removed experimental mod_tls. source, documenation and test cases

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1920744 13f79535-47bb-0310-9956-ffa450edef68

2 files changed, 0 insertions, 641 deletions

diff --git a/docs/manual/mod/allmodules.xml b/docs/manual/mod/allmodules.xml
index 0a9d8b752b..cb8b6fcad1 100644
--- a/docs/manual/mod/allmodules.xml
+++ b/docs/manual/mod/allmodules.xml
@@ -129,7 +129,6 @@
   <modulefile>mod_suexec.xml</modulefile>
   <modulefile>mod_syslog.xml</modulefile>
   <modulefile>mod_systemd.xml</modulefile>
-  <modulefile>mod_tls.xml</modulefile>
   <modulefile>mod_unique_id.xml</modulefile>
   <modulefile>mod_unixd.xml</modulefile>
   <modulefile>mod_userdir.xml</modulefile>
diff --git a/docs/manual/mod/mod_tls.xml b/docs/manual/mod/mod_tls.xml
deleted file mode 100644
index 8e88923482..0000000000
--- a/docs/manual/mod/mod_tls.xml
+++ /dev/null
@@ -1,640 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE modulesynopsis SYSTEM "../style/modulesynopsis.dtd">
-<?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
-<!-- $LastChangedRevision: 1895285 $ -->
-
-<!--
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements.  See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License.  You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
- -->
-
-<modulesynopsis metafile="mod_tls.xml.meta">
-
-    <name>mod_tls</name>
-    <description>TLS v1.2 and v1.3 implemented in memory-safe Rust via
-        the rustls library
-    </description>
-    <status>Experimental</status>
-    <sourcefile>mod_tls.c</sourcefile>
-    <identifier>tls_module</identifier>
-    <compatibility>Available in version 2.4.52 and later</compatibility>
-    <summary>
-        <p>
-            mod_tls is an alternative to <module>mod_ssl</module> for providing https to a server.
-            It's feature set is a subset, described in more detail below. It can
-            be used as a companion to <module>mod_ssl</module>, e.g. both modules can be loaded at
-            the same time.
-        </p><p>
-            mod_tls, being written in C, used the Rust implementation of TLS named
-            <a href="https://github.com/rustls/rustls">rustls</a> via its C interface
-            <a href="https://github.com/rustls/rustls-ffi">rustls-ffi</a>. This gives
-            <em>memory safe</em> cryptography and protocol handling at comparable
-            performance.
-        </p><p>
-            It can be configured for frontend and backend connections. The configuration
-            directive have been kept mostly similar to <module>mod_ssl</module> ones.
-        </p>
-    </summary>
-    <section id="vhost_context">
-        <title>TLS in a VirtualHost context</title>
-        <highlight language="config">
-Listen 443
-TLSEngine 443
-
-&lt;VirtualHost *:443>
-  ServerName example.net
-  TLSCertificate file_with_certificate.pem file_with_key.pem
-  ...
-&lt;/VirtualHost>
-        </highlight>
-        <p>
-            The above is a minimal configuration. Instead of enabling mod_tls
-            in every virtual host, the port for incoming TLS connections is
-            specified.
-        </p><p>
-            You cannot mix virtual hosts with <module>mod_ssl</module> and mod_tls on the same
-            port. It's either or. SNI and ALPN are supported. You may use several
-            virtual hosts on the same port and a mix of protocols like http/1.1
-            and h2.
-        </p>
-    </section>
-
-        <section id="comparison"><title>Feature Comparison with mod_ssl</title>
-        <p>
-            The table below gives a comparison of feature between
-            <module>mod_ssl</module> and mod_tls. If a feature of <module>mod_ssl</module> is no listed here,
-            it is not supported by mod_tls. The one difference, probably most relevant
-            is the lack for client certificate support in the current version of
-            mod_tls.
-        </p>
-            <table>
-                <tr><th>Feature</th><th>mod_ssl</th><th>mod_tls</th><th>Comment</th></tr>
-<tr><td>Frontend TLS</td><td>yes</td><td>yes</td><td></td></tr>
-<tr><td>Backend TLS</td><td>yes</td><td>yes</td><td></td></tr>
-<tr><td>TLS v1.3</td><td>yes*</td><td>yes</td><td>*)with recent OpenSSL</td></tr>
-<tr><td>TLS v1.2</td><td>yes</td><td>yes</td><td></td></tr>
-<tr><td>TLS v1.0</td><td>yes*</td><td>no</td><td>*)if enabled in OpenSSL</td></tr>
-<tr><td>SNI Virtual Hosts</td><td>yes</td><td>yes</td><td></td></tr>
-<tr><td>Client Certificates</td><td>yes</td><td>no</td><td></td></tr>
-<tr><td>Machine Certificates for Backend</td><td>yes</td><td>yes</td><td></td></tr>
-<tr><td>OCSP Stapling</td><td>yes</td><td>yes*</td><td>*)via <module>mod_md</module></td></tr>
-<tr><td>Backend OCSP check</td><td>yes</td><td>no*</td><td>*)stapling will be verified</td></tr>
-<tr><td>TLS version to allow</td><td>min-max</td><td>min</td><td></td></tr>
-<tr><td>TLS ciphers</td><td>exclusive list</td><td>preferred/suppressed</td><td></td></tr>
-<tr><td>TLS cipher ordering</td><td>client/server</td><td>client/server</td><td></td></tr>
-<tr><td>TLS sessions</td><td>yes</td><td>yes</td><td></td></tr>
-<tr><td>SNI strictness</td><td>default no</td><td>default yes</td><td></td></tr>
-<tr><td>Option EnvVars</td><td>exhaustive</td><td>limited*</td><td>*)see var list</td></tr>
-<tr><td>Option ExportCertData</td><td>client+server</td><td>server</td><td></td></tr>
-<tr><td>Backend CA</td><td>file/dir</td><td>file</td><td></td></tr>
-<tr><td>Revocation CRLs</td><td>yes</td><td>no</td><td></td></tr>
-<tr><td>TLS Renegotiation</td><td>yes*</td><td>no</td><td>*)in TLS v1.2</td></tr>
-<tr><td>Encrypted Cert Keys</td><td>yes</td><td>no</td><td></td></tr>
-            </table>
-        <p>
-    	</p>
-        </section>
-
-        <section id="protocols"><title>TLS Protocols</title>
-        <p>
-            mod_tls supports TLS protocol version 1.2 and 1.3. Should there ever be
-            a version 1.4 and <code>rustls</code> supports it, it will be available as well.
-        </p>
-        <p>
-            In mod_tls, you configure the <em>minimum</em> version to use, never the maximum:
-        </p>
-        <highlight language="config">
-TLSProtocol TLSv1.3+
-        </highlight>
-        <p>
-            This allows only version 1.3 and whatever may be its successor one day when talking
-            to your server or to a particular virtual host.
-    	</p>
-        </section>
-
-        <section id="ciphers"><title>TLS Ciphers</title>
-        <p>
-            The list of TLS ciphers supported in the <code>rustls</code> library,
-            can be found <a href="https://docs.rs/rustls/">here</a>. All TLS v1.3
-            ciphers are supported. For TLS v1.2, only ciphers that rustls considers
-            secure are available.
-        </p><p>
-            mod_tls supports the following names for TLS ciphers:
-        </p>
-        <ol>
-            <li>
-                The <a href="https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4">IANA assigned name</a>
-                which uses `_` to separate parts. Example: <code>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384</code>
-            </li>
-            <li>
-                The OpenSSL name, using `-` as separator (for 1.2). Example: <code>ECDHE-ECDSA-AES256-SHA384</code>.
-                Such names often appear in documentation. `mod_tls` defines them for all TLS v1.2 ciphers.
-                For TLS v1.3 ciphers, names starting with <code>TLS13_</code> are also supported.
-            </li>
-            <li>
-                The <a href="https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4">IANA assigned identifier</a>,
-                which is a 16-bit numeric value. Example: <code>0xc024</code>.
-                You can use this in configurations as <code>TLS_CIPHER_0xc024</code>.
-            </li>
-        </ol>
-        <p>
-            You can configure a preference for ciphers, which means they will be used
-            for clients that support them. If you do not configure a preference, <code>rustls</code>
-            will use the one that it considers best. This is recommended.
-        </p>
-        <p>
-            Should you nevertheless have the need to prefer one cipher over another, you
-            may configure it like this:
-        </p>
-        <highlight language="config">
-TLSCiphersPrefer ECDHE-ECDSA-AES256-SHA384
-# or several
-TLSCiphersPrefer ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305
-        </highlight>
-        <p>
-            If you name a cipher that is unknown, the configuration will fail.
-            If you name a cipher is not supported by <code>rustls</code> (or no
-            longer supported in an updated version of <code>rustls</code> for security
-            reasons), mod_tls will log a <code>WARNING</code>, but continue to work.
-    	</p>
-        <p>
-            A similar mechanism exists, if you want to disable a particular cipher:
-        </p>
-        <highlight language="config">
-TLSCipherSuppress ECDHE-ECDSA-AES256-SHA384
-        </highlight>
-        <p>
-            A suppressed cipher will not longer be used.
-            If you name a cipher that is unknown, the configuration will fail.
-            If you name a cipher is not supported by <code>rustls</code> (or no
-            longer supported in an updated version of <code>rustls</code> for security
-            reasons), mod_tls will log a <code>WARNING</code>, but continue to work.
-        </p>
-        </section>
-
-        <section id="vhosts"><title>Virtual Hosts</title>
-        <p>
-            mod_tls uses the SNI (Server Name Indicator) to select one of the
-            configured virtual hosts that match the port being served. Should
-            the client not provide an SNI, the <em>first</em> configured
-            virtual host will be selected. If the client <em>does</em> provide
-            an SNI (as all today's clients do), it <em>must</em> match one
-            virtual host (<directive module="core">ServerName</directive> or
-            <directive module="core">ServerAlias</directive>)
-            or the connection will fail.
-        </p>
-        <p>
-            As with <module>mod_ssl</module>, you may specify ciphers and protocol
-            versions for the base server (global) and/or individual virtual hosts
-            that are selected via SNI by the client.
-        </p>
-        <highlight language="config">
-Listen 443
-TLSEngine 443
-
-&lt;VirtualHost *:443>
-  ServerName example1.net
-  TLSCertificate example1-cert.pem
-  ...
-&lt;/VirtualHost>
-
-&lt;VirtualHost *:443>
-  ServerName example2.net
-  TLSCertificate example2-cert.pem
-  ...
-  TLSProtocol v1.3+
-&lt;/VirtualHost>
-        </highlight>
-        <p>
-            The example above show different TLS settings for virtual hosts on the
-            same port. This is supported. <code>example1</code> can be contacted via
-            all TLS versions and <code>example2</code> only allows v1.3 or later.
-    	</p>
-        </section>
-
-        <section id="ACME"><title>ACME Certificates</title>
-        <p>
-            ACME certificates via <module>mod_md</module> are supported, just as
-            for <module>mod_ssl</module>. A minimal configuration:
-        </p>
-        <highlight language="config">
-Listen 443
-TLSEngine 443
-MDomain example.net
-
-&lt;VirtualHost *:443>
-  ServerName example.net
-  ...
-&lt;/VirtualHost>
-        </highlight>
-        </section>
-
-        <section id="OCSP"><title>OCSP Stapling</title>
-        <p>
-            mod_tls has no own implementation to retrieve OCSP information for
-            a certificate. However, it will use such for Stapling if it is provided
-            by <module>mod_md</module>. See <module>mod_md</module>'s documentation
-            on how to enable this.
-        </p>
-        </section>
-
-        <section id="variables"><title>TLS Variables</title>
-        <p>
-            Via the directive <directive module="mod_tls">TLSOptions</directive>, several variables
-            are placed into the environment of requests and can be inspected, for
-            example in a CGI script.
-        </p>
-        <p>
-            The variable names are given by <module>mod_ssl</module>. Note that these
-            are only a subset of the many variables that <module>mod_ssl</module> exposes.
-    	</p>
-        <table>
-            <tr><th>Variable</th><th>TLSOption</th><th>Description</th></tr>
-            <tr><td>SSL_TLS_SNI</td><td>*</td><td>the server name indicator (SNI) send by the client</td></tr>
-            <tr><td>SSL_PROTOCOL</td><td>*</td><td>the TLS protocol negotiated</td></tr>
-            <tr><td>SSL_CIPHER</td><td>*</td><td>the name of the TLS cipher negotiated</td></tr>
-            <tr><td>SSL_VERSION_INTERFACE</td><td>StdEnvVars</td><td>the module version</td></tr>
-            <tr><td>SSL_VERSION_LIBRARY</td><td>StdEnvVars</td><td>the rustls-ffi version</td></tr>
-            <tr><td>SSL_SECURE_RENEG</td><td>StdEnvVars</td><td>always `false`</td></tr>
-            <tr><td>SSL_COMPRESS_METHOD</td><td>StdEnvVars</td><td>always `false`</td></tr>
-            <tr><td>SSL_CIPHER_EXPORT</td><td>StdEnvVars</td><td>always `false`</td></tr>
-            <tr><td>SSL_CLIENT_VERIFY</td><td>StdEnvVars</td><td>always `false`</td></tr>
-            <tr><td>SSL_SESSION_RESUMED</td><td>StdEnvVars</td><td>either `Resumed` if a known TLS session id was presented by the client or `Initial` otherwise</td></tr>
-            <tr><td>SSL_SERVER_CERT</td><td>ExportCertData</td><td>the selected server certificate in PEM format</td></tr>
-        </table>
-        <p>
-           The variable <code>SSL_SESSION_ID</code> is intentionally not supported as
-            it contains sensitive information.
-        </p>
-        </section>
-
-        <section id="certificates"><title>Client Certificates</title>
-        <p>
-            While <code>rustls</code> supports client certificates in principle, parts
-            of the infrastructure to make <em>use</em> of these in a server are not
-            offered.
-        </p>
-        <p>
-            Among these features are: revocation lists, inspection of certificate
-            extensions and the matched issuer chain for OCSP validation. Without these,
-            revocation of client certificates is not possible. Offering authentication
-            without revocation is not considered an option.
-        </p>
-        <p>
-            Work will continue on this and client certificate support may become
-            available in a future release.
-        </p>
-        </section>
-
-    <directivesynopsis>
-        <name>TLSEngine</name>
-        <description>defines on which address+port the module shall handle incoming connections.</description>
-        <syntax>TLSEngine [<em>address</em>:]<em>port</em></syntax>
-        <contextlist>
-            <context>server config</context>
-        </contextlist>
-        <usage>
-            <p>
-                This is set on a global level, not in individual <directive module="core"
-                type="section">VirtualHost</directive>s.
-                It will affect all <directive module="core" type="section">VirtualHost</directive>
-                that match the specified address/port.
-                You can use <directive>TLSEngine</directive> several times to use more than one address/port.
-            </p><p>
-            </p>
-            <example><title>Example</title>
-                <highlight language="config">
-                    TLSEngine 443
-                </highlight>
-            </example>
-            <p>
-                The example tells mod_tls to handle incoming connection on port 443 for
-                all listeners.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSCertificate</name>
-        <description>adds a certificate and key (PEM encoded) to a server/virtual host.</description>
-        <syntax>TLSCertificate <em>cert_file</em> [<em>key_file</em>]</syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-        </contextlist>
-        <usage>
-            <p>
-                If you do not specify a separate key file, the key is assumed to also be
-                found in the first file. You may add more than one certificate to a
-                server/virtual host. The first certificate suitable for a client is then chosen.
-            </p><p>
-                The path can be specified relative to the server root.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSProtocol</name>
-        <description>specifies the minimum version of the TLS protocol to use.</description>
-        <syntax>TLSProtocol <em>version</em>+</syntax>
-        <default>TLSProtocol v1.2+</default>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-        </contextlist>
-        <usage>
-            <p>
-                The default is `v1.2+`. Settings this to `v1.3+` would disable TLSv1.2.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSCiphersPrefer</name>
-        <description>defines ciphers that are preferred.</description>
-        <syntax>TLSCiphersPrefer <em>cipher(-list)</em></syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-        </contextlist>
-        <usage>
-            <p>
-                This will not disable any ciphers supported by `rustls`. If you
-                specify a cipher that is completely unknown, the configuration will
-                fail. If you specify a cipher that is known but not supported by `rustls`,
-                a warning will be logged but the server will continue.
-            </p><p>
-            </p>
-            <example><title>Example</title>
-                <highlight language="config">
-TLSCiphersPrefer ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305
-                </highlight>
-            </example>
-            <p>
-                The example gives 2 ciphers preference over others, in the
-                order they are mentioned.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSCiphersSuppress</name>
-        <description>defines ciphers that are not to be used.</description>
-        <syntax>TLSCiphersSuppress <em>cipher(-list)</em></syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-        </contextlist>
-        <usage>
-            <p>
-                This will not disable any unmentioned ciphers supported by `rustls`.
-                If you specify a cipher that is completely unknown, the configuration will fail.
-                If you specify a cipher that is known but not supported by `rustls`,
-                a warning will be logged but the server will continue.
-            </p><p>
-            </p>
-            <example><title>Example</title>
-                <highlight language="config">
-TLSCiphersSuppress ECDHE-ECDSA-CHACHA20-POLY1305
-                </highlight>
-            </example>
-            <p>
-                The example removes a cipher for use in connections.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSHonorClientOrder</name>
-        <description>determines if the order of ciphers supported by the client is honored</description>
-        <syntax>TLSHonorClientOrder on|off</syntax>
-        <default>TLSHonorClientOrder on</default>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-        </contextlist>
-        <usage>
-            <p>
-                <directive>TLSHonorClientOrder</directive> determines if the order of ciphers
-                supported by the client is honored.
-            </p><p>
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSOptions</name>
-        <description>enables SSL variables for requests.</description>
-        <syntax>TLSOptions [+|-]<em>option</em></syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-            <context>directory</context>
-            <context>.htaccess</context>
-        </contextlist>
-        <usage>
-            <p>
-                <directive>TLSOptions</directive> is analog to <directive
-                module="mod_ssl">SSLOptions</directive> in <module>mod_ssl</module>.
-                It can be set per directory/location and `option` can be:
-            </p>
-            <ul>
-                <li>`StdEnvVars`: adds more variables to the requests environment,
-                    as forwarded for example to CGI processing and other applications.
-                </li>
-                <li>`ExportCertData`: adds certificate related variables to the request environment.
-                </li>
-                <li>`Defaults`: resets all options to their default values.</li>
-            </ul>
-            <p>
-                Adding variables to a request environment adds overhead, especially
-                when certificates need to be inspected and fields extracted.
-                Therefore most variables are not set by default.
-            </p>
-            <p>
-                You can configure <directive>TLSOptions</directive> per location or generally on a
-                server/virtual host. Prefixing an option with `-` disables this
-                option while leaving others unchanged.
-                A `+` prefix is the same as writing the option without one.
-            </p>
-            <p>
-                The `Defaults` value can be used to reset any options that are
-                inherited from other locations or the virtual host/server.
-            </p>
-            <example><title>Example</title>
-                <highlight language="config">
-&lt;Location /myplace/app>
-  TLSOptions Defaults StdEnvVars
-  ...
-&lt;/Location>
-                </highlight>
-            </example>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSProxyEngine</name>
-        <description>enables TLS for backend connections.</description>
-        <syntax>TLSProxyEngine on|off</syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-            <context>proxy section</context>
-        </contextlist>
-        <usage>
-            <p>
-                <directive>TLSProxyEngine</directive> is analog to <directive
-                module="mod_ssl">SSLProxyEngine</directive> in <module>mod_ssl</module>.
-            </p><p>
-                This can be used in a server/virtual host or <directive module="mod_proxy"
-                type="section">Proxy</directive> section to
-                enable the module for outgoing connections using <module>mod_proxy</module>.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSProxyCA</name>
-        <description>sets the root certificates to validate the backend server with.</description>
-        <syntax>TLSProxyCA <em>file.pem</em></syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-            <context>proxy section</context>
-        </contextlist>
-        <usage>
-            <p>
-
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSProxyProtocol</name>
-        <description>specifies the minimum version of the TLS protocol to use in proxy connections.</description>
-        <syntax>TLSProxyProtocol <em>version</em>+</syntax>
-        <default>TLSProxyProtocol v1.2+</default>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-            <context>proxy section</context>
-        </contextlist>
-        <usage>
-            <p>
-                The default is `v1.2+`. Settings this to `v1.3+` would disable TLSv1.2.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSProxyCiphersPrefer</name>
-        <description>defines ciphers that are preferred for a proxy connection.</description>
-        <syntax>TLSProxyCiphersPrefer <em>cipher(-list)</em></syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-            <context>proxy section</context>
-        </contextlist>
-        <usage>
-            <p>
-                This will not disable any ciphers supported by `rustls`.
-                If you specify a cipher that is completely unknown, the configuration will fail.
-                If you specify a cipher that is known but not supported by `rustls`,
-                a warning will be logged but the server will continue.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSProxyCiphersSuppress</name>
-        <description>defines ciphers that are not to be used for a proxy connection.</description>
-        <syntax>TLSProxyCiphersSuppress <em>cipher(-list)</em></syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-            <context>proxy section</context>
-        </contextlist>
-        <usage>
-            <p>
-                This will not disable any unmentioned ciphers supported by `rustls`.
-                If you specify a cipher that is completely unknown, the configuration will fail.
-                If you specify a cipher that is known but not supported by `rustls`,
-                a warning will be logged but the server will continue.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSProxyMachineCertificate</name>
-        <description>adds a certificate and key file (PEM encoded) to a proxy setup.</description>
-        <syntax>TLSProxyMachineCertificate <em>cert_file</em> [<em>key_file</em>]</syntax>
-        <contextlist>
-            <context>server config</context>
-            <context>virtual host</context>
-            <context>proxy section</context>
-        </contextlist>
-        <usage>
-            <p>
-                The certificate is used to authenticate against a proxied backend server.
-            </p><p>
-                If you do not specify a separate key file, the key is assumed to also be
-                found in the first file. You may add more than one certificate to a proxy
-                setup. The first certificate suitable for a proxy connection to a backend
-                is then chosen by <code>rustls</code>.
-            </p>
-            <p>
-                The path can be specified relative to the server root.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSStrictSNI</name>
-        <description>enforces exact matches of client server indicators (SNI) against host names.</description>
-        <syntax>TLSStrictSNI on|off</syntax>
-        <default>TLSStrictSNI on</default>
-        <contextlist>
-            <context>server config</context>
-        </contextlist>
-        <usage>
-            <p>
-                Client connections using SNI will be unsuccessful if no match is found.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-    <directivesynopsis>
-        <name>TLSSessionCache</name>
-        <description>specifies the cache for TLS session resumption.</description>
-        <syntax>TLSSessionCache <em>cache-spec</em></syntax>
-        <contextlist>
-            <context>server config</context>
-        </contextlist>
-        <usage>
-            <p>
-                This uses a cache on the server side to allow clients to resume connections.
-            </p><p>
-            You can set this to `none` or define a cache as in the <directive
-            module="mod_ssl">SSLSessionCache</directive>
-            directive of <module>mod_ssl</module>.
-            </p><p>
-            If not configured, `mod_tls` will try to create a shared memory cache on its own,
-            using `shmcb:tls/session-cache` as specification.
-            Should that fail, a warning is logged, but the server continues.
-            </p>
-        </usage>
-    </directivesynopsis>
-
-</modulesynopsis>