mod_nss

internal:secret12 +internal:secret12 Example @@ -359,7 +363,7 @@ Specifies the location of the NSS certificate database to be used. An NSS certificate database consists of 3 files: cert8.db, key3.db and secmod.db. cert8.db stores certificates and Certificate Revocation Lists (CRLs), key3.db stores keys and secmod.db stores information -about available pkcs#11 modules. +about available PKCS#11 modules. This directive specifies a path, not a filename. @@ -376,13 +380,13 @@ in one directory. Example -NSSDBPrefix my-prefix- +NSSDBPrefix my-prefix- You would then need: my-prefix-cert8.db, my-prefix-key3.db and secmod.db In order to work with files with a prefix using the NSS command-line tools use the -P flag. - + NSSSessionCacheSize Specifies the number of SSL sessions that can be cached. @@ -404,8 +408,7 @@ is silently constrained. The default value is 100. -Example +Example NSSSessionCacheTimeout 100 @@ -413,7 +416,7 @@ The default value is 100. Specifies the number of seconds SSL 3 sessions are cached. -The valid range is 5 - 86400 seconds. A setting outside the valid +The valid range is 5 - 86400 seconds. A setting outside the valid range is silently constrained. The default value is 86400 (24 hours). @@ -425,24 +428,24 @@ The default value is 86400 (24 hours). NSSRandomSeed Configures sources to seed the NSS Random Number Generator (RNG) at -startup. Currently this only supports seeding the RNG at startup. +startup. Currently this only supports seeding the RNG at startup. The following sources are available: - builtin: Combines the current system time, the + builtin: Combines the current system time, the current process id and a randomly choosen 128-byte extract of the process stack. This is not a particularly strong source of entropy. - file:/path/to/source: Reads from the specified file. + file:/path/to/source: Reads from the specified file. If the number of bytes to read is specified it just reads that amount. Be aware that some operating systems block on /dev/random if not enough entropy is available. This means that the server will wait until that -/data is available to continue startup. These systems generally offer a +data is available to continue startup. These systems generally offer a non-blocking device as well, /dev/urandom. - exec:/path/to/program: Executes the given program and takes -the stdout of it as the entryop. If the bytes argument is included it -reads that many bytes, otherwise it reads until the program exits. + exec:/path/to/program: Executes the given program and takes +the stdout of it as the entropy. If the bytes argument is included it +reads that many bytes, otherwise it reads until the program exits. Example @@ -455,10 +458,10 @@ NSSRandomSeed startup /usr/bin/makerandom

Enables or disables the SSL protocol. This is usually used within a VirtualHost tag to enable SSL for a particular virtual host.
-
-SSL is disabled by default.
-
-Example
+
+SSL is disabled by default.
+
+Example

NSSEngine on

@@ -479,10 +482,10 @@ The allowable ciphers are:

rsa_des_56_sha

fortezza

Environment Variables

Database Management

Why is SSLv2 disabled?

Frequently Asked Questions

mod_nss

Table of Contents

Introduction

Building

Installation

Certificate Generation

Server Startup

Migration

Configuration Directives