You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Yann Ylavic <yl...@apache.org> on 2014/04/04 01:06:50 UTC
Re: svn commit: r1584098 - in /httpd/httpd/trunk: CHANGES
docs/manual/mod/mod_ssl.xml modules/ssl/ssl_engine_ocsp.c modules/ssl/ssl_private.h
On Wed, Apr 2, 2014 at 7:21 PM, <yl...@apache.org> wrote:
> Author: ylavic
> Date: Wed Apr 2 17:21:28 2014
> New Revision: 1584098
>
> URL: http://svn.apache.org/r1584098
> Log:
> mod_ssl: follow up to r1583191.
>
> New SSLOCSPUseRequestNonce directive's manual and CHANGES.
>
[snip]
>
> Modified: httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml?rev=1584098&r1=1584097&r2=1584098&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml (original)
> +++ httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml Wed Apr 2 17:21:28 2014
> @@ -2278,6 +2278,23 @@ which means that OCSP responses are cons
> </directivesynopsis>
>
> <directivesynopsis>
> +<name>SSLOCSPUseRequestNonce</name>
> +<description>Use a nonce within OCSP queries</description>
> +<syntax>SSLOCSPUseRequestNonce on|off</syntax>
> +<default>SSLOCSPUseRequestNonce on</default>
> +<contextlist><context>server config</context>
> +<context>virtual host</context></contextlist>
> +<compatibility>Available in httpd 2.4.10 and later, if using OpenSSL 0.9.7 or later</compatibility>
I had to use the next version number here, while it is abviously not
yet accepted for backport.
What is the procedure in this case?
> +
> +<usage>
> +<p>This option determines whether queries to OCSP responders should contain
> +a nonce or not. By default, a query nonce is always used and checked against
> +the response's one. When the responder does not use nonces (eg. Microsoft OCSP
> +Responder), this option ought to be turned <code>off</code>.</p>
> +</usage>
> +</directivesynopsis>
> +
> +<directivesynopsis>
> <name>SSLInsecureRenegotiation</name>
> <description>Option to enable support for insecure renegotiation</description>
> <syntax>SSLInsecureRenegotiation on|off</syntax>
>
Re: svn commit: r1584098 - in /httpd/httpd/trunk: CHANGES
docs/manual/mod/mod_ssl.xml modules/ssl/ssl_engine_ocsp.c modules/ssl/ssl_private.h
Posted by Yann Ylavic <yl...@gmail.com>.
On Fri, Apr 4, 2014 at 9:57 AM, Yann Ylavic <yl...@gmail.com> wrote:
> On Fri, Apr 4, 2014 at 9:55 AM, Yann Ylavic <yl...@gmail.com> wrote:
>> I can now remove this requirement from all...
> And maybe the availability in httpd 2.3 and later too.
Done in r1584555.
Re: svn commit: r1584098 - in /httpd/httpd/trunk: CHANGES
docs/manual/mod/mod_ssl.xml modules/ssl/ssl_engine_ocsp.c modules/ssl/ssl_private.h
Posted by Yann Ylavic <yl...@gmail.com>.
On Fri, Apr 4, 2014 at 9:55 AM, Yann Ylavic <yl...@gmail.com> wrote:
> I can now remove this requirement from all...
And maybe the availability in httpd 2.3 and later too.
Re: svn commit: r1584098 - in /httpd/httpd/trunk: CHANGES
docs/manual/mod/mod_ssl.xml modules/ssl/ssl_engine_ocsp.c modules/ssl/ssl_private.h
Posted by Yann Ylavic <yl...@gmail.com>.
On Fri, Apr 4, 2014 at 9:21 AM, Ruediger Pluem <rp...@apache.org> wrote:
>
>
> Eric Covener wrote:
>>
>> On Thu, Apr 3, 2014 at 7:06 PM, Yann Ylavic <ylavic@apache.org <ma...@apache.org>> wrote:
>>
>> > +<compatibility>Available in httpd 2.4.10 and later, if using OpenSSL 0.9.7 or later</compatibility>
>
> Hmm. Isn't OpenSSL >= 0.9.8 already mandatory for httpd 2.4.x?
Correct, although all the SSLOCSP* directives refer to 0.9.7 (I
blindly copied this part).
I can now remove this requirement from all...
Regards,
Yann.
Re: svn commit: r1584098 - in /httpd/httpd/trunk: CHANGES docs/manual/mod/mod_ssl.xml
modules/ssl/ssl_engine_ocsp.c modules/ssl/ssl_private.h
Posted by Ruediger Pluem <rp...@apache.org>.
Eric Covener wrote:
>
> On Thu, Apr 3, 2014 at 7:06 PM, Yann Ylavic <ylavic@apache.org <ma...@apache.org>> wrote:
>
> > +<compatibility>Available in httpd 2.4.10 and later, if using OpenSSL 0.9.7 or later</compatibility>
Hmm. Isn't OpenSSL >= 0.9.8 already mandatory for httpd 2.4.x?
Regards
Rüdiger
Re: svn commit: r1584098 - in /httpd/httpd/trunk: CHANGES
docs/manual/mod/mod_ssl.xml modules/ssl/ssl_engine_ocsp.c modules/ssl/ssl_private.h
Posted by Eric Covener <co...@gmail.com>.
On Thu, Apr 3, 2014 at 7:06 PM, Yann Ylavic <yl...@apache.org> wrote:
> > +<compatibility>Available in httpd 2.4.10 and later, if using OpenSSL
> 0.9.7 or later</compatibility>
I usually only do it for stuff I think will not be at all controversial
and proposed immediately
Otherwise, without/until 2.5.x releases from trunk, assume nobody will ask
when something went into trunk and just try to remember during backport.
--
Eric Covener
covener@gmail.com