Description:	Configure protocol preference for Application-Layer Protocol Negotiation (RFC 7301)
Syntax:	`SSLALPNPreference protocol-id ...`
Context:	server config, virtual host
Status:	Extension
Module:	mod_ssl
Compatibility:	Available if using OpenSSL 1.0.2 or later

SSLCACertificateFile Directive

- - - - - - - + - - - - - + + + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + - - + - - - + - - - - - - - - - - - - + + + + + + - - - + - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + - - - - + + + - - - - - - - - + + + + + + + - - + - - - - - - - - - + + + + + + + - - + - - + - - - - + + - - + - - - - - - - + + - - + - +

Description:	File of concatenated PEM-encoded CA Certificates @@ -795,8 +770,8 @@ prefixes are: `aNULL`, `eNULL` and `EXP` ciphers are always disabled Beginning with version 2.4.7, null and export-grade -ciphers are always disabled, as mod_ssl unconditionally prepends any supplied -cipher suite string with `!aNULL:!eNULL:!EXP:` at initialization. +ciphers are always disabled, as mod_ssl unconditionally adds +`!aNULL:!eNULL:!EXP` to any cipher string at initialization. A simpler way to look at all of this is to use the ```openssl ciphers @@ -1144,7 +1119,7 @@ features are added to OpenSSL.` depends on the OpenSSL version being used for mod_ssl (at least version 1.0.2 is required). For a list of supported command names, see the section Supported configuration file commands in the -SSL_CONF_cmd(3) manual page for OpenSSL. +SSL_CONF_cmd(3) manual page for OpenSSL. Some of the SSLOpenSSLConfCmd commands can be used as an alternative to existing directives (such as Modified: httpd/httpd/trunk/docs/manual/mod/quickreference.html.en URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/quickreference.html.en?rev=1702646&r1=1702645&r2=1702646&view=diff ============================================================================== --- httpd/httpd/trunk/docs/manual/mod/quickreference.html.en (original) +++ httpd/httpd/trunk/docs/manual/mod/quickreference.html.en Sat Sep 12 15:50:07 2015 @@ -989,160 +989,159 @@ server.
SSITimeFormat `formatstring`	"%A, %d-%b-%Y %H:%M +	svdh	B
Configures the format in which date strings are displayed
SSIUndefinedEcho `string`	"(none)"	svdh	B
String displayed when an unset variable is echoed
SSLALPNPreference protocol-id ...		sv	E
Configure protocol preference for Application-Layer Protocol Negotiation (RFC 7301)
SSLCACertificateFile file-path		sv	E
File of concatenated PEM-encoded CA Certificates +
SSLCACertificateFile file-path		sv	E
File of concatenated PEM-encoded CA Certificates for Client Auth
SSLCACertificatePath directory-path		sv	E
Directory of PEM-encoded CA Certificates for +
SSLCACertificatePath directory-path		sv	E
Directory of PEM-encoded CA Certificates for Client Auth
SSLCADNRequestFile file-path		sv	E
File of concatenated PEM-encoded CA Certificates +
SSLCADNRequestFile file-path		sv	E
File of concatenated PEM-encoded CA Certificates for defining acceptable CA names
SSLCADNRequestPath directory-path		sv	E
Directory of PEM-encoded CA Certificates for +
SSLCADNRequestPath directory-path		sv	E
Directory of PEM-encoded CA Certificates for defining acceptable CA names
SSLCARevocationCheck chain\|leaf\|none	none	sv	E
Enable CRL-based revocation checking
SSLCARevocationFile file-path		sv	E
File of concatenated PEM-encoded CA CRLs for +
SSLCARevocationCheck chain\|leaf\|none	none	sv	E
Enable CRL-based revocation checking
SSLCARevocationFile file-path		sv	E
File of concatenated PEM-encoded CA CRLs for Client Auth
SSLCARevocationPath directory-path		sv	E
Directory of PEM-encoded CA CRLs for +
SSLCARevocationPath directory-path		sv	E
Directory of PEM-encoded CA CRLs for Client Auth
SSLCertificateChainFile file-path		sv	E
File of PEM-encoded Server CA Certificates
SSLCertificateFile file-path		sv	E
Server PEM-encoded X.509 certificate data file
SSLCertificateKeyFile file-path		sv	E
Server PEM-encoded private key file
SSLCipherSuite cipher-spec	DEFAULT (depends on +	svdh	E
Cipher Suite available for negotiation in SSL +
SSLCertificateChainFile file-path		sv	E
File of PEM-encoded Server CA Certificates
SSLCertificateFile file-path		sv	E
Server PEM-encoded X.509 certificate data file
SSLCertificateKeyFile file-path		sv	E
Server PEM-encoded private key file
SSLCipherSuite cipher-spec	DEFAULT (depends on +	svdh	E
Cipher Suite available for negotiation in SSL handshake
SSLCompression on\|off	off	sv	E
Enable compression on the SSL level
SSLCryptoDevice engine	builtin	s	E
Enable use of a cryptographic hardware accelerator
SSLEngine on\|off\|optional	off	sv	E
SSL Engine Operation Switch
SSLFIPS on\|off	off	s	E
SSL FIPS mode Switch
SSLHonorCipherOrder on\|off	off	sv	E
Option to prefer the server's cipher preference order
SSLInsecureRenegotiation on\|off	off	sv	E
Option to enable support for insecure renegotiation
SSLOCSDefaultResponder uri		sv	E
Set the default responder URI for OCSP validation
SSLOCSPEnable on\|off	off	sv	E
Enable OCSP validation of the client certificate chain
SSLOCSPOverrideResponder on\|off	off	sv	E
Force use of the default responder URI for OCSP validation
SSLOCSPResponderTimeout seconds	10	sv	E
Timeout for OCSP queries
SSLOCSPResponseMaxAge seconds	-1	sv	E
Maximum allowable age for OCSP responses
SSLOCSPResponseTimeSkew seconds	300	sv	E
Maximum allowable time skew for OCSP response validation
SSLOCSPUseRequestNonce on\|off	on	sv	E
Use a nonce within OCSP queries
SSLOpenSSLConfCmd command-name command-value		sv	E
Configure OpenSSL parameters through its SSL_CONF API
SSLOptions [+\|-]option ...		svdh	E
Configure various SSL engine run-time options
SSLPassPhraseDialog type	builtin	s	E
Type of pass phrase dialog for encrypted private +
SSLCompression on\|off	off	sv	E
Enable compression on the SSL level
SSLCryptoDevice engine	builtin	s	E
Enable use of a cryptographic hardware accelerator
SSLEngine on\|off\|optional	off	sv	E
SSL Engine Operation Switch
SSLFIPS on\|off	off	s	E
SSL FIPS mode Switch
SSLHonorCipherOrder on\|off	off	sv	E
Option to prefer the server's cipher preference order
SSLInsecureRenegotiation on\|off	off	sv	E
Option to enable support for insecure renegotiation
SSLOCSDefaultResponder uri		sv	E
Set the default responder URI for OCSP validation
SSLOCSPEnable on\|off	off	sv	E
Enable OCSP validation of the client certificate chain
SSLOCSPOverrideResponder on\|off	off	sv	E
Force use of the default responder URI for OCSP validation
SSLOCSPResponderTimeout seconds	10	sv	E
Timeout for OCSP queries
SSLOCSPResponseMaxAge seconds	-1	sv	E
Maximum allowable age for OCSP responses
SSLOCSPResponseTimeSkew seconds	300	sv	E
Maximum allowable time skew for OCSP response validation
SSLOCSPUseRequestNonce on\|off	on	sv	E
Use a nonce within OCSP queries
SSLOpenSSLConfCmd command-name command-value		sv	E
Configure OpenSSL parameters through its SSL_CONF API
SSLOptions [+\|-]option ...		svdh	E
Configure various SSL engine run-time options
SSLPassPhraseDialog type	builtin	s	E
Type of pass phrase dialog for encrypted private keys
SSLProtocol [+\|-]protocol ...	all	sv	E
Configure usable SSL/TLS protocol versions
SSLProxyCACertificateFile file-path		sv	E
File of concatenated PEM-encoded CA Certificates +
SSLProtocol [+\|-]protocol ...	all	sv	E
Configure usable SSL/TLS protocol versions
SSLProxyCACertificateFile file-path		sv	E
File of concatenated PEM-encoded CA Certificates for Remote Server Auth
SSLProxyCACertificatePath directory-path		sv	E
Directory of PEM-encoded CA Certificates for +
SSLProxyCACertificatePath directory-path		sv	E
Directory of PEM-encoded CA Certificates for Remote Server Auth
SSLProxyCARevocationCheck chain\|leaf\|none	none	sv	E
Enable CRL-based revocation checking for Remote Server Auth
SSLProxyCARevocationFile file-path		sv	E
File of concatenated PEM-encoded CA CRLs for +
SSLProxyCARevocationCheck chain\|leaf\|none	none	sv	E
Enable CRL-based revocation checking for Remote Server Auth
SSLProxyCARevocationFile file-path		sv	E
File of concatenated PEM-encoded CA CRLs for Remote Server Auth
SSLProxyCARevocationPath directory-path		sv	E
Directory of PEM-encoded CA CRLs for +
SSLProxyCARevocationPath directory-path		sv	E
Directory of PEM-encoded CA CRLs for Remote Server Auth
SSLProxyCheckPeerCN on\|off	on	sv	E
Whether to check the remote server certificate's CN field +
SSLProxyCheckPeerCN on\|off	on	sv	E
Whether to check the remote server certificate's CN field
SSLProxyCheckPeerExpire on\|off	on	sv	E
Whether to check if remote server certificate is expired +
SSLProxyCheckPeerExpire on\|off	on	sv	E
Whether to check if remote server certificate is expired
SSLProxyCheckPeerName on\|off	on	sv	E
Configure host name checking for remote server certificates +
SSLProxyCheckPeerName on\|off	on	sv	E
Configure host name checking for remote server certificates
SSLProxyCipherSuite cipher-spec	ALL:!ADH:RC4+RSA:+H +	svdh	E
Cipher Suite available for negotiation in SSL +
SSLProxyCipherSuite cipher-spec	ALL:!ADH:RC4+RSA:+H +	svdh	E
Cipher Suite available for negotiation in SSL proxy handshake
SSLProxyEngine on\|off	off	sv	E
SSL Proxy Engine Operation Switch
SSLProxyMachineCertificateChainFile filename		s	E
File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate
SSLProxyMachineCertificateFile filename		s	E
File of concatenated PEM-encoded client certificates and keys to be used by the proxy
SSLProxyMachineCertificatePath directory		s	E
Directory of PEM-encoded client certificates and keys to be used by the proxy
SSLProxyProtocol [+\|-]protocol ...	all	sv	E
Configure usable SSL protocol flavors for proxy usage
SSLProxyVerify level	none	sv	E
Type of remote server Certificate verification
SSLProxyVerifyDepth number	1	sv	E
Maximum depth of CA Certificates in Remote Server +
SSLProxyEngine on\|off	off	sv	E
SSL Proxy Engine Operation Switch
SSLProxyMachineCertificateChainFile filename		s	E
File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate
SSLProxyMachineCertificateFile filename		s	E
File of concatenated PEM-encoded client certificates and keys to be used by the proxy
SSLProxyMachineCertificatePath directory		s	E
Directory of PEM-encoded client certificates and keys to be used by the proxy
SSLProxyProtocol [+\|-]protocol ...	all	sv	E
Configure usable SSL protocol flavors for proxy usage
SSLProxyVerify level	none	sv	E
Type of remote server Certificate verification
SSLProxyVerifyDepth number	1	sv	E
Maximum depth of CA Certificates in Remote Server Certificate verification
SSLRandomSeed context source -[bytes]		s	E
Pseudo Random Number Generator (PRNG) seeding +
SSLRandomSeed context source +[bytes]		s	E
Pseudo Random Number Generator (PRNG) seeding source
SSLRenegBufferSize `bytes`	131072	dh	E
Set the size for the SSL renegotiation buffer
SSLRequire expression		dh	E
Allow access only when an arbitrarily complex +
SSLRenegBufferSize `bytes`	131072	dh	E
Set the size for the SSL renegotiation buffer
SSLRequire expression		dh	E
Allow access only when an arbitrarily complex boolean expression is true
SSLRequireSSL		dh	E
Deny access when SSL is not used for the +
SSLRequireSSL		dh	E
Deny access when SSL is not used for the HTTP request
SSLSessionCache type	none	s	E
Type of the global/inter-process SSL Session +
SSLSessionCache type	none	s	E
Type of the global/inter-process SSL Session Cache
SSLSessionCacheTimeout seconds	300	sv	E
Number of seconds before an SSL session expires +
SSLSessionCacheTimeout seconds	300	sv	E
Number of seconds before an SSL session expires in the Session Cache
SSLSessionTicketKeyFile file-path		sv	E
Persistent encryption/decryption key for TLS session tickets
SSLSessionTickets on\|off	on	sv	E
Enable or disable use of TLS session tickets
SSLSRPUnknownUserSeed secret-string		sv	E
SRP unknown user seed
SSLSRPVerifierFile file-path		sv	E
Path to SRP verifier file
SSLStaplingCache type		s	E
Configures the OCSP stapling cache
SSLStaplingErrorCacheTimeout seconds	600	sv	E
Number of seconds before expiring invalid responses in the OCSP stapling cache
SSLStaplingFakeTryLater on\|off	on	sv	E
Synthesize "tryLater" responses for failed OCSP stapling queries
SSLStaplingForceURL uri		sv	E
Override the OCSP responder URI specified in the certificate's AIA extension
SSLStaplingResponderTimeout seconds	10	sv	E
Timeout for OCSP stapling queries
SSLStaplingResponseMaxAge seconds	-1	sv	E
Maximum allowable age for OCSP stapling responses
SSLStaplingResponseTimeSkew seconds	300	sv	E
Maximum allowable time skew for OCSP stapling response validation
SSLStaplingReturnResponderErrors on\|off	on	sv	E
Pass stapling related OCSP errors on to client
SSLStaplingStandardCacheTimeout seconds	3600	sv	E
Number of seconds before expiring responses in the OCSP stapling cache
SSLStrictSNIVHostCheck on\|off	off	sv	E
Whether to allow non-SNI clients to access a name-based virtual +
SSLSessionTicketKeyFile file-path		sv	E
Persistent encryption/decryption key for TLS session tickets
SSLSessionTickets on\|off	on	sv	E
Enable or disable use of TLS session tickets
SSLSRPUnknownUserSeed secret-string		sv	E
SRP unknown user seed
SSLSRPVerifierFile file-path		sv	E
Path to SRP verifier file
SSLStaplingCache type		s	E
Configures the OCSP stapling cache
SSLStaplingErrorCacheTimeout seconds	600	sv	E
Number of seconds before expiring invalid responses in the OCSP stapling cache
SSLStaplingFakeTryLater on\|off	on	sv	E
Synthesize "tryLater" responses for failed OCSP stapling queries
SSLStaplingForceURL uri		sv	E
Override the OCSP responder URI specified in the certificate's AIA extension
SSLStaplingResponderTimeout seconds	10	sv	E
Timeout for OCSP stapling queries
SSLStaplingResponseMaxAge seconds	-1	sv	E
Maximum allowable age for OCSP stapling responses
SSLStaplingResponseTimeSkew seconds	300	sv	E
Maximum allowable time skew for OCSP stapling response validation
SSLStaplingReturnResponderErrors on\|off	on	sv	E
Pass stapling related OCSP errors on to client
SSLStaplingStandardCacheTimeout seconds	3600	sv	E
Number of seconds before expiring responses in the OCSP stapling cache
SSLStrictSNIVHostCheck on\|off	off	sv	E
Whether to allow non-SNI clients to access a name-based virtual host.
SSLUserName varname		sdh	E
Variable name to determine user name
SSLUseStapling on\|off	off	sv	E
Enable stapling of OCSP responses in the TLS handshake
SSLVerifyClient level	none	svdh	E
Type of Client Certificate verification
SSLVerifyDepth number	1	svdh	E
Maximum depth of CA Certificates in Client +
SSLUserName varname		sdh	E
Variable name to determine user name
SSLUseStapling on\|off	off	sv	E
Enable stapling of OCSP responses in the TLS handshake
SSLVerifyClient level	none	svdh	E
Type of Client Certificate verification
SSLVerifyDepth number	1	svdh	E
Maximum depth of CA Certificates in Client Certificate verification
StartServers `number`		s	M
Number of child server processes created at startup
StartThreads `number`		s	M
Number of threads created on startup
Substitute `s/pattern/substitution/[infq]`		dh	E
Pattern to filter the response content
SubstituteInheritBefore on\|off	on	dh	E
Change the merge order of inherited patterns
SubstituteMaxLineLength `bytes`(b\|B\|k\|K\|m\|M\|g\|G)	1m	dh	E
Set the maximum line size
Suexec On\|Off		s	B
Enable or disable the suEXEC feature
SuexecUserGroup User Group		sv	E
User and group for CGI programs to run as
ThreadLimit `number`		s	M
Sets the upper limit on the configurable number of threads +
StartServers `number`		s	M
Number of child server processes created at startup
StartThreads `number`		s	M
Number of threads created on startup
Substitute `s/pattern/substitution/[infq]`		dh	E
Pattern to filter the response content
SubstituteInheritBefore on\|off	on	dh	E
Change the merge order of inherited patterns
SubstituteMaxLineLength `bytes`(b\|B\|k\|K\|m\|M\|g\|G)	1m	dh	E
Set the maximum line size
Suexec On\|Off		s	B
Enable or disable the suEXEC feature
SuexecUserGroup User Group		sv	E
User and group for CGI programs to run as
ThreadLimit `number`		s	M
Sets the upper limit on the configurable number of threads per child process
ThreadsPerChild `number`		s	M
Number of threads created by each child process
ThreadStackSize `size`		s	M
The size in bytes of the stack used by threads handling +
ThreadsPerChild `number`		s	M
Number of threads created by each child process
ThreadStackSize `size`		s	M
The size in bytes of the stack used by threads handling client connections
TimeOut `seconds`	60	sv	C
Amount of time the server will wait for +
TimeOut `seconds`	60	sv	C
Amount of time the server will wait for certain events before failing a request
TraceEnable `[on\|off\|extended]`	on	sv	C
Determines the behavior on `TRACE` requests
TransferLog `file`\|`pipe`		sv	B
Specify location of a log file
TypesConfig `file-path`	conf/mime.types	s	B
The location of the `mime.types` file
UnDefine `parameter-name`		sv	C
Undefine the existence of a variable
UndefMacro `name`		svd	B
Undefine a macro
UnsetEnv `env-variable` [`env-variable`] -...		svdh	B
Removes variables from the environment
Use `name` [`value1` ... `valueN`] -		svd	B
Use a macro
UseCanonicalName On\|Off\|DNS	Off	svd	C
Configures how the server determines its own name and +
TraceEnable `[on\|off\|extended]`	on	sv	C
Determines the behavior on `TRACE` requests
TransferLog `file`\|`pipe`		sv	B
Specify location of a log file
TypesConfig `file-path`	conf/mime.types	s	B
The location of the `mime.types` file
UnDefine `parameter-name`		sv	C
Undefine the existence of a variable
UndefMacro `name`		svd	B
Undefine a macro
UnsetEnv `env-variable` [`env-variable`] +...		svdh	B
Removes variables from the environment
Use `name` [`value1` ... `valueN`] +		svd	B
Use a macro
UseCanonicalName On\|Off\|DNS	Off	svd	C
Configures how the server determines its own name and port
UseCanonicalPhysicalPort On\|Off	Off	svd	C
Configures how the server determines its own port
User `unix-userid`	#-1	s	B
The userid under which the server will answer +
UseCanonicalPhysicalPort On\|Off	Off	svd	C
Configures how the server determines its own port
User `unix-userid`	#-1	s	B
The userid under which the server will answer requests
UserDir directory-filename [directory-filename] ... -		sv	B
Location of the user-specific directories
VHostCGIMode On\|Off\|Secure	On	v	X
Determines whether the virtualhost can run +
UserDir directory-filename [directory-filename] ... +		sv	B
Location of the user-specific directories
VHostCGIMode On\|Off\|Secure	On	v	X
Determines whether the virtualhost can run subprocesses, and the privileges available to subprocesses.
VHostPrivs [+-]?`privilege-name` [[+-]?privilege-name] ...		v	X
Assign arbitrary privileges to subprocesses created +
VHostPrivs [+-]?`privilege-name` [[+-]?privilege-name] ...		v	X
Assign arbitrary privileges to subprocesses created by a virtual host.
VHostGroup `unix-groupid`		v	X
Sets the Group ID under which a virtual host runs.
VHostPrivs [+-]?`privilege-name` [[+-]?privilege-name] ...		v	X
Assign arbitrary privileges to a virtual host.
VHostSecure On\|Off	On	v	X
Determines whether the server runs with enhanced security +
VHostGroup `unix-groupid`		v	X
Sets the Group ID under which a virtual host runs.
VHostPrivs [+-]?`privilege-name` [[+-]?privilege-name] ...		v	X
Assign arbitrary privileges to a virtual host.
VHostSecure On\|Off	On	v	X
Determines whether the server runs with enhanced security for the virtualhost.
VHostUser `unix-userid`		v	X
Sets the User ID under which a virtual host runs.
VirtualDocumentRoot interpolated-directory\|none	none	sv	E
Dynamically configure the location of the document root +
VHostUser `unix-userid`		v	X
Sets the User ID under which a virtual host runs.
VirtualDocumentRoot interpolated-directory\|none	none	sv	E
Dynamically configure the location of the document root for a given virtual host
VirtualDocumentRootIP interpolated-directory\|none	none	sv	E
Dynamically configure the location of the document root +
VirtualDocumentRootIP interpolated-directory\|none	none	sv	E
Dynamically configure the location of the document root for a given virtual host
<VirtualHost +
<VirtualHost `addr`[:`port`] [`addr`[:`port`]] - ...> ... </VirtualHost>		s	C
Contains directives that apply only to a specific + ...> ... </VirtualHost>				s	C
Contains directives that apply only to a specific hostname or IP address
VirtualScriptAlias interpolated-directory\|none	none	sv	E
Dynamically configure the location of the CGI directory for +
VirtualScriptAlias interpolated-directory\|none	none	sv	E
Dynamically configure the location of the CGI directory for a given virtual host
VirtualScriptAliasIP interpolated-directory\|none	none	sv	E
Dynamically configure the location of the CGI directory for +
VirtualScriptAliasIP interpolated-directory\|none	none	sv	E
Dynamically configure the location of the CGI directory for a given virtual host
Warning `message`		svdh	C
Warn from configuration parsing with a custom message
WatchdogInterval `number-of-seconds`	1	s	B
Watchdog interval in seconds
XBitHack on\|off\|full	off	svdh	B
Parse SSI directives in files with the execute bit +
Warning `message`		svdh	C
Warn from configuration parsing with a custom message
WatchdogInterval `number-of-seconds`	1	s	B
Watchdog interval in seconds
XBitHack on\|off\|full	off	svdh	B
Parse SSI directives in files with the execute bit set
xml2EncAlias `charset alias [alias ...]`		s	B
Recognise Aliases for encoding values
xml2EncDefault `name`		svdh	B
Sets a default encoding to assume when absolutely no information +
xml2EncAlias `charset alias [alias ...]`		s	B
Recognise Aliases for encoding values
xml2EncDefault `name`		svdh	B
Sets a default encoding to assume when absolutely no information can be automatically detected
xml2StartParse `element [element ...]`		svdh	B
Advise the parser to skip leading junk.
xml2StartParse `element [element ...]`		svdh	B
Advise the parser to skip leading junk.

Directives

SSLALPNPreference Directive

Examples

SSLCACertificateFile Directive

`aNULL`, `eNULL` and `EXP` ciphers are always disabled

Directives

SSLALPNPreference Directive

Examples

SSLCACertificateFile Directive

aNULL, eNULL and EXP ciphers are always disabled

`aNULL`, `eNULL` and `EXP` ciphers are always disabled