konevsa/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DOC: ssl: add 'verify', 'cafile' and 'crlfile' statements on 'bind'

Browse Source
This commit is contained in:
Emeric Brun 2012-09-28 17:07:34 +02:00 committed by Willy Tarreau
parent d94b3fe98f
commit 1a073b4650
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
doc/configuration.txt
View File

@ -6742,6 +6742,11 @@ ecdhe <named curve>
the named curve (RFC 4492) used to generate ECDH ephemeral keys and makes the named curve (RFC 4492) used to generate ECDH ephemeral keys and makes
ECDHE cipher suites usable. ECDHE cipher suites usable.
cafile <cafile>
This setting is only available when support for OpenSSL was built in. It
designates a PEM file from which to load CA certificates used to verify
client's certificate.
ciphers <ciphers> ciphers <ciphers>
This setting is only available when support for OpenSSL was built in. It sets This setting is only available when support for OpenSSL was built in. It sets
the string describing the list of cipher algorithms ("cipher suite") that are the string describing the list of cipher algorithms ("cipher suite") that are
@ -6749,6 +6754,11 @@ ciphers <ciphers>
in "man 1 ciphers" from OpenSSL man pages, and can be for instance a string in "man 1 ciphers" from OpenSSL man pages, and can be for instance a string
such as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes). such as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes).
crlfile <cafile>
This setting is only available when support for OpenSSL was built in. It
designates a PEM file from which to load certificate revocation list used
to verify client's certificate.
crt <cert> crt <cert>
This setting is only available when support for OpenSSL was built in. This setting is only available when support for OpenSSL was built in.
It designates a PEM file from which to load both a certificate and the It designates a PEM file from which to load both a certificate and the
@ -6919,6 +6929,15 @@ user <user>
setting except that the user name is used instead of its uid. This setting is setting except that the user name is used instead of its uid. This setting is
ignored by non UNIX sockets. ignored by non UNIX sockets.
verify [none|optional|required]
This setting is only available when support for OpenSSL was built in. If set
to 'none', client certificate is not requested. This is the default. In other
cases, a client certificate is requested. If the client does not provide a
certificate after the request and if 'verify' is set to 'required', then the
handshake is aborted, while it would have succeeded if set to 'optional'. The
certificate provided by the client is always verified using CAs from 'cafile'
and optional CRLs from 'crlfile'. On verify failure the handshake is aborted,
regardless of the 'verify' option.
5.2. Server and default-server options 5.2. Server and default-server options
------------------------------------ ------------------------------------