You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ic...@apache.org on 2021/05/17 12:11:24 UTC
svn commit: r1889958 - /httpd/httpd/trunk/docs/manual/mod/mod_md.xml
Author: icing
Date: Mon May 17 12:11:24 2021
New Revision: 1889958
URL: http://svn.apache.org/viewvc?rev=1889958&view=rev
Log:
mod_md: update documentation regading private keys and message events.
Modified:
httpd/httpd/trunk/docs/manual/mod/mod_md.xml
Modified: httpd/httpd/trunk/docs/manual/mod/mod_md.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_md.xml?rev=1889958&r1=1889957&r2=1889958&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_md.xml (original)
+++ httpd/httpd/trunk/docs/manual/mod/mod_md.xml Mon May 17 12:11:24 2021
@@ -675,22 +675,31 @@ MDPortMap http:- https:8433
<usage>
<p>
Defines what kind of private keys are generated for a managed domain and with
- what parameters. The only supported type right now is 'RSA' and the only parameter
- it takes is the number of bits used for the key.
+ what parameters. You can have more than one private key type configured and
+ the module will obtain a certificate for each key.
</p><p>
- The current (2017) recommendation is at least 2048 bits and a smaller number is
- not accepted here. Higher numbers offer longer security, but are computationally more
- expensive, e.g. increase the load on your server. That might or might not be an
- issue for you.
- </p><p>
- Other key types will be defined in the future.
+ For example, you may configure an RSA and an Elliptic Curve (EC) key, so
+ that 2 certicates are created for a domain. On a client connection, the first
+ one supported by the client will then be used.
+ </p><p>
+ Since EC keys and certificates are smaller, you might want to offer
+ them first for all compatible (modern) clients. This can enable
+ faster handshakes. Add an RSA key type to support older clients.
</p>
<example><title>Example</title>
<highlight language="config">
-MDPrivateKeys RSA 3072
+MDPrivateKeys secp256r1 rsa3072
</highlight>
</example>
<p>
+ The EC types supported depend on the CA you use. For Let's encrypt
+ the supported curves include 'secp256r1' and 'secp384r1'.
+ </p><p>
+ Each key and certificate type is stored in its own file in the
+ MD store. The key type is part of the file name with some backward
+ compatible naming for RSA certificates. So you may continue sharing
+ these files with other applications.
+ </p><p>
Please note that this setting only has an effect on new keys. Any existing
private key you have remains unaffected. Also, this only affects private keys
generated for certificates. ACME account keys are unaffected by this.
@@ -1039,6 +1048,21 @@ MDMessageCmd /etc/apache/md-message
with root permissions (on *nix systems) and has access to the certificate
files (and keys). Certificates needed for other applications or
in different formats can be processed on this event.
+ </p><p>
+ 'renewing' event is triggered before starting renew process for the managed
+ domain. Should the command return != 0 for this reason, renew will be
+ aborted and repeated on next cycle. Some cluster setups use this to
+ allow renewals to run only on a single node.
+ </p><p>
+ 'challenge-setup:type:domain' event is triggered when the challenge data for a domain has
+ been created. This is invoked before the ACME server is told to check for it.
+ The type is one of the ACME challenge types. This is invoked for every
+ DNS name in a MDomain. Cluster setups may use this event to distribute
+ challenge files to all nodes in a cluster.
+ </p><p>
+ ocsp-errored happens when MDStapling is enabled for a domain, this indicates
+ that an error was encountered retrieving the OCSP response from the
+ Certificate Authority. mod_md will continue trying.
</p>
</usage>
</directivesynopsis>