Changeset b888e8b in mod_gnutls for doc/mod_gnutls_manual.mdwn

Timestamp:

Nov 1, 2016, 7:20:42 AM (4 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

b26a792

Parents:

b34a67e

git-author:

Thomas Klute <thomas2.klute@…> (10/31/16 19:42:11)

git-committer:

Thomas Klute <thomas2.klute@…> (11/01/16 07:20:42)

Message:

New directive GnuTLSOCSPCheckNonce

Some CAs refuse to send nonces in their OCSP responses, probably
because that way they can cache responses. This makes nonce
verification fail, so give the user an option disable it.

File:

• doc/mod_gnutls_manual.mdwn (modified) (1 diff)

doc/mod_gnutls_manual.mdwn

@@ -553 +553 @@
 
 OCSP cache updates are serialized using the `gnutls-ocsp` mutex.
+
+### GnuTLSOCSPCheckNonce
+
+Check the nonce in OCSP responses?
+
+    GnuTLSOCSPCheckNonce [On|Off]
+
+Default: *on*\
+Context: server config, virtual host
+
+Some CAs refuse to send nonces in their OCSP responses, probably
+because that way they can cache responses. If your CA is one of them
+you can use this flag to disable nonce verification. Note that
+`mod_gnutls` will _send_ a nonce either way.
 
 ### GnuTLSOCSPResponseFile