summaryrefslogtreecommitdiffstats
path: root/docs
Commit message (Collapse)AuthorAgeFilesLines
* Check filesystem permissions on NSS database at startupRob Crittenden2016-03-011-0/+12
| | | | | | | | | | | | | See if the configured user has read access to the NSS database during initialization so the server can gracefully shutdown rather than ending up in a forking loop because the database is owned by root and is therefore unreadable once Apache starts forking. Adds a new configuration option, NSSSkipPermissionCheck <on/off>, to skip this check in case something goes wrong. https://fedorahosted.org/mod_nss/ticket/3
* Add server support for DHE ciphersChristian Heimes2016-02-291-1/+39
| | | | | | | | Similar patch was provided by Vitezslav Cizek <vcizek@suse.com> Heavily modified by Rob Crittenden <rcritten@redhat.com> https://fedorahosted.org/mod_nss/ticket/15
* Cleanup to remove a slew of trailing whitespaceRob Crittenden2015-10-021-1/+1
|
* Add support for Server Name Indication (SNI)Rob Crittenden2015-10-021-1/+27
| | | | | | | | Uses a hash table to pair up server names and nicknames and a lookup is done during the handshake to determine which nickname to be used, and therefore which VirtualHost. Based heavily on patch from Stanislav Tokos <stokos@suse.de>
* Add 'v' to refererences of protocols (e.g. SSLv3)Matthew Harmsen2015-07-291-7/+8
| | | | BZ #1066236
* Add support for TLS Session Tickets (RFC 5077)Rob Crittenden2015-06-111-0/+9
| | | | | | New server/vhost config option, NSSSessionTickets, to enable or disable TLS Session Tickets support. This is off by default in NSS.
* Add RenegBufferSize optionRob Crittenden2015-06-101-0/+15
| | | | | | | Control the buffer size used on a POST when SSL renegotiation is being done. The default is 128K. Resolves BZ 1214366
* Add compatibility for mod_ssl-style cipher definitionsRob Crittenden2014-12-021-117/+200
| | | | | | | | - Add Camelia ciphers - Remove Fortezza ciphers - Add TLSv1.2-specific ciphers Resolves BZ: #862938
* Completely remove support for SSLv2Rob Crittenden2014-11-121-59/+2
|
* Add support for sqlite NSS databasesRob Crittenden2014-10-281-2/+11
| | | | | | | | | | | | We do a chdir() to the NSS database location so that libnssckbi.so is available when the database is opened. Strip off a sql: prefix if one is available. This allows the new sqlite format to work. Add an additional test pass configuring NSS using the sqlite format. This requires a bit of a hack to pass in the value to python but it will work for now. Resolves: #1057650
* Don't enable SSL 3 by defaultRob Crittenden2014-10-161-2/+2
| | | | | | This is in response to the POODLE CVE CVE-2014-3566 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
* Add support for enabling TLS v1.2Rob Crittenden2014-10-161-48/+49
| | | | | If support is available in NSS then it is just a matter of including TLS 1.2 in the protocol range.
* Document sample mod_nss use cases, including FIPS.Rob Crittenden2014-02-211-2/+297
| | | | | | Matthew Harmsen <mharmsen@redhat.com> Resolvds #1036940
* Documentation formatting fixesTomas Hoger2014-02-211-104/+100
| | | | | | | - correct few cases of <code> used on text that should use normal font - strip some redundant html tags - use <pre> for larger command output blocks - correct few typos
* Add support for TLS v1.1, protocol ranges.Rob Crittenden2014-02-211-47/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | Set protocol version ranges: (1) Set the minimum protocol accepted (2) Set the maximum protocol accepted (3) Protocol ranges extend from maximum down to minimum protocol (4) All protocol ranges are completely inclusive; no protocol in the middle of a range may be excluded (5) NSS automatically negotiates the use of the strongest protocol for a connection starting with the maximum specified protocol and downgrading as necessary to the minimum specified protocol For example, if SSL 3.0 is chosen as the minimum protocol, and TLS 1.1 is chosen as the maximum protocol, SSL 3.0, TLS 1.0, and TLS 1.1 will all be accepted as protocols, as TLS 1.0 will not and cannot be excluded from this range. NSS will automatically negotiate to utilize the strongest acceptable protocol for a connection starting with the maximum specified protocol and downgrading as necessary to the minimum specified protocol (TLS 1.1 -> TLS 1.0 -> SSL 3.0). BZ 816394
* Compare CN value of remote host with requested host in reverse proxy.rcritten2010-05-131-38/+19
| | | | | | Add configuration option to disable this, defaulting to on. 591224
* Add information about ECC including required versions of NSPR and NSSrcritten2006-09-051-6/+222
| | | | | | | | and the available ciphers. Clarify starting up Apache without requiring user intervention. Fix a few bad links to NSPR.
* Add support for seeding the NSS Random Number Generator. This addsrcritten2005-10-031-1/+29
| | | | | a new directive, NSSRandomSeed based on the mod_ssl SSLRandomSeed directive.
* Add proxy support to mod_nss. Most of the changes are related torcritten2005-09-291-36/+138
| | | | | | adding new configuration directives. For the others we need to initialize an NSS socket differently whether we will be acting as a client or a server.
* Add missing copyright blockrcritten2005-09-161-0/+14
|
* Make SSL2 an optional protocol, disabled by default.rcritten2005-09-131-20/+25
|
* Update to reflect changes to the NSSFIPS directivercritten2005-09-081-2/+13
|
* Add OCSP supportrcritten2005-09-061-1/+17
|
* Add a FIPS configuration option. This enables the FIPS internalrcritten2005-08-191-0/+11
| | | | | database module, configures for SSLv3 and TLSv1 and enables the 2 FIPS ciphers (and disables all the others).
* Added Database Management section.rcritten2005-08-031-9/+150
| | | | Added links to NSS and NSPR
* Reflect new Directive naming conventionrcritten2005-06-071-45/+69
|
* Basic documentation on the mod_nss module.rcritten2005-06-031-0/+908
generated by cgit (git 2.34.1) at 2024-05-24 01:45:10 +0000