diff options
Diffstat (limited to 'docs/manual/ssl/ssl_faq.html.en')
| -rw-r--r-- | docs/manual/ssl/ssl_faq.html.en | 47 |
1 files changed, 26 insertions, 21 deletions
diff --git a/docs/manual/ssl/ssl_faq.html.en b/docs/manual/ssl/ssl_faq.html.en index c2a9d1df2f..c7c83e9ffc 100644 --- a/docs/manual/ssl/ssl_faq.html.en +++ b/docs/manual/ssl/ssl_faq.html.en @@ -176,11 +176,12 @@ relative hyperlinks?</a></li> fully-qualified hyperlinks (because you have to change the URL scheme). Using <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code> however, you can manipulate relative hyperlinks, to achieve the same effect.</p> - <div class="example"><p><code> - RewriteEngine on<br /> - RewriteRule ^/(.*)_SSL$ https://%{SERVER_NAME}/$1 [R,L]<br /> - RewriteRule ^/(.*)_NOSSL$ http://%{SERVER_NAME}/$1 [R,L] - </code></p></div> + <pre class="prettyprint lang-config"> +RewriteEngine on +RewriteRule ^/(.*)_SSL$ https://%{SERVER_NAME}/$1 [R,L] +RewriteRule ^/(.*)_NOSSL$ http://%{SERVER_NAME}/$1 [R,L] + </pre> + <p>This rewrite ruleset lets you use hyperlinks of the form <code><a href="document.html_SSL"></code>, to switch to HTTPS @@ -256,10 +257,11 @@ Certificate for testing purposes?</a></h3> -keyout server.key</strong></code><br /> These can be used as follows in your <code>httpd.conf</code> file: - <pre> - SSLCertificateFile /path/to/this/server.crt - SSLCertificateKeyFile /path/to/this/server.key + <pre class="prettyprint lang-config"> +SSLCertificateFile /path/to/this/server.crt +SSLCertificateKeyFile /path/to/this/server.key </pre> + </li> <li>It is important that you are aware that this <code>server.key</code> does <em>not</em> have any passphrase. @@ -336,10 +338,11 @@ Certificate for testing purposes?</a></h3> <li>You should now have two files: <code>server.key</code> and <code>server.crt</code>. These can be used as follows in your <code>httpd.conf</code> file: - <pre> - SSLCertificateFile /path/to/this/server.crt - SSLCertificateKeyFile /path/to/this/server.key + <pre class="prettyprint lang-config"> +SSLCertificateFile /path/to/this/server.crt +SSLCertificateKeyFile /path/to/this/server.key </pre> + The <code>server.csr</code> file is no longer needed. </li> @@ -606,9 +609,9 @@ error when connecting to my newly installed server?</a></h3> handshake is finished, but the information is needed in order to complete the SSL handshake phase. See the next question for how to circumvent this issue.</p> - + <p>Note that if you have a wildcard SSL certificate, or a - certificate that has multple hostnames on it using subjectAltName + certificate that has multiple hostnames on it using subjectAltName fields, you can use SSL on name-based virtual hosts without further workarounds.</p> @@ -651,9 +654,10 @@ Virtual Hosting to identify different SSL virtual hosts?</a></h3> you must make sure to put the non-SSL port number on the NameVirtualHost directive, e.g.</p> - <div class="example"><p><code> + <pre class="prettyprint lang-config"> NameVirtualHost 192.168.1.1:80 - </code></p></div> + </pre> + <p>Other workaround solutions include: </p> @@ -669,7 +673,7 @@ a negotiable standard compression method. <p>OpenSSL 0.9.8 started to support this by default when compiled with the <code>zlib</code> option. If both the client and the server support compression, it will be used. However, most clients still try to initially connect with an -SSLv2 Hello. As SSLv2 did not include an array of prefered compression algorithms +SSLv2 Hello. As SSLv2 did not include an array of preferred compression algorithms in its handshake, compression cannot be negotiated with these clients. If the client disables support for SSLv2, either an SSLv3 or TLS Hello may be sent, depending on which SSL library is used, and compression may @@ -703,11 +707,12 @@ Explorer (MSIE)?</a></h3> keep-alive connections or send the SSL close notify messages to MSIE clients. This can be done by using the following directive in your SSL-aware virtual host section:</p> - <div class="example"><p><code> - SetEnvIf User-Agent "MSIE [2-5]" \<br /> - nokeepalive ssl-unclean-shutdown \<br /> - downgrade-1.0 force-response-1.0 - </code></p></div> + <pre class="prettyprint lang-config"> +SetEnvIf User-Agent "MSIE [2-5]" \ + nokeepalive ssl-unclean-shutdown \ + downgrade-1.0 force-response-1.0 + </pre> + <p>Further, some MSIE versions have problems with particular ciphers. Unfortunately, it is not possible to implement a MSIE-specific workaround for this, because the ciphers are needed as early as the |