Mailing-List: contact docs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: docs@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of i.galic@brainsware.org
 designates 188.40.115.121 as permitted sender)
Date: Mon, 10 Jan 2011 16:37:32 +0000 (UTC)
From: =?utf-8?Q?Igor_Gali=C4=87?= <i.galic@brainsware.org>
To: docs@httpd.apache.org
Message-ID: <254583916.7612.1294677452150.JavaMail.root@iris>
In-Reply-To: <471621995.7610.1294677238986.JavaMail.root@iris>
Subject: Re: mod_ssl and SSL how-to
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


----- "Lucien Gentis" <lucien.gentis@lorraine.iufm.fr> wrote:

> Hello,
>=20
> I think a good start point could be the file conf/extra/httpd-ssl.conf
> from install directory.

Yesno..

Aside from being too much (comments) and too long, it also has hints like


#   See the mod_ssl documentation for a complete list.

Which in case of SSLCipherSuite just isn't true.
We cannot provide a complete list of SSLCipherSuites -- they highly depend
on your installation, on the moon-phase, the version of your SSL library,
what animal you sacrificed to Dionysus and how you mismanaged to compile
mod_ssl against that.

> All necessary directives are there with comments.

And some more. Which are unnecessary, or which should have sane defaults.
In some cases the (sane) defaults are reproduced. Which again seems
unnecessary.

I think the .conf files are the wrong place to put this kind of
documentation

> Le 9 janv. 2011 =C3=A0 22:10, Rich Bowen a =C3=A9crit :
>=20
> > Yes that is kind of the obvious thing to have in there.
> >=20
> > --
> > Rich Bowen
> >=20
> > On Jan 9, 2011, at 3:07 PM, Eric Covener <covener@gmail.com> wrote:
> >=20
> >> It's kind of interesting that neither of these documents tells you
> how
> >> to setup a basic SSL-speaking virtual host.
> >>=20
> >> e.g.
> >>=20
> >> * create a self-signed certificate or certificate request
> >> * add a listen directive
> >> * add a VH *:443
> >> * add cert-related directives
> >> * passphrase stuff
> >>=20
> >> Any reason not to kick-off the Howto with this or am I missing
> something?

I think we need to cover the other FAQ as well: How to do client
certificate authnz.

I suggest we do just that: Start a wiki page, and give it three or
so weeks to mature.. then have it reviewed and replace the current
SSL HOWTOs.

As for extras/httpd-ssl.conf.in ... I suppose someone from dev@
will have their say as well..


i

--=20
Igor Gali=C4=87

Tel: +43 (0) 664 886 22 883
Mail: i.galic@brainsware.org
URL: http://brainsware.org/

---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org