1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
|
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
<!--
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
This file is generated from xml source: DO NOT EDIT
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-->
<title>ctlogconfig - Certificate Transparency log configuration tool - Apache HTTP Server Version 2.5</title>
<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
<script src="../style/scripts/prettify.min.js" type="text/javascript">
</script>
<link href="../images/favicon.ico" rel="shortcut icon" /></head>
<body id="manual-page"><div id="page-header">
<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
<p class="apache">Apache HTTP Server Version 2.5</p>
<img alt="" src="../images/feather.png" /></div>
<div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
<div id="path">
<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.5</a> > <a href="./">Programs</a></div><div id="page-content"><div id="preamble"><h1>ctlogconfig - Certificate Transparency log configuration tool</h1>
<div class="toplang">
<p><span>Available Languages: </span><a href="../en/programs/ctlogconfig.html" title="English"> en </a> |
<a href="../fr/programs/ctlogconfig.html" hreflang="fr" rel="alternate" title="Français"> fr </a></p>
</div>
<p><code>ctlogconfig</code> is a tool for creating and maintaining a log
configuration database, for use with <code class="module"><a href="../mod/mod_ssl_ct.html">mod_ssl_ct</a></code>.</p>
<p>Refer first to <a href="../mod/mod_ssl_ct.html#logconf">Log
configuration</a> in the <code class="module"><a href="../mod/mod_ssl_ct.html">mod_ssl_ct</a></code> documentation.</p>
<p>Refer to the <a href="#examples">examples below</a> for typical use.</p>
</div>
<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#synopsis">Synopsis</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#subcommands">Sub-commands</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#examples">Examples</a></li>
</ul><h3>See also</h3><ul class="seealso"><li><code class="module"><a href="../mod/mod_ssl_ct.html">mod_ssl_ct</a></code></li><li><a href="#comments_section">Comments</a></li></ul></div>
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="synopsis" id="synopsis">Synopsis</a><a title="Permanent link" href="#synopsis" class="permalink">¶</a></h2>
<p><code>
<strong>ctlogconfig</strong> <em>/path/to/db</em> <strong>dump</strong>
</code></p>
<p><code>
<strong>ctlogconfig</strong> <em>/path/to/db</em> <strong>configure-public-key</strong>
[ <em>log-id</em>|<em>record-id</em> ]
<em>/path/to/public-key.pem</em>
</code></p>
<p><code>
<strong>ctlogconfig</strong> <em>/path/to/db</em> <strong>configure-url</strong>
[ <em>log-id</em>|<em>record-id</em> ]
<em>log-URL</em>
</code></p>
<p><code>
<strong>ctlogconfig</strong> <em>/path/to/db</em> <strong>valid-time-range</strong>
<em>log-id</em>|<em>record-id</em>
<em>min-timestamp</em> <em>max-timestamp</em>
</code></p>
<p><code>
<strong>ctlogconfig</strong> <em>/path/to/db</em> <strong>trust</strong>
<em>log-id</em>|<em>record-id</em>
</code></p>
<p><code>
<strong>ctlogconfig</strong> <em>/path/to/db</em> <strong>distrust</strong>
<em>log-id</em>|<em>record-id</em>
</code></p>
<p><code>
<strong>ctlogconfig</strong> <em>/path/to/db</em> <strong>forget</strong>
<em>log-id</em>|<em>record-id</em>
</code></p>
<dl>
<dt><em>log-id</em></dt>
<dd>This is the id of the log, which is the SHA-256 hash of the log's public key,
provided in hexadecimal format. This string is 64 characters in length.</dd>
<dt><em>record-id</em></dt>
<dd>This is the record number in the database, as displayed by the <strong>dump</strong>
sub-command, prefixed with <strong>#</strong>. As an example, <strong>#4</strong>
references the fourth record in the database. (Use shell escaping as necessary.)</dd>
<dt><em>/path/to/public-key.pem</em></dt>
<dd>This is a file containing the log's public key in PEM format. The public
key is not stored in the database. Instead, a reference to the file is stored.
Thus, the file cannot be removed until the public key in the database is removed
or changed.</dd>
<dt><em>min-timestamp</em>, <em>max-timestamp</em></dt>
<dd>A timestamp is a time as expressed in the number of milliseconds since the
epoch, ignoring leap seconds. This is the form of time used in Signed Certificate
Timestamps. This must be provided as a decimal number.
<br />
Specify <strong><code>-</code></strong> for one of the timestamps if it is unknown.
For example, when configuring the minimum valid timestamp for a log which remains
valid, specify <strong><code>-</code></strong> for <em>max-timestamp</em>.
<br />
SCTs received from this log by the proxy are invalid if the timestamp
is older than <em>min-timestamp</em> or newer than <em>max-timestamp</em>.</dd>
</dl>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="subcommands" id="subcommands">Sub-commands</a><a title="Permanent link" href="#subcommands" class="permalink">¶</a></h2>
<dl>
<dt>dump</dt>
<dd>Display configuration database contents. The record id shown in
the output of this sub-command can be used to identify the affected
record in other sub-commands.</dd>
<dt>configure-public-key</dt>
<dd>Add a log's public key to the database or set the public key for an
existing entry. The log's public key is needed to validate the signature
of SCTs received by a proxy from a backend server. (The database will
be created if it does not yet exist.)</dd>
<dt>configure-url</dt>
<dd>Add a log's URL to the database or set the URL for an existing entry.
The log's URL is used when submitting server certificates to logs in
order to obtain SCTs to send to clients. (The database will
be created if it does not yet exist.)</dd>
<dt>valid-time-range</dt>
<dd>Set the minimum valid time and/or the maximum valid time for a log.
SCTs from the log with timestamps outside of the valid range will not be
accepted. Use <code>-</code> for a time that is not being configured.
(The database will be created if it does not yet exist.)</dd>
<dt>trust</dt>
<dd>Mark a log as trusted, which is the default setting. This sub-command
is used to reverse a <em>distrust</em> setting. (The database will
be created if it does not yet exist.)</dd>
<dt>distrust</dt>
<dd>Mark a log as distrusted. (The database will be created if it does
not yet exist.)</dd>
<dt>forget</dt>
<dd>Remove information about a log from the database.</dd>
</dl>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="examples" id="examples">Examples</a><a title="Permanent link" href="#examples" class="permalink">¶</a></h2>
<p>Consider an Apache httpd instance which serves as a TLS server and a proxy.
The TLS server needs to obtain SCTs from a couple of known logs in order to
pass those to clients, and the proxy needs to be able to validate the signature
of SCTs received from backend servers.</p>
<p>First we'll configure the URLs for logs where server certificates are logged:</p>
<div class="example"><p><code>
$ ctlogconfig /path/to/conf/log-config configure-url http://log1.example.com/<br />
$ ctlogconfig /path/to/conf/log-config configure-url http://log2.example.com/<br />
$ ctlogconfig /path/to/conf/log-config dump<br />
Log entry:<br />
Record 1<br />
Log id : (not configured)<br />
Public key file: (not configured)<br />
URL : http://log1.example.com/<br />
Time range : -INF to +INF<br />
<br />
Log entry:<br />
Record 2<br />
Log id : (not configured)<br />
Public key file: (not configured)<br />
URL : http://log2.example.com/<br />
Time range : -INF to +INF<br />
</code></p></div>
<p>Next we'll set the public key of a log where the certificate of our only
backend server is published. In this case it is the log with URL
http://log2.example.com/ which has already been configured.</p>
<div class="example"><p><code>
$ ctlogconfig /path/to/conf/log-config configure-public-key \#2 /path/to/conf/log2-pub.pem<br />
$ ctlogconfig /path/to/conf/log-config dump<br />
Log entry:<br />
Record 1<br />
Log id : (not configured)<br />
Public key file: (not configured)<br />
URL : http://log1.example.com/<br />
Time range : -INF to +INF<br />
<br />
Log entry:<br />
Record 2<br />
Log id : (not configured)<br />
Public key file: /path/to/conf/log2-pub.pem<br />
URL : http://log2.example.com/<br />
Time range : -INF to +INF<br />
</code></p></div>
</div></div>
<div class="bottomlang">
<p><span>Available Languages: </span><a href="../en/programs/ctlogconfig.html" title="English"> en </a> |
<a href="../fr/programs/ctlogconfig.html" hreflang="fr" rel="alternate" title="Français"> fr </a></p>
</div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
<script type="text/javascript"><!--//--><![CDATA[//><!--
var comments_shortname = 'httpd';
var comments_identifier = 'http://httpd.apache.org/docs/trunk/programs/ctlogconfig.html';
(function(w, d) {
if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
d.write('<div id="comments_thread"><\/div>');
var s = d.createElement('script');
s.type = 'text/javascript';
s.async = true;
s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
(d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
}
else {
d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
}
})(window, document);
//--><!]]></script></div><div id="footer">
<p class="apache">Copyright 2018 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
if (typeof(prettyPrint) !== 'undefined') {
prettyPrint();
}
//--><!]]></script>
</body></html>
|
