Changeset d8ae2a0 in mod_gnutls for docs

Timestamp:

Mar 19, 2015, 9:30:18 AM (8 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, main, master, proxy-ticket, upstream

Children:

6bbc00a

Parents:

91ccb87

Message:

Documentation for proxy TLS configuration directives

Add documentation for the new configuration directives introduced in
commit 0de1839d444092a3d46ebae49572c54b1982f629, and add the generated
documentation files to .gitignore.

File:

• docs/mod_gnutls_manual.mdwn (modified) (1 diff)

docs/mod_gnutls_manual.mdwn

@@ -395 +395 @@
 With GnuTLSExportCertificates enabled, `mod_gnutls` exports the same
 environment variables to the CGI process as `mod_ssl`.
+
+
+`SSLProxyEngine`
+--------------
+
+Enable TLS proxy connections for this virtual host
+
+    SSLProxyEngine [on|off]
+
+Default: *off*\
+Context: virtual host
+
+This directive enables support for TLS proxy connections for a virtual
+host.
+
+`GnuTLSProxyCAFile`
+--------------------
+
+Set to the PEM Encoded Certificate Authority Certificate
+
+    GnuTLSProxyCAFile FILEPATH
+
+Default: *none*\
+Context: server config, virtual host
+
+Takes an absolute or relative path to a PEM Encoded Certificate to use
+as a Certificate Authority when verifying certificates provided by
+proxy back end servers. This file may contain a list of trusted
+authorities. If not set, verification of TLS back end servers will
+always fail due to lack of a trusted CA.
+
+`GnuTLSProxyCertificateFile`
+-----------------------
+
+Set to the PEM Encoded Client Certificate
+
+    GnuTLSProxyCertificateFile FILEPATH
+
+Default: *none*\
+Context: server config, virtual host
+
+Takes an absolute or relative path to a PEM-encoded X.509 certificate
+to use as this Server's End Entity (EE) client certificate for TLS
+client authentication in proxy TLS connections. If you need to supply
+certificates for intermediate Certificate Authorities (iCAs), they
+should be listed in sequence in the file, from EE to the iCA closest
+to the root CA. Optionally, you can also include the root CA's
+certificate as the last certificate in the list.
+
+If not set, TLS client authentication will be disabled for TLS proxy
+connections. If set, `GnuTLSProxyKeyFile` must be set as well to
+provide the matching private key.
+
+`GnuTLSProxyKeyFile`
+---------------
+
+Set to the PEM Encoded Private Key
+
+    GnuTLSProxyKeyFile FILEPATH
+
+Default: *none*\
+Context: server config, virtual host
+
+Takes an absolute or relative path to the Private Key matching the
+certificate configured using the `GnuTLSProxyCertificateFile`
+directive. This key cannot currently be password protected.
+
+**Security Warning:**\
+This private key must be protected. It is read while Apache is still
+running as root, and does not need to be readable by the nobody or
+apache user.
 
 * * * * *