You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by tr...@apache.org on 2014/10/17 02:32:45 UTC
svn commit: r1632456 - in /httpd/httpd/trunk/docs/manual/ssl:
ssl_howto.html.en ssl_howto.html.fr ssl_howto.xml.fr ssl_howto.xml.meta
Author: trawick
Date: Fri Oct 17 00:32:45 2014
New Revision: 1632456
URL: http://svn.apache.org/r1632456
Log:
make docs
Modified:
httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.en
httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.fr
httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.fr
httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.meta
Modified: httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.en
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.en?rev=1632456&r1=1632455&r2=1632456&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.en (original)
+++ httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.en Fri Oct 17 00:32:45 2014
@@ -33,6 +33,7 @@ before progressing to the advanced techn
</div>
<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#configexample">Basic Configuration Example</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#ciphersuites">Cipher Suites and Enforcing Strong Security</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#ocspstapling">OCSP Stapling</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#accesscontrol">Client Authentication and Access Control</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#logging">Logging</a></li>
</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
@@ -101,6 +102,102 @@ SSLCipherSuite HIGH:!aNULL:!MD5
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
+<h2><a name="ocspstapling" id="ocspstapling">OCSP Stapling</a></h2>
+
+
+<p>The Online Certificate Status Protocol (OCSP) is a mechanism for
+determining whether or not a server certificate has been revoked, and OCSP
+Stapling is a special form of this in which the server, such as httpd and
+mod_ssl, maintains current OCSP responses for its certificates and sends
+them to clients which communicate with the server. Most certificates
+contain the address of an OCSP responder maintained by the issuing
+Certificate Authority, and mod_ssl can communicate with that responder to
+obtain a signed response that can be sent to clients communicating with
+the server.</p>
+
+<p>Because the client can obtain the certificate revocation status from
+the server, without requiring an extra connection from the client to the
+Certificate Authority, OCSP Stapling is the preferred way for the
+revocation status to be obtained. Other benefits of eliminating the
+communication between clients and the Certificate Authority are that the
+client browsing history is not exposed to the Certificate Authority and
+obtaining status is more reliable by not depending on potentially heavily
+loaded Certificate Authority servers.</p>
+
+<p>Because the response obtained by the server can be reused for all clients
+using the same certificate during the time that the response is valid, the
+overhead for the server is minimal.</p>
+
+<p>Once general SSL support has been configured properly, enabling OCSP
+Stapling generally requires only very minor modifications to the httpd
+configuration — the addition of these two directives:</p>
+
+ <pre class="prettyprint lang-config">SSLUseStapling On
+SSLStaplingCache "shmcb:ssl_stapling(32768)"</pre>
+
+
+<p>These directives are placed at global scope (i.e., not within a virtual
+host definition) wherever other global SSL configuration directives are
+placed, such as in <code>conf/extra/httpd-ssl.conf</code> for normal
+open source builds of httpd, <code>/etc/apache2/mods-enabled/ssl.conf</code>
+for the Ubuntu or Debian-bundled httpd, etc.</p>
+
+<p>The following sections highlight the most common situations which require
+further modification to the configuration. Refer also to the
+<code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> reference manual.</p>
+
+<h3>If more than a few SSL certificates are used for the server</h3>
+
+<p>OCSP responses are stored in the SSL stapling cache. While the responses
+are typically a few hundred to a few thousand bytes in size, mod_ssl
+supports OCSP responses up to around 10K bytes in size. With more than a
+few certificates, the stapling cache size (32768 bytes in the example above)
+may need to be increased.</p>
+
+
+<h3>If the certificate does not point to an OCSP responder, or if a
+different address must be used</h3>
+
+<p>Refer to the
+<code class="directive"><a href="../mod/mod_ssl.html#sslstaplingforceurl">SSLStaplingForceURL</a></code> directive.</p>
+
+<p>You can confirm that a server certificate points to an OCSP responder
+using the openssl command-line program, as follows:</p>
+
+<pre>$ openssl x509 -in ./www.example.com.crt -text | grep 'OCSP.*http'
+OCSP - URI:http://ocsp.example.com</pre>
+
+<p>If the OCSP URI is provided and the web server can communicate to it
+directly without using a proxy, no configuration is required. Note that
+firewall rules that control outbound connections from the web server may
+need to be adjusted.</p>
+
+<p>If no OCSP URI is provided, contact your Certificate Authority to
+determine if one is available; if so, configure it with
+<code class="directive"><a href="../mod/mod_ssl.html#sslstaplingforceurl">SSLStaplingForceURL</a></code> in the virtual
+host that uses the certificate.</p>
+
+
+<h3>If multiple SSL-enabled virtual hosts are configured and OCSP
+Stapling should be disabled for some</h3>
+
+
+<p>Add <code>SSLUseStapling Off</code> to the virtual hosts for which OCSP
+Stapling should be disabled.</p>
+
+
+<h3>If the OCSP responder is slow or unreliable</h3>
+
+<p>Several directives are available to handle timeouts and errors. Refer
+to the documentation for the
+<code class="directive"><a href="../mod/mod_ssl.html#sslstaplingfaketrylater">SSLStaplingFakeTryLater</a></code>,
+<code class="directive"><a href="../mod/mod_ssl.html#sslstaplingrespondertimeout">SSLStaplingResponderTimeout</a></code>, and
+<code class="directive"><a href="../mod/mod_ssl.html#sslstaplingreturnrespondererrors">SSLStaplingReturnResponderErrors</a></code>
+directives.</p>
+
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
<h2><a name="accesscontrol" id="accesscontrol">Client Authentication and Access Control</a></h2>
<ul>
Modified: httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.fr
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.fr?rev=1632456&r1=1632455&r2=1632456&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.fr (original)
+++ httpd/httpd/trunk/docs/manual/ssl/ssl_howto.html.fr Fri Oct 17 00:32:45 2014
@@ -24,6 +24,8 @@
<p><span>Langues Disponibles: </span><a href="../en/ssl/ssl_howto.html" hreflang="en" rel="alternate" title="English"> en </a> |
<a href="../fr/ssl/ssl_howto.html" title="Français"> fr </a></p>
</div>
+<div class="outofdate">Cette traduction peut être périmée. Vérifiez la version
+ anglaise pour les changements récents.</div>
<p>Ce document doit vous permettre de démarrer et de faire fonctionner
Modified: httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.fr
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.fr?rev=1632456&r1=1632455&r2=1632456&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.fr (original)
+++ httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.fr Fri Oct 17 00:32:45 2014
@@ -1,7 +1,7 @@
<?xml version="1.0" encoding="ISO-8859-1" ?>
<!DOCTYPE manualpage SYSTEM "../style/manualpage.dtd">
<?xml-stylesheet type="text/xsl" href="../style/manual.fr.xsl"?>
-<!-- English Revision : 1380242 -->
+<!-- English Revision: 1380242:1632454 (outdated) -->
<!-- French translation : Lucien GENTIS -->
<!-- Reviewed by : Vincent Deffontaines -->
Modified: httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.meta
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.meta?rev=1632456&r1=1632455&r2=1632456&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.meta (original)
+++ httpd/httpd/trunk/docs/manual/ssl/ssl_howto.xml.meta Fri Oct 17 00:32:45 2014
@@ -8,6 +8,6 @@
<variants>
<variant>en</variant>
- <variant>fr</variant>
+ <variant outdated="yes">fr</variant>
</variants>
</metafile>