From bb0f6cad431aa8dfd6ec6dbc73a90f40ee85aaff Mon Sep 17 00:00:00 2001 From: rcritten <> Date: Tue, 5 Sep 2006 14:58:56 +0000 Subject: Add information about ECC including required versions of NSPR and NSS and the available ciphers. Clarify starting up Apache without requiring user intervention. Fix a few bad links to NSPR. --- docs/mod_nss.html | 228 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 222 insertions(+), 6 deletions(-) diff --git a/docs/mod_nss.html b/docs/mod_nss.html index 71d1ada..75d6162 100644 --- a/docs/mod_nss.html +++ b/docs/mod_nss.html @@ -50,7 +50,8 @@ calls instead.

Building

Refer to the README file included with the distribution.

-To build you'll need NSPR 4.4.1 or above and NSPR +4.4.1 or above and NSS 3.9.2 or above. It may work with earlier versions but these are recommended (or @@ -60,9 +61,15 @@ installed in the same parent directory (e.g. /opt/nspr, /usr/local/nspr, etc). It will look in this parent for include/ and lib/, etc.

+To build with ECC support you need NSPR 4.6.2 or higher +and NSS +3.11.2 or higher.
+
You will also need the NSS and NSPR directories in your library search + href="http://www.mozilla.org/projects/nspr/">NSPR directories in +your library search path (either /etc/ld.so.conf or LD_LIBRARY_PATH) to link and run the module.

@@ -134,6 +141,19 @@ of the Apache you want to install the module into.
tells us where the APR include files and libraries are located
+ + --enable-ssl2
+ + SSLv2 is disabled by default.
+ + + + --enable-ecc
+ + Enable Elliptical Curve +Cryptography. Disabled by default.
+ +
@@ -232,6 +252,22 @@ If you have additional hardware tokens you will be prompted for each token password.

All other output will be written to the Apache log files.
+
+To avoid  being prompted for a startup password you can either:
+ +
% +modutil -dbdir /path/to/database/directory -changepw "NSS Certificate +DB"
+
+Enter the old password then press Enter twice for the new password to +blank it out.
+

Migration

A perl script, migrate,pl, is included to help migrate an existing mod_ssl configuration to work with mod_nss. There is one @@ -331,6 +367,22 @@ This directive specifies a path, not a filename.

NSSCertificateDatabase /etc/httpd/conf/nss

+NSSDBPrefix
+
+Normally a certificate database consists of 3 files: cert8.db, key3.db +and secmod.db. This directive allows you to add a named prefix to the +filenames of cert8.db and key3.db so you can store multiple databases +in one directory.
+
+Example
+
+NSSDBPrefix my-prefix-
+
+You would then need: my-prefix-cert8.db, my-prefix-key3.db and secmod.db
+
+In order to work with files with a prefix using the NSS command-line +tools use the -P flag.
+
NSSSessionCacheSize

Specifies the number of SSL sessions that can be cached.
@@ -386,7 +438,7 @@ not a particularly strong source of entropy. If the number of bytes to read is specified it just reads that amount. Be aware that some operating systems block on /dev/random if not enough entropy is available. This means that the server will wait until that -data is available to continue startup. These systems generally offer a +/data is available to continue startup. These systems generally offer a non-blocking device as well, /dev/urandom.
  • exec:/path/to/program: Executes the given program and takes the stdout of it as the entryop. If the bytes argument is included it @@ -459,7 +511,7 @@ enabled because
    Available ciphers are:

    - @@ -630,6 +682,147 @@ definition

    +Additionally there are a number of ECC ciphers:
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cipher Name
    +     		NSS Cipher +Definition
    +     		Protocol
    +
    ecdh_ecdsa_null_shaTLS_ECDH_ECDSA_WITH_NULL_SHATLSv1
    ecdh_ecdsa_rc4_128_shaTLS_ECDH_ECDSA_WITH_RC4_128_SHATLSv1
    ecdh_ecdsa_3des_shaTLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHATLSv1
    ecdh_ecdsa_aes_128_shaTLS_ECDH_ECDSA_WITH_AES_128_CBC_SHATLSv1
    ecdh_ecdsa_aes_256_shaTLS_ECDH_ECDSA_WITH_AES_256_CBC_SHATLSv1
    ecdhe_ecdsa_null_shaTLS_ECDHE_ECDSA_WITH_NULL_SHATLSv1
    ecdhe_ecdsa_rc4_128_shaTLS_ECDHE_ECDSA_WITH_RC4_128_SHATLSv1
    ecdhe_ecdsa_3des_shaTLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHATLSv1
    ecdhe_ecdsa_aes_128_shaTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHATLSv1
    ecdhe_ecdsa_aes_256_shaTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHATLSv1
    ecdh_rsa_null_shaTLS_ECDH_RSA_WITH_NULL_SHATLSv1
    ecdh_rsa_128_shaTLS_ECDH_RSA_WITH_RC4_128_SHATLSv1
    ecdh_rsa_3des_shaTLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHATLSv1
    ecdh_rsa_aes_128_shaTLS_ECDH_RSA_WITH_AES_128_CBC_SHATLSv1
    ecdh_rsa_aes_256_shaTLS_ECDH_RSA_WITH_AES_256_CBC_SHATLSv1
    echde_rsa_nullTLS_ECDHE_RSA_WITH_NULL_SHATLSv1
    ecdhe_rsa_rc4_128_shaTLS_ECDHE_RSA_WITH_RC4_128_SHATLSv1
    ecdhe_rsa_3des_shaTLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHATLSv1
    ecdhe_rsa_aes_128_shaTLS_ECDHE_RSA_WITH_AES_128_CBC_SHATLSv1
    ecdhe_rsa_aes_256_shaTLS_ECDHE_RSA_WITH_AES_256_CBC_SHATLSv1
    ecdh_anon_null_shaTLS_ECDH_anon_WITH_NULL_SHATLSv1
    ecdh_anon_rc4_128shaTLS_ECDH_anon_WITH_RC4_128_SHATLSv1
    ecdh_anon_3des_shaTLS_ECDH_anon_WITH_3DES_EDE_CBC_SHATLSv1
    ecdh_anon_aes_128_shaTLS_ECDH_anon_WITH_AES_128_CBC_SHATLSv1
    ecdh_anon_aes_256_shaTLS_ECDH_anon_WITH_AES_256_CBC_SHATLSv1
    +
    Example

    NSSCipherSuite @@ -651,7 +844,7 @@ Options are:
    Note that this differs from mod_ssl in that you can't add or subtract protocols.
    -SSLv2 is not supported at this time.
    +SSLv2 is not supported by default at this time.

    Example

    @@ -670,7 +863,23 @@ be enclosed in double quotes.
    style="font-weight: bold;">
    NSSNickname Server-Cert
    -NSSNickname "This contains a space"
    +NSSNickname "This contains a space"
    +
    +NOTE: There is nothing magical about the string "Server-Cert." A +nickname can be anything. Historically this was Server-Cert in the +Netscape server products that used NSS.
    +
    +    NSSECCNickname
    +
    +Similar to NSSNickname but designed for use with ECC certificates. This +allows you to have both an RSA certificate and an ECC certificate +available on the same listening port. This allows newer clients that +support ECC to connect with those ciphers but also allows older clients +to connect with an RSA cipher.
    +
    +Example
    +
    +NSSNickname Server-Cert-ECC

    NSSEnforceValidCerts

    @@ -929,6 +1138,13 @@ start time
    Client certificate validity end time + + SSL_CLIENT_V_REMAIN
    + + Number of days that the +certificate is valid
    + + SSL_CLIENT_M_VERSION
     -- cgit