From 304e9c4c08227be0556cc497519e0efccbba6988 Mon Sep 17 00:00:00 2001 From: Kaspar Brand Date: Fri, 18 Nov 2011 05:27:00 +0000 Subject: drop SSLv2 support (set SSL_OP_NO_SSLv2 for any new SSL_CTX) git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1203491 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_ssl.xml | 28 ++++++++++------------------ docs/manual/upgrading.xml | 3 ++- 2 files changed, 12 insertions(+), 19 deletions(-) (limited to 'docs') diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index 3b342b47bf..041446961e 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -61,7 +61,7 @@ compatibility variables.

Description: HTTPS flag HTTPS is being used. -SSL_PROTOCOL string The SSL protocol version (SSLv2, SSLv3, TLSv1) +SSL_PROTOCOL string The SSL protocol version (SSLv3, TLSv1) SSL_SESSION_ID string The hex-encoded SSL session id SSL_SESSION_RESUMED string Initial or Resumed SSL Session. Note: multiple requests may be served over the same (Initial or Resumed) SSL session if HTTP KeepAlive is in use SSL_SECURE_RENEG string true if secure renegotiation is supported, else false @@ -563,7 +563,7 @@ by the applicable Security Policy. SSLProtocol -Configure usable SSL protocol versions +Configure usable SSL/TLS protocol versions SSLProtocol [+|-]protocol ... SSLProtocol all server config @@ -571,17 +571,11 @@ by the applicable Security Policy.

-This directive can be used to control which versions of the SSL protocol +This directive can be used to control which versions of the SSL/TLS protocol will be accepted in new connections.

The available (case-insensitive) protocols are:

    -
  • SSLv2 -

    - This is the Secure Sockets Layer (SSL) protocol, version 2.0. It is the - original SSL protocol as designed by Netscape Corporation. Though it's - use has been deprecated, because of weaknesses in the security of the protocol.

    • -
  • SSLv3

    This is the Secure Sockets Layer (SSL) protocol, version 3.0, from @@ -592,19 +586,17 @@ The available (case-insensitive) protocols are:

  • TLSv1

    This is the Transport Layer Security (TLS) protocol, version 1.0. It is the - successor to SSLv3 and is defined in RFC2246. - Which has been obsoleted by RFC4346.

    • + successor to SSLv3 and was originally defined in RFC 2246 + (obsoleted by RFC 4346 + and RFC 5246 in + the meantime).

    -
  • All +
  • all

    - This is a shortcut for ``+SSLv2 +SSLv3 +TLSv1'' and a - convenient way for enabling all protocols except one when used in - combination with the minus sign on a protocol as the example above - shows.

    • + This is a shortcut for ``+SSLv3 +TLSv1''.

Example -# enable SSLv3 and TLSv1, but not SSLv2
-SSLProtocol all -SSLv2 +SSLProtocol TLSv1 diff --git a/docs/manual/upgrading.xml b/docs/manual/upgrading.xml index 300fe19e5f..0b844516e4 100644 --- a/docs/manual/upgrading.xml +++ b/docs/manual/upgrading.xml @@ -294,7 +294,8 @@
  • mod_ssl: The default format of the *_DN variables has changed. The old format can still be used with the new LegacyDNStringFormat argument to SSLOptions.
    • + module="mod_ssl">SSLOptions. The SSLv2 protocol is + no longer supported.
  • htpasswd now uses MD5 hash by default on all platforms.
    • -- cgit v1.2.3