$ cd apache_1.3.x/
|
||||||
|
$ SSL_BASE=/path/to/openssl ./configure ... --enable-module=ssl
|
||||||
|
</pre>
|
||||||
|
</blockquote>
|
||||||
|
or by manually editing the <code>SSL_BASE</code> variable,
|
||||||
|
uncommenting the corresponding <code>AddModule</code> directive inside the
|
||||||
|
<code>src/Configuration</code> file and using the command
|
||||||
|
<blockquote>
|
||||||
|
<pre>
|
||||||
|
$ cd apache_1.3.x/src
|
||||||
|
$ ./Configure
|
||||||
|
</pre>
|
||||||
|
</blockquote>
|
||||||
|
for configuring. Additionally you can enable the <a
|
||||||
|
href="http://www.apache.org/docs/dso.html">Dynamic Shared Object</a> (DSO)
|
||||||
|
support for mod_ssl by either adding the <code>--enable-shared=ssl</code>
|
||||||
|
option to the APACI configure command line or by replacing the
|
||||||
|
<blockquote>
|
||||||
|
<pre>
|
||||||
|
AddModule ssl_module modules/ssl/libssl.a
|
||||||
|
</pre>
|
||||||
|
</blockquote>
|
||||||
|
line in <code>src/Configuration</code> with
|
||||||
|
<blockquote>
|
||||||
|
<pre>
|
||||||
|
SharedModule ssl_module modules/ssl/libssl.so
|
||||||
|
</pre>
|
||||||
|
</blockquote>
|
||||||
|
Building mod_ssl as a DSO is especially interesting to achieve more run-time
|
||||||
|
flexibility, i.e. you can decide whether to use SSL or not at run-time instead
|
||||||
|
of build-time. But notice that building mod_ssl as a DSO requires that your
|
||||||
|
OS/compiler supports building DSOs in the first place, and additionally that
|
||||||
|
they support linking of a DSO against a static library (libssl.a, libcrypo.a).
|
||||||
|
Not all platform support this.
|
||||||
|
<p>
|
||||||
|
<br>
|
||||||
|
<table summary="">
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<table width="600" border="0" summary="">
|
||||||
|
<tr>
|
||||||
|
<td valign="top" align="left" width="250">
|
||||||
|
<a href="index.html" onmouseover="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onmouseout="ro_imgNormal('ro_img_prev_bot'); return true" onfocus="ro_imgOver('ro_img_prev_bot', 'previous page'); return true" onblur="ro_imgNormal('ro_img_prev_bot'); return true"><img name="ro_img_prev_bot" src="ssl_template.navbut-prev-n.gif" alt="previous page" width="70" height="18" border="0"></a><br><font color="#000000">Cover</font>
|
||||||
|
</td>
|
||||||
|
<td valign="top" align="right" width="250">
|
||||||
|
<a href="ssl_intro.html" onmouseover="ro_imgOver('ro_img_next_bot', 'next page'); return true" onmouseout="ro_imgNormal('ro_img_next_bot'); return true" onfocus="ro_imgOver('ro_img_next_bot', 'next page'); return true" onblur="ro_imgNormal('ro_img_next_bot'); return true"><img name="ro_img_next_bot" src="ssl_template.navbut-next-n.gif" alt="next page" width="70" height="18" border="0"></a><br><font color="#000000">Introduction</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="ssl_template.imgdot-1x1-000000.gif" alt="" width="600" height="2" align="bottom" border="0"></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><table width="598" summary="">
|
||||||
|
<tr>
|
||||||
|
<td align="left"><font face="Arial,Helvetica">
|
||||||
|
<a href="http://www.modssl.org/">mod_ssl</a> 2.8, User Manual<br>
|
||||||
|
The Apache Interface to OpenSSL
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
<td align="right"><font face="Arial,Helvetica">
|
||||||
|
Copyright © 1998-2001
|
||||||
|
<a href="http://www.engelschall.com/">Ralf S. Engelschall</a><br>
|
||||||
|
All Rights Reserved<br>
|
||||||
|
</font>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
2539
docs/manual/ssl/ssl_reference.html
Normal file
2539
docs/manual/ssl/ssl_reference.html
Normal file
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user