|
 |
90ca4f |
@@ -, +, @@
|
|
|
90ca4f |
Documentation formatting fixes
|
|
|
90ca4f |
|
|
|
90ca4f |
- correct few cases of used on text that should use normal font
|
|
|
90ca4f |
- strip some redundant html tags
|
|
|
90ca4f |
- use for larger command output blocks
|
|
|
90ca4f |
- correct few typos
|
|
|
90ca4f |
--- a/docs/mod_nss.html
|
|
|
90ca4f |
+++ a/docs/mod_nss.html
|
|
|
90ca4f |
@@ -15,10 +15,10 @@
|
|
|
90ca4f |
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
90ca4f |
See the License for the specific language governing permissions and
|
|
|
90ca4f |
-->
|
|
|
90ca4f |
-
|
|
|
90ca4f |
- http-equiv="content-type">
|
|
|
90ca4f |
+ <meta content="text/html; charset=ISO-8859-1" http-equiv="content-type">
|
|
|
90ca4f |
<title>mod_nss</title>
|
|
|
90ca4f |
</head>
|
|
|
90ca4f |
+
|
|
|
90ca4f |
<body>
|
|
|
90ca4f |
mod_nss
|
|
|
90ca4f |
Table of Contents
|
|
|
90ca4f |
@@ -33,6 +33,7 @@
|
|
|
90ca4f |
Database Management
|
|
|
90ca4f |
Why is SSLv2 disabled?
|
|
|
90ca4f |
Frequently Asked Questions
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Introduction
|
|
|
90ca4f |
The mod_ssl package was
|
|
|
90ca4f |
created in April 1998 by Ralf S.
|
|
|
90ca4f |
@@ -44,9 +45,10 @@ the
|
|
|
90ca4f |
license.
|
|
|
90ca4f |
|
|
|
90ca4f |
mod_nss is based directly on the mod_ssl package from Apache
|
|
|
90ca4f |
-2.0.54. It is a conversion from using OpenSSL calls to using
|
|
|
90ca4f |
- href="http://www.mozilla.org/projects/security/pki/nss/">NSS
|
|
|
90ca4f |
+2.0.54. It is a conversion from using OpenSSL calls to using
|
|
|
90ca4f |
+NSS
|
|
|
90ca4f |
calls instead.
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Building
|
|
|
90ca4f |
Refer to the README file included with the distribution.
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -173,13 +175,14 @@ module with something like:
|
|
|
90ca4f |
This will create a sample configuration file nss.conf.
|
|
|
90ca4f |
By default
|
|
|
90ca4f |
this is installed during the installation process.
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Installation
|
|
|
90ca4f |
The make install target uses apxs to install the module into Apache.
|
|
|
90ca4f |
This automatically copies the mod_nss shared library to the appropriate
|
|
|
90ca4f |
location and updates Apache's httpd.conf so that the module will be
|
|
|
90ca4f |
loaded during the next restart.
|
|
|
90ca4f |
|
|
|
90ca4f |
-It also tries to rename ssl.conf to ssl.conf.old.
|
|
|
90ca4f |
+It also tries to rename ssl.conf to ssl.conf.old.
|
|
|
90ca4f |
The assumption is that mod_nss is replacing mod_ssl. They can co-exist
|
|
|
90ca4f |
as long as they are listening on separate ports.
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -196,6 +199,7 @@ following line to httpd.conf (location relative to httpd.conf):
|
|
|
90ca4f |
This has Apache load the mod_nss configuration file, nss.conf.
|
|
|
90ca4f |
It is here that you will setup your VirtualServer entries to and
|
|
|
90ca4f |
configure your SSL servers.
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Certificate Generation
|
|
|
90ca4f |
A ksh script, gencert, is included to automatically
|
|
|
90ca4f |
generate a self-signed CA plus one server certificate. This is fine for
|
|
|
90ca4f |
@@ -212,30 +216,31 @@ bother with the details.
|
|
|
90ca4f |
The certificate database password is httptest.
|
|
|
90ca4f |
|
|
|
90ca4f |
A sample run is:
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-# mkdir /etc/httpd/nss
|
|
|
90ca4f |
-# ./gencert /etc/httpd/nss
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-#####################################################################
|
|
|
90ca4f |
-Generating new server certificate and key database. The password
|
|
|
90ca4f |
-is httptest
|
|
|
90ca4f |
-#####################################################################
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-#####################################################################
|
|
|
90ca4f |
-Generating self-signed client CA certificate
|
|
|
90ca4f |
-#####################################################################
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-Generating key. This may take a few moments...
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-[ Lots of output removed ]
|
|
|
90ca4f |
-
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+# mkdir /etc/httpd/nss
|
|
|
90ca4f |
+# ./gencert /etc/httpd/nss
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+#####################################################################
|
|
|
90ca4f |
+Generating new server certificate and key database. The password
|
|
|
90ca4f |
+is httptest
|
|
|
90ca4f |
+#####################################################################
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+#####################################################################
|
|
|
90ca4f |
+Generating self-signed client CA certificate
|
|
|
90ca4f |
+#####################################################################
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+Generating key. This may take a few moments...
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+[ Lots of output removed ]
|
|
|
90ca4f |
+
|
|
|
90ca4f |
You should now have the following files:
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-/etc/httpd/nss/cert8.db
|
|
|
90ca4f |
-/etc/httpd/nss/key3db
|
|
|
90ca4f |
-/etc/httpd/nss/secmod.db
|
|
|
90ca4f |
-
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+/etc/httpd/nss/cert8.db
|
|
|
90ca4f |
+/etc/httpd/nss/key3db
|
|
|
90ca4f |
+/etc/httpd/nss/secmod.db
|
|
|
90ca4f |
+
|
|
|
90ca4f |
These 3 files make up an NSS certificate database.
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Server Startup
|
|
|
90ca4f |
Starting a mod_nss server is no different than starting a mod_ssl
|
|
|
90ca4f |
server. You will need to authenticate yourself to the security token
|
|
|
90ca4f |
@@ -253,23 +258,21 @@ token password.
|
|
|
90ca4f |
|
|
|
90ca4f |
All other output will be written to the Apache log files.
|
|
|
90ca4f |
|
|
|
90ca4f |
-To avoid being prompted for a startup password you can either:
|
|
|
90ca4f |
+To avoid being prompted for a startup password you can either:
|
|
|
90ca4f |
|
|
|
90ca4f |
- Use a password file that contains your token passwords. See <small><small>
|
|
|
90ca4f |
- size="+2"><small><small>NSSPassPhraseDialog for details.</small></small></font></small></small>
|
|
|
90ca4f |
- <small><small><font size="+2"><small><small>Change the internal
|
|
|
90ca4f |
-token password to a blank with:
|
|
|
90ca4f |
- </small></small></font></small></small>
|
|
|
90ca4f |
+ Use a password file that contains your token passwords. See
|
|
|
90ca4f |
+NSSPassPhraseDialog for details.
|
|
|
90ca4f |
+ Change the internal token password to a blank with:
|
|
|
90ca4f |
|
|
|
90ca4f |
-<small><small><font size="+2"><small><small>%
|
|
|
90ca4f |
-modutil -dbdir /path/to/database/directory -changepw "NSS Certificate
|
|
|
90ca4f |
-DB"
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+% modutil -dbdir /path/to/database/directory -changepw "NSS Certificate DB"
|
|
|
90ca4f |
|
|
|
90ca4f |
Enter the old password then press Enter twice for the new password to
|
|
|
90ca4f |
blank it out.
|
|
|
90ca4f |
-</small></small></font></small></small>
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Migration
|
|
|
90ca4f |
-A perl script, migrate,pl, is included to help migrate an
|
|
|
90ca4f |
+A perl script, migrate.pl, is included to help migrate an
|
|
|
90ca4f |
existing mod_ssl configuration to work with mod_nss. There is one
|
|
|
90ca4f |
optional argument, -c, that will try to convert your existing server
|
|
|
90ca4f |
and CA certificates plus any certificate revocation lists (CRLs) into
|
|
|
90ca4f |
@@ -282,6 +285,7 @@ possible to migrate httpd.conf to use mod_nss. Simply copy httpd.conf
|
|
|
90ca4f |
to ssl.conf, run the update, then copy nss.conf to httpd.conf (after
|
|
|
90ca4f |
making a backup, of couse). This multi-step process gives you a chance
|
|
|
90ca4f |
to verify that the migration was successful.
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Configuration Directives
|
|
|
90ca4f |
The following mod_ssl Directives are not applicable to mod_nss:
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -297,10 +301,10 @@ The following mod_ssl Directives are not applicable to mod_nss:
|
|
|
90ca4f |
|
|
|
90ca4f |
Authentication is required in order to use the private key in an NSS
|
|
|
90ca4f |
certificate database. The method of this authentication is specified
|
|
|
90ca4f |
-with the NSSPassPhraseDialog directive. This directive takes one
|
|
|
90ca4f |
+with the NSSPassPhraseDialog directive. This directive takes one
|
|
|
90ca4f |
argument specifying the method of authentication:
|
|
|
90ca4f |
|
|
|
90ca4f |
- builtin
|
|
|
90ca4f |
+ builtin
|
|
|
90ca4f |
|
|
|
90ca4f |
The user will be prompted to enter the
|
|
|
90ca4f |
token password for each cryptographic device. This works seemlessly
|
|
|
90ca4f |
@@ -308,20 +312,20 @@ with any hardware tokens used. The default "device" is the internal
|
|
|
90ca4f |
token provided by the NSS Certificate database itself.
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
- file:/path/to/file
|
|
|
90ca4f |
+ file:/path/to/file
|
|
|
90ca4f |
|
|
|
90ca4f |
The token password(s) may be stored in
|
|
|
90ca4f |
an ASCII text file which is read during startup so the server can start
|
|
|
90ca4f |
without user intervention. The format of this file is:
|
|
|
90ca4f |
|
|
|
90ca4f |
-token:password
|
|
|
90ca4f |
+token:password
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
An example for the internal token is:
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
-internal:secret12
|
|
|
90ca4f |
+internal:secret12
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
Example
|
|
|
90ca4f |
@@ -359,7 +363,7 @@ Specifies the location of the NSS certificate database to be used. An
|
|
|
90ca4f |
NSS certificate database consists of 3 files: cert8.db, key3.db and
|
|
|
90ca4f |
secmod.db. cert8.db stores certificates and Certificate Revocation
|
|
|
90ca4f |
Lists (CRLs), key3.db stores keys and secmod.db stores information
|
|
|
90ca4f |
-about available pkcs#11 modules.
|
|
|
90ca4f |
+about available PKCS#11 modules.
|
|
|
90ca4f |
|
|
|
90ca4f |
This directive specifies a path, not a filename.
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -376,13 +380,13 @@ in one directory.
|
|
|
90ca4f |
|
|
|
90ca4f |
Example
|
|
|
90ca4f |
|
|
|
90ca4f |
-NSSDBPrefix my-prefix-
|
|
|
90ca4f |
+NSSDBPrefix my-prefix-
|
|
|
90ca4f |
|
|
|
90ca4f |
You would then need: my-prefix-cert8.db, my-prefix-key3.db and secmod.db
|
|
|
90ca4f |
|
|
|
90ca4f |
In order to work with files with a prefix using the NSS command-line
|
|
|
90ca4f |
tools use the -P flag.
|
|
|
90ca4f |
-
|
|
|
90ca4f |
+
|
|
|
90ca4f |
<font size="+2">NSSSessionCacheSize</font>
|
|
|
90ca4f |
|
|
|
90ca4f |
Specifies the number of SSL sessions that can be cached.
|
|
|
90ca4f |
@@ -404,8 +408,7 @@ is silently constrained.
|
|
|
90ca4f |
|
|
|
90ca4f |
The default value is 100.
|
|
|
90ca4f |
|
|
|
90ca4f |
-Example
|
|
|
90ca4f |
- style="font-weight: bold;">
|
|
|
90ca4f |
+Example
|
|
|
90ca4f |
|
|
|
90ca4f |
NSSSessionCacheTimeout 100
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -413,7 +416,7 @@ The default value is 100.
|
|
|
90ca4f |
</big></big>
|
|
|
90ca4f |
Specifies the number of seconds SSL 3 sessions are cached.
|
|
|
90ca4f |
|
|
|
90ca4f |
-The valid range is 5 - 86400 seconds. A setting outside the valid
|
|
|
90ca4f |
+The valid range is 5 - 86400 seconds. A setting outside the valid
|
|
|
90ca4f |
range is silently constrained.
|
|
|
90ca4f |
|
|
|
90ca4f |
The default value is 86400 (24 hours).
|
|
|
90ca4f |
@@ -425,24 +428,24 @@ The default value is 86400 (24 hours).
|
|
|
90ca4f |
<big><big>NSSRandomSeed</big></big>
|
|
|
90ca4f |
|
|
|
90ca4f |
Configures sources to seed the NSS Random Number Generator (RNG) at
|
|
|
90ca4f |
-startup. Currently this only supports seeding the RNG at startup.
|
|
|
90ca4f |
+startup. Currently this only supports seeding the RNG at startup.
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
The following sources are available:
|
|
|
90ca4f |
|
|
|
90ca4f |
- builtin: Combines the current system time, the
|
|
|
90ca4f |
+ builtin: Combines the current system time, the
|
|
|
90ca4f |
current process id
|
|
|
90ca4f |
and a randomly choosen 128-byte extract of the process stack. This is
|
|
|
90ca4f |
not a particularly strong source of entropy.
|
|
|
90ca4f |
- file:/path/to/source: Reads from the specified file.
|
|
|
90ca4f |
+ file:/path/to/source: Reads from the specified file.
|
|
|
90ca4f |
If the number of bytes to read is specified it just reads that amount.
|
|
|
90ca4f |
Be aware that some operating systems block on /dev/random if not enough
|
|
|
90ca4f |
entropy is available. This means that the server will wait until that
|
|
|
90ca4f |
-/data is available to continue startup. These systems generally offer a
|
|
|
90ca4f |
+data is available to continue startup. These systems generally offer a
|
|
|
90ca4f |
non-blocking device as well, /dev/urandom.
|
|
|
90ca4f |
- exec:/path/to/program: Executes the given program and takes
|
|
|
90ca4f |
-the stdout of it as the entryop. If the bytes argument is included it
|
|
|
90ca4f |
-reads that many bytes, otherwise it reads until the program exits.
|
|
|
90ca4f |
+ exec:/path/to/program: Executes the given program and takes
|
|
|
90ca4f |
+the stdout of it as the entropy. If the bytes argument is included it
|
|
|
90ca4f |
+reads that many bytes, otherwise it reads until the program exits.
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
Example
|
|
|
90ca4f |
@@ -455,10 +458,10 @@ NSSRandomSeed startup /usr/bin/makerandom
|
|
|
90ca4f |
|
|
|
90ca4f |
Enables or disables the SSL protocol. This is usually used within a
|
|
|
90ca4f |
VirtualHost tag to enable SSL for a particular virtual host.
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-SSL is disabled by default.
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-Example
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+SSL is disabled by default.
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+Example
|
|
|
90ca4f |
|
|
|
90ca4f |
NSSEngine on
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -479,10 +482,10 @@ The allowable ciphers are:
|
|
|
90ca4f |
rsa_des_56_sha
|
|
|
90ca4f |
fortezza
|
|
|
90ca4f |
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-FIPS is disabled by default.
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-Example
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+FIPS is disabled by default.
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+Example
|
|
|
90ca4f |
|
|
|
90ca4f |
NSSFIPS on
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -493,10 +496,9 @@ Enables or disables
|
|
|
90ca4f |
(Online Certificate Status Protocol). This allows the server to check
|
|
|
90ca4f |
the validity of a client certificate before accepting it.
|
|
|
90ca4f |
|
|
|
90ca4f |
-OCSP
|
|
|
90ca4f |
- style="font-weight: bold;"> is disabled by default.
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-Example
|
|
|
90ca4f |
+OCSP is disabled by default.
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+Example
|
|
|
90ca4f |
|
|
|
90ca4f |
NSSOCSP on
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -517,8 +519,7 @@ Available ciphers are:
|
|
|
90ca4f |
|
|
|
90ca4f |
Cipher Name
|
|
|
90ca4f |
|
|
|
90ca4f |
- NSS Cipher
|
|
|
90ca4f |
-definition
|
|
|
90ca4f |
+ NSS Cipher definition
|
|
|
90ca4f |
|
|
|
90ca4f |
Protocol
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -689,8 +690,7 @@ Additionally there are a number of ECC ciphers:
|
|
|
90ca4f |
|
|
|
90ca4f |
Cipher Name
|
|
|
90ca4f |
|
|
|
90ca4f |
- NSS Cipher
|
|
|
90ca4f |
-Definition
|
|
|
90ca4f |
+ NSS Cipher Definition
|
|
|
90ca4f |
|
|
|
90ca4f |
Protocol
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -856,20 +856,19 @@ Specify the nickname to be used for this the server certificate.
|
|
|
90ca4f |
Certificates stored in an NSS database are referred to using nicknames
|
|
|
90ca4f |
which makes accessing a specific certificate much easier. It is also
|
|
|
90ca4f |
possible to specify the certificate DN but it is easier to use a
|
|
|
90ca4f |
-nickname. If the nickname includes spaces then the value needs to
|
|
|
90ca4f |
+nickname. If the nickname includes spaces then the value needs to
|
|
|
90ca4f |
be enclosed in double quotes.
|
|
|
90ca4f |
|
|
|
90ca4f |
-Example
|
|
|
90ca4f |
- style="font-weight: bold;">
|
|
|
90ca4f |
+Example
|
|
|
90ca4f |
|
|
|
90ca4f |
NSSNickname Server-Cert
|
|
|
90ca4f |
-NSSNickname "This contains a space"
|
|
|
90ca4f |
+NSSNickname "This contains a space"
|
|
|
90ca4f |
|
|
|
90ca4f |
NOTE: There is nothing magical about the string "Server-Cert." A
|
|
|
90ca4f |
nickname can be anything. Historically this was Server-Cert in the
|
|
|
90ca4f |
Netscape server products that used NSS.
|
|
|
90ca4f |
|
|
|
90ca4f |
-<big><big>NSSECCNickname</big></big>
|
|
|
90ca4f |
+<big><big>NSSECCNickname</big></big>
|
|
|
90ca4f |
|
|
|
90ca4f |
Similar to NSSNickname but designed for use with ECC certificates. This
|
|
|
90ca4f |
allows you to have both an RSA certificate and an ECC certificate
|
|
|
90ca4f |
@@ -909,7 +908,7 @@ Available options are:
|
|
|
90ca4f |
none: no client certificate
|
|
|
90ca4f |
is required or requested
|
|
|
90ca4f |
|
|
|
90ca4f |
- code>optional: a client
|
|
|
90ca4f |
+ optional: a client
|
|
|
90ca4f |
certificate is requested but if one is not available, the connection
|
|
|
90ca4f |
may continue.
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -935,8 +934,7 @@ also be set for this to work.
|
|
|
90ca4f |
|
|
|
90ca4f |
Example
|
|
|
90ca4f |
|
|
|
90ca4f |
-NSSUserName SSL_CLIENT_S_DN_UID
|
|
|
90ca4f |
- style="font-family: sans-serif;">
|
|
|
90ca4f |
+NSSUserName SSL_CLIENT_S_DN_UID
|
|
|
90ca4f |
<big><big>
|
|
|
90ca4f |
NSSOptions</big></big>
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -959,7 +957,7 @@ plus every CA certificate in the client certificate.
|
|
|
90ca4f |
StrictRequire: Absolutely forces the connection to be forbidden
|
|
|
90ca4f |
when NSSRequireSSL or NSSRequire aren't met.
|
|
|
90ca4f |
OptRenegotiate: Allows the SSL connection to be renegotiated
|
|
|
90ca4f |
-using a different contiguration. This is designed for a per-directory
|
|
|
90ca4f |
+using a different configuration. This is designed for a per-directory
|
|
|
90ca4f |
and is relatively expensive to do. For example, it can be used to force
|
|
|
90ca4f |
very strong ciphers in particular directories.
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -967,20 +965,19 @@ very strong ciphers in particular directories.
|
|
|
90ca4f |
All options are disabled by default.
|
|
|
90ca4f |
|
|
|
90ca4f |
Example:
|
|
|
90ca4f |
-
|
|
|
90ca4f |
-NSSOptions +FakeBasicAuth
|
|
|
90ca4f |
-<Files ~ "\.(cgi|shtml)$">
|
|
|
90ca4f |
-NSSOptions +StdEnvVars
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+NSSOptions +FakeBasicAuth
|
|
|
90ca4f |
+<Files ~ "\.(cgi|shtml)$">
|
|
|
90ca4f |
+NSSOptions +StdEnvVars
|
|
|
90ca4f |
<Files>
|
|
|
90ca4f |
-
|
|
|
90ca4f |
+
|
|
|
90ca4f |
|
|
|
90ca4f |
<big><big>NSSRequireSSL</big></big>
|
|
|
90ca4f |
|
|
|
90ca4f |
The request is forbidden unless the connection is using SSL. Only
|
|
|
90ca4f |
available in a per-directory context. This takes no arguments.
|
|
|
90ca4f |
|
|
|
90ca4f |
-Example
|
|
|
90ca4f |
- style="font-weight: bold;">
|
|
|
90ca4f |
+Example
|
|
|
90ca4f |
|
|
|
90ca4f |
NSSRequireSSL
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -1040,9 +1037,9 @@ man-in-the-middle attack so leaving this as on is strongly recommended.
|
|
|
90ca4f |
|
|
|
90ca4f |
Example
|
|
|
90ca4f |
|
|
|
90ca4f |
-NSSProcyCheckPeerCN
|
|
|
90ca4f |
-on
|
|
|
90ca4f |
-
|
|
|
90ca4f |
+NSSProcyCheckPeerCN on
|
|
|
90ca4f |
+
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Environment Variables
|
|
|
90ca4f |
Quite a few environment variables (for CGI and SSI) may be set
|
|
|
90ca4f |
depending on the NSSOptions configuration. It can be expensive to set
|
|
|
90ca4f |
@@ -1163,7 +1160,7 @@ certificate is valid
|
|
|
90ca4f |
SSL_CLIENT_M_VERSION
|
|
|
90ca4f |
|
|
|
90ca4f |
X.509 version of the client
|
|
|
90ca4f |
-certificiate
|
|
|
90ca4f |
+certificate
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
@@ -1181,7 +1178,7 @@ certificate
|
|
|
90ca4f |
|
|
|
90ca4f |
SSL_CLIENT_A_SIG
|
|
|
90ca4f |
Algorithm used for the signature
|
|
|
90ca4f |
-of the client key
|
|
|
90ca4f |
+of the client key
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
SSL_CLIENT_S_DN
|
|
|
90ca4f |
@@ -1228,7 +1225,7 @@ certificate. Only those that exist in the certificate are created
|
|
|
90ca4f |
SSL_SERVER_M_VERSION
|
|
|
90ca4f |
|
|
|
90ca4f |
X.509 version of the server
|
|
|
90ca4f |
-certificiate
|
|
|
90ca4f |
+certificate
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
SSL_SERVER_M_SERIAL
|
|
|
90ca4f |
@@ -1257,7 +1254,7 @@ time
|
|
|
90ca4f |
SSL_SERVER_A_SIG
|
|
|
90ca4f |
|
|
|
90ca4f |
Algorithm used for the signature
|
|
|
90ca4f |
-of the server key
|
|
|
90ca4f |
+of the server key
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
SSL_SESSION_ID
|
|
|
90ca4f |
@@ -1304,6 +1301,7 @@ itself).
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Database Management
|
|
|
90ca4f |
NSS stores it's certificates and keys in a set of files referred to as
|
|
|
90ca4f |
the "certificate database." The files by default (with NSS 3.x) are
|
|
|
90ca4f |
@@ -1437,21 +1435,19 @@ have NSS validate it:
|
|
|
90ca4f |
|
|
|
90ca4f |
% certutil -V -n Server-Cert -u V -d .
|
|
|
90ca4f |
certutil: certificate is valid
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Why is SSLv2 disabled?
|
|
|
90ca4f |
-All major browsers (Firefox, Internet Explorer, Mozilla, Netscape,
|
|
|
90ca4f |
-Opera, and
|
|
|
90ca4f |
-Safari) support SSL 3 and TLS so there is no need for a web server to
|
|
|
90ca4f |
-support
|
|
|
90ca4f |
-SSL 2. There are some known attacks against SSL 2 that are handled by
|
|
|
90ca4f |
-SSL 3/TLS. SSLv2 also doesn't support useful features like client
|
|
|
90ca4f |
-authentication.
|
|
|
90ca4f |
+All major browsers (Firefox, Internet Explorer, Mozilla, Netscape, Opera, and
|
|
|
90ca4f |
+Safari) support SSL 3 and TLS so there is no need for a web server to support
|
|
|
90ca4f |
+SSL 2. There are some known attacks against SSL 2 that are handled by SSL
|
|
|
90ca4f |
+3/TLS. SSLv2 also doesn't support useful features like client authentication.
|
|
|
90ca4f |
|
|
|
90ca4f |
+
|
|
|
90ca4f |
Frequently Asked Questions
|
|
|
90ca4f |
Q. Does mod_nss support mod_proxy?
|
|
|
90ca4f |
|
|
|
90ca4f |
A. Yes but you need to make sure that mod_ssl is not loaded. mod_proxy
|
|
|
90ca4f |
provides a single interface for SSL providers and mod_nss defers to
|
|
|
90ca4f |
-mod_ssl
|
|
|
90ca4f |
-if it is loaded.
|
|
|
90ca4f |
+mod_ssl if it is loaded.
|
|
|
90ca4f |
</body>
|
|
|
90ca4f |
</html>
|