diff options
| author | Kaspar Brand <kbrand@apache.org> | 2015-11-01 10:38:31 +0100 |
|---|---|---|
| committer | Kaspar Brand <kbrand@apache.org> | 2015-11-01 10:38:31 +0100 |
| commit | d3fd6650ad40a2fc9454007e8d2ca09f86754284 (patch) | |
| tree | c19805b84d95bad41686854e6c2d8d5f35c6cafb /docs/manual/mod/mod_ssl.xml | |
| parent | Follow up to r1709008: CHANGES entry. (diff) | |
| download | apache2-d3fd6650ad40a2fc9454007e8d2ca09f86754284.tar.xz apache2-d3fd6650ad40a2fc9454007e8d2ca09f86754284.zip | |
For the "SSLStaplingReturnResponderErrors off" case, make sure to only
staple responses with certificate status "good". Also avoids including
inaccurate responses when the OCSP responder is not completely up
to date in terms of the CA-issued certificates (and provides interim
"unknown" or "extended revoked" [RFC 6960] status replies).
Log a certificate status other than "good" in stapling_check_response().
Propagate the "ok" status from stapling_check_response() back via both
stapling_renew_response() and get_and_check_cached_response() to the
callback code in stapling_cb(), enabling the decision whether to include
or skip the response.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1711728 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'docs/manual/mod/mod_ssl.xml')
| -rw-r--r-- | docs/manual/mod/mod_ssl.xml | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index 9b43b4e438..553197dc79 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -2527,9 +2527,11 @@ used for controlling the timeout for invalid/unavailable responses. <usage> <p>When enabled, mod_ssl will pass responses from unsuccessful -stapling related OCSP queries (such as status errors, expired responses etc.) -on to the client. If set to <code>off</code>, no stapled responses -for failed queries will be included in the TLS handshake.</p> +stapling related OCSP queries (such as responses with an overall status +other than "successful", responses with a certificate status other than +"good", expired responses etc.) on to the client. +If set to <code>off</code>, only responses indicating a certificate status +of "good" will be included in the TLS handshake.</p> </usage> </directivesynopsis> |