[Fedora-directory-commits] esc/coreconf rules.mk,1.1.1.1,1.2
by Doctor Conrad
Author: jmagne
Update of /cvs/dirsec/esc/coreconf
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv12536
Modified Files:
rules.mk
Log Message:
Minor cleanup.
Index: rules.mk
===================================================================
RCS file: /cvs/dirsec/esc/coreconf/rules.mk,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- rules.mk 12 Jun 2006 23:39:53 -0000 1.1.1.1
+++ rules.mk 13 Sep 2006 17:45:49 -0000 1.2
@@ -749,7 +749,7 @@
-include $(DEPENDENCIES)
-ifneq (,$(filter-out OpenVMS OS2 WIN%,$(OS_TARGET)))
+ifneq (,$(filter-out Linux OpenVMS OS2 WIN%,$(OS_TARGET)))
# Can't use sed because of its 4000-char line length limit, so resort to perl
.DEFAULT:
@perl -e ' \
17 years, 7 months
[Fedora-directory-commits] esc manifest.mn,1.1.1.1,1.2
by Doctor Conrad
Author: jmagne
Update of /cvs/dirsec/esc
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv12501
Modified Files:
manifest.mn
Log Message:
Remove uneeded code to import NSS.
Index: manifest.mn
===================================================================
RCS file: /cvs/dirsec/esc/manifest.mn,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- manifest.mn 12 Jun 2006 23:39:49 -0000 1.1.1.1
+++ manifest.mn 13 Sep 2006 17:44:51 -0000 1.2
@@ -15,21 +15,11 @@
# All rights reserved.
# END COPYRIGHT BLOCK
-CORE_DEPTH = .
-
-REQUIRES = nss nspr
+CORE_DEPTH = ./
DIRS = coreconf \
- clib \
- zlib \
- pkcs11 \
- esc \
+ src \
$(NULL)
-# egate \
-# lib \
-# cmd \
-IMPORTS = nspr20/v4.4.1 \
- nss/NSS_3_9_3_RTM \
- $(NULL)
+IMPORTS = $(NULL)
17 years, 7 months
[Fedora-directory-commits] esc Makefile,1.1.1.1,1.2
by Doctor Conrad
Author: jmagne
Update of /cvs/dirsec/esc
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv12466
Modified Files:
Makefile
Log Message:
Cleanup unneeded code for importing NSS.
Index: Makefile
===================================================================
RCS file: /cvs/dirsec/esc/Makefile,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- Makefile 12 Jun 2006 23:39:49 -0000 1.1.1.1
+++ Makefile 13 Sep 2006 17:43:54 -0000 1.2
@@ -19,29 +19,6 @@
include $(CORE_DEPTH)/coreconf/config.mk
-all:: importnss
include $(CORE_DEPTH)/coreconf/rules.mk
-# only build the card applet on Windows, and if the tools are setup
-
-ifeq ($(findstring WIN,$(OS_TARGET)),WIN)
-ifneq (,$(JAVACARD_KIT_DIR))
-ifneq (,$(JAVA_HOME))
-ifneq (,$(SLB_DIR))
-DIRS += applet
-endif
-endif
-endif
-endif
-
-# import xulrunner to get the gdk
-
-
-IMPORTS += src/xulrunner/v1.8.0.1/xulrunner-1.8.0.1-source.tar.gz
-importnss:
-ifeq ($(IMPORT_NSS),1)
-ifneq ($(wildcard $(NSSDIR)/$(OBJDIR)/include/prtypes.h),$(NSSDIR)/$(OBJDIR)/include/prtypes.h)
- $(MAKE) import
-endif
-endif
17 years, 7 months
[Fedora-directory-commits] coolkey/src/coolkey machdep.cpp,1.2,1.3
by Doctor Conrad
Author: rrelyea
Update of /cvs/dirsec/coolkey/src/coolkey
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv16750
Modified Files:
machdep.cpp
Log Message:
create separate cache files for each user.
Set permissions so all users can share the directory.
Index: machdep.cpp
===================================================================
RCS file: /cvs/dirsec/coolkey/src/coolkey/machdep.cpp,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- machdep.cpp 13 Jul 2006 21:32:39 -0000 1.2
+++ machdep.cpp 7 Sep 2006 20:57:20 -0000 1.3
@@ -177,6 +177,7 @@
#define FULL_CLEANUP
#else
/* if we can't lock on open, don't use locking for now */
+#undef FULL_CLEANUP
#define O_EXLOCK 0
#endif
@@ -207,9 +208,11 @@
#ifdef FULL_CLEANUP
flock(fd,LOCK_EX);
unsigned long ref = --(*(unsigned long *)addr);
+#ifdef notdef
if (ref == 0) {
unlink(path);
}
+#endif
flock(fd, LOCK_UN);
#endif
munmap(addr,size+RESERVED_OFFSET);
@@ -228,6 +231,14 @@
SHMem::initSegment(const char *name, int size, bool &init)
{
bool needInit = true;
+ /* big enough to hold a uid_t value in decimal */
+ /* decimal digits = ceiling(log10(uid_t_max)); */
+ /* log10(uid_t_max) = log256(uid_t_max)/log256(10); */
+ /* log256(uid_t_max) = sizeof(uid_t); */
+ /* log10(256) just greater than .41 */
+ /* so decimal_digits = (sizeof(uid_t)*100 +40)/41 */
+#define UID_DIGITS (((sizeof(uid_t)*100)+40)/41)
+ char uid_str[UID_DIGITS+2]; /* 1 for '-', 1 for null */
init = 0;
SHMemData *shmemData = new SHMemData;
@@ -236,12 +247,13 @@
// from getSHMemAddr.
return NULL;
}
- int ret = mkdir (MEMSEGPATH, 0755);
+ int ret = mkdir (MEMSEGPATH, 0777);
if ((ret == -1) && (errno != EEXIST)) {
delete shmemData;
return NULL;
}
- shmemData->path = new char [sizeof(MEMSEGPATH)+strlen(name)+2];
+ /* 1 for the '/', one for the '-' and one for the null */
+ shmemData->path = new char [sizeof(MEMSEGPATH)+strlen(name)+UID_DIGITS+3];
if (shmemData->path == NULL) {
delete shmemData;
return NULL;
@@ -249,11 +261,19 @@
memcpy(shmemData->path,MEMSEGPATH, sizeof(MEMSEGPATH));
shmemData->path[sizeof(MEMSEGPATH)-1] = '/';
strcpy(&shmemData->path[sizeof(MEMSEGPATH)],name);
+
+ int mode = 0777;
+ if (strcmp(name,"token_names") != 0) {
+ /* each user gets his own uid array */
+ sprintf(uid_str, "-%u",getuid());
+ strcat(shmemData->path,uid_str);
+ mode = 0700;
+ }
shmemData->fd = open(shmemData->path,
- O_CREAT|O_RDWR|O_EXCL|O_APPEND|O_EXLOCK, 0700);
+ O_CREAT|O_RDWR|O_EXCL|O_APPEND|O_EXLOCK, mode);
if (shmemData->fd < 0) {
needInit = false;
- shmemData->fd = open(shmemData->path,O_RDWR|O_EXLOCK, 0700);
+ shmemData->fd = open(shmemData->path,O_RDWR|O_EXLOCK, mode);
} else {
char *buf;
int len = size+RESERVED_OFFSET;
17 years, 7 months
[Fedora-directory-commits] mod_revocator/docs mod_revocator.html, NONE, 1.1
by Doctor Conrad
Author: rcritten
Update of /cvs/dirsec/mod_revocator/docs
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv29154
Added Files:
mod_revocator.html
Log Message:
HTML documentation for mod_revocator
--- NEW FILE mod_revocator.html ---
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<!--
Copyright (c) 2006 Red Hat, Inc. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
-->
<meta content="text/html; charset=ISO-8859-1"
http-equiv="content-type">
<title>mod_revocator</title>
</head>
<body>
<h1 style="text-align: center;">mod_revocator</h1>
<br>
<h2>Table of Contents</h2>
<a href="#Introduction">Introduction</a><br>
<a href="#Building">Building</a><br>
<div style="margin-left: 40px;"><a href="#Package_Requirements">Package
Requirements</a><br>
</div>
<a href="#Configuration_Directives">Configuration Directives</a><br>
<a href="#Developer_Information">Developer Information </a><br>
<h1><a name="Introduction"></a>Introduction</h1>
This Apache module lets the user configure remote Certificate
Revocation Lists (CRLs) to be downloaded and installed automatically on
a regular basis without restarting the server. This helps ensure that
the CRLs are kept up-to-date with minimal effort. The module can also
bring the server down if the CRL expires and a new one cannot be
obtained. This module requires that <a
href="http://directory.fedora.redhat.com/wiki/Mod_nss">mod_nss</a>
also be installed.
<br>
<h1><a name="Building"></a>Building </h1>
Refer to the README file included with the distribution for the latest
information.<br>
<h2><a name="Package_Requirements"></a>Package Requirements<br>
</h2>
To build this you'll need:<br>
<ul>
<li><a href="http://www.mozilla.org/projects/nspr/">NSPR</a> 4.4.1 or
higher<br>
</li>
<li><a href="http://www.mozilla.org/projects/security/pki/nss/">NSS</a>
3.9.3 or higher<br>
</li>
<li>Mozilla <a href="http://www.mozilla.org/directory/csdk.html">LDAP
SDK</a> 5.15 or higher</li>
<li>Apache development package(s)</li>
<li><a href="http://directory.fedora.redhat.com/wiki/Mod_nss">mod_nss</a><br>
</li>
</ul>
mod_revocator will not work with earlier versions of NSS due to an API
change. <br>
<br>
<table style="width: 70%;" border="0" cellpadding="2" cellspacing="2">
<tbody>
<tr>
<td style="vertical-align: top; font-weight: bold;">Option<br>
</td>
<td style="vertical-align: top; font-weight: bold;">Description<br>
</td>
</tr>
<tr>
<td>--with-apr-config</td>
<td>Use apr-config to determine the APR directory</td>
</tr>
<tr>
<td>--with-apxs=PATH</td>
<td>Path to apxs</td>
</tr>
<tr>
<td>--with-nspr=PATH</td>
<td>Netscape Portable Runtime (NSPR) directory</td>
</tr>
<tr>
<td>--with-nspr-inc=PATH</td>
<td>Netscape Portable Runtime (NSPR) include file directory</td>
</tr>
<tr>
<td>--with-nspr-lib=PATH</td>
<td>Netscape Portable Runtime (NSPR) library directory</td>
</tr>
<tr>
<td>--with-nss=PATH</td>
<td>Network Security Services (NSS) directory</td>
</tr>
<tr>
<td>--with-nss-inc=PATH</td>
<td>Network Security Services (NSS) include directory</td>
</tr>
<tr>
<td>--with-nss-lib=PATH</td>
<td>Network Security Services (NSS) library directory</td>
</tr>
<tr>
<td>--with-ldapsdk=PATH</td>
<td>LDAP SDK directory</td>
</tr>
<tr>
<td>--with-ldapsdk-inc=PATH</td>
<td>Mozilla LDAP SDK include directory</td>
</tr>
<tr>
<td>--with-ldapsdk-lib=PATH</td>
<td>Mozilla LDAP SDK library directory</td>
</tr>
</tbody>
</table>
<br>
<br>
The --with-nspr, --with-nss and --with-ldapsdk tags require that the
package be installed in the same parent directory (e.g. /opt/nspr,
/usr/local/nspr, etc). It will look in this parent for include/, lib/,
etc. Alternatively you can use -inc and -lib to specify separate
locations for each one (--with-nspr-inc, --with-nspr-lib,
--with-nss-inc, etc). <br>
<br>
If --with-nss or --with-nspr and/or --with-ldapsdk are not passed
configure will look for the [nss|nspr|mozldap]-devel packages and use
the libraries with that if found.<br>
<br>
A sample configure might look something like: <br>
<br>
<code>% ./configure --with-apxs[=/path/to/apxs/]
--with-nspr=/path/to/nspr/ --with-nss=/path/to/nss/
--with-ldapsdk=/path/to/ldapsdk <br>
% gmake all install <br>
</code><br>
You only need to use =/path/to/apxs if apxs isn't in your path or if
you want to install into a specific Apache installation. <br>
<br>
This just installs the library librevocation.so. You will need to
manually install the Apache module at this point. A sample
configuration file is provided in revocator.conf. <br>
<br>
NSPR and NSS are both included with Fedora Core 5 but it doesn't ship
the Mozilla LDAP SDK.
<br>
<h1><a name="Configuration_Directives"></a>Configuration Directives</h1>
<big><big>CRLEngine</big></big><br>
<br>
This boolean turns on/off CRL revocation. This actives the automatic
CRL retrieval for this server. <br>
<br>
<big><big>CRLUpdateCritical</big></big><br>
<br>
Shut down server if CRL updates fail (for example, if the remote URL is
not accessible).<br>
<br>
<big><big>CRLAgeCheck</big></big><br>
<br>
Boolean that when enabled will shut down server if CRLs are too old.
The server will shut down if the age of a downloaded CRL exceeds the
time specified in its Next Update field. This condition indicates that
the CRL may not contain the most recent information available. To avoid
the possibility of users authenticating with compromised certificates
that would have been added to an up-to-date CRL, you can choose to have
the server shut down automatically when a CRL is considered too old. <br>
<br>
This check is performed when the CRL is downloaded. Therefore, an
already downloaded CRL can become older than its Next Update time in
the interval between updates and still be considered valid. This
feature does not apply to CRLs that do not have a Next Update field. <br>
<br>
<big><big>CRLFile</big></big><br>
<br>
A space-delimited list of protocol://urldata;update_interval;max_age If
multiple remote locations are listed then the value will need to be
enclosed in double-quotes. <br>
<br>
<span style="font-weight: bold;">urldata</span> specifies the URL(s) of
remote CRLs to retrieve and install. mod_revocator can download CRLs
over HTTP, HTTP over SSL, LDAP, and LDAP over SSL. You can also specify
a binary executable to retrieve the data. This executable must return
the data via stdout. The executable option is primarily to work around
LDAP library resolution problem but any executable may be used. For
LDAP you may only retrieve one attribute. Valid URL formats are: <br>
<br>
<ul>
<li>ldap[s]://hostname:port/base_dn?attributes?scope?filter </li>
</ul>
<div style="margin-left: 40px;">For example: <br>
</div>
<br>
<div style="margin-left: 40px;">ldap://ldap.example.com:5000/o=example.net?usercertificate%3binary
telephoneNumber?sub?(sn=Jensen)?? <br>
</div>
<ul>
<li>http[s]://username:password@hostname:port/path[?query_string] </li>
</ul>
<div style="margin-left: 40px;">For example: <br>
<br>
https://ca.example.com:1025/getCRL?op=getCRL&issuepoint=MasterCRL <br>
</div>
<ul>
<li>exec://path/to/program|argument1|...|argumentn </li>
</ul>
<div style="margin-left: 40px;">For example: <br>
<br>
exec:///opt/fortitude/bin/ldapget|ldap://ldap.example.com:3389/
o=example.com?userCertificate%3bbinary?sub?(uid=crl)?? <br>
<br>
The ldapget program is supplied to demonstrate how this works and to
provide LDAP/S support. The usage for ldapget is: <br>
<br>
/path/to/ldapget [/path/to/certdatabase] ldap://... <br>
</div>
<br>
<span style="font-weight: bold;">update_interval</span> specifies the
maximum amount of time in minutes to allow between CRL downloads. <br>
<br>
At startup, mod_revocator downloads all CRLs configured for automatic
downloading. To determine the time of the next download, mod_revocator
uses this value or the time specified in the Next Update field of the
CRL, whichever is sooner. Not all CRLs have a Next Update field,
however, so you must specify an update interval for each CRL. <br>
<br>
To determine an appropriate update interval, consider the network
connectivity and available bandwidth at your site and how often the CRL
is updated. If you it is critcal to have up-to-date revocation
information then OCSP is probably a better way to go.<br>
<br>
<span style="font-weight: bold;">max_age</span> specifies the time in
minutes you want mod_revocator to wait past the time indicated in the
CRL's Next Update field before determining that the CRL is too old to
be valid. <br>
<br>
To avoid unnecessary shutdowns it is recommended that you set this
value no lower than 5 minutes and take into account possible system
time differences between the server host and the CA's CRL download
server. <br>
<br>
If you have not enabled the option <code>CRLUpdateCritical</code> then
the value specified in this field has no impact. A good starting value
is 60 minutes. <br>
<br>
A sample configuration might look like: <br>
<br>
<div style="margin-left: 40px;"><code>CRLEngine on </code><br>
<code>CRLFile http://somehost.example.com/MasterCRL.crl;60;60 </code><br>
<code>CRLAgeCheck off </code><br>
<code>CRLUpdateCritical off
</code><br>
</div>
<h1><a name="Developer_Information"></a>Developer Information </h1>
This module uses some internals from NSS. This is normally a big no-no
but there was no other way to get around it. As such a private copy of
some of the NSS include files can be found in the mozilla subdirectory.
If you use a version of NSS other than 3.9.3 then you should replace
the files in this directory with appropriate files from whatever
version you are using. NSS 3.9.3 introduced a new locking mechanism for
PKCS#11 modules. As such the CKFW interface changed slightly so the
nsprstub.cpp in this module will not work with previous versions of
NSS.
<br>
</body>
</html>
17 years, 7 months
[Fedora-directory-commits] mod_nss/docs mod_nss.html,1.10,1.11
by Doctor Conrad
Author: rcritten
Update of /cvs/dirsec/mod_nss/docs
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv32411
Modified Files:
mod_nss.html
Log Message:
Add information about ECC including required versions of NSPR and NSS
and the available ciphers.
Clarify starting up Apache without requiring user intervention.
Fix a few bad links to NSPR.
Index: mod_nss.html
===================================================================
RCS file: /cvs/dirsec/mod_nss/docs/mod_nss.html,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- mod_nss.html 3 Oct 2005 14:59:26 -0000 1.10
+++ mod_nss.html 5 Sep 2006 14:58:56 -0000 1.11
@@ -50,7 +50,8 @@
<h1><a name="Building"></a>Building</h1>
Refer to the README file included with the distribution.<br>
<br>
-To build you'll need <a href="NSPR">NSPR</a> 4.4.1 or above and <a
+To build you'll need <a href="http://www.mozilla.org/projects/nspr/">NSPR</a>
+4.4.1 or above and <a
href="http://www.mozilla.org/projects/security/pki/nss/">NSS</a> 3.9.2
or above.
It may work with earlier versions but these are recommended (or
@@ -60,9 +61,15 @@
/usr/local/nspr, etc). It will look in this parent for include/ and
lib/, etc.<br>
<br>
+To build with ECC support you need <a
+ href="http://www.mozilla.org/projects/nspr/">NSPR</a> 4.6.2 or higher
+and <a href="http://www.mozilla.org/projects/security/pki/nss/">NSS</a>
+3.11.2 or higher.<br>
+<br>
You will also need the <a
href="http://www.mozilla.org/projects/security/pki/nss/">NSS</a> and <a
- href="NSPR">NSPR</a> directories in your library search
+ href="http://www.mozilla.org/projects/nspr/">NSPR</a> directories in
+your library search
path (either /etc/ld.so.conf or LD_LIBRARY_PATH) to link and run the
module.<br>
<br>
@@ -134,6 +141,19 @@
tells us where the APR include files and libraries are located<br>
</td>
</tr>
+ <tr>
+ <td style="vertical-align: top;">--enable-ssl2<br>
+ </td>
+ <td style="vertical-align: top;">SSLv2 is disabled by default.<br>
+ </td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">--enable-ecc<br>
+ </td>
+ <td style="vertical-align: top;">Enable Elliptical Curve
+Cryptography. Disabled by default.<br>
+ </td>
+ </tr>
</tbody>
</table>
<br>
@@ -232,6 +252,22 @@
token password.<br>
<br>
All other output will be written to the Apache log files.<br>
+<br>
+To avoid being prompted for a startup password you can either:<br>
+<ul>
+ <li>Use a password file that contains your token passwords. See <small><small><font
+ size="+2"><small><small>NSSPassPhraseDialog for details.</small></small></font></small></small></li>
+ <li><small><small><font size="+2"><small><small>Change the internal
+token password to a blank with: <br>
+ </small></small></font></small></small></li>
+</ul>
+<div style="margin-left: 40px;"><small><small><font size="+2"><small><small><code>%
+modutil -dbdir /path/to/database/directory -changepw "NSS Certificate
+DB"</code><br>
+<br>
+Enter the old password then press Enter twice for the new password to
+blank it out.<br>
+</small></small></font></small></small></div>
<h1><a name="Migration"></a>Migration</h1>
A perl script, <code>migrate,pl</code>, is included to help migrate an
existing mod_ssl configuration to work with mod_nss. There is one
@@ -331,6 +367,22 @@
<br>
<code>NSSCertificateDatabase /etc/httpd/conf/nss</code><br>
<br>
+<big><big>NSSDBPrefix</big></big><br>
+<br>
+Normally a certificate database consists of 3 files: cert8.db, key3.db
+and secmod.db. This directive allows you to add a named prefix to the
+filenames of cert8.db and key3.db so you can store multiple databases
+in one directory. <br>
+<br>
+<span style="font-weight: bold;">Example</span><br>
+<br>
+<code>NSSDBPrefix my-prefix-<br>
+<br>
+You would then need: my-prefix-cert8.db, my-prefix-key3.db and secmod.db<br>
+<br>
+In order to work with files with a prefix using the NSS command-line
+tools use the -P flag.<br>
+</code><br>
<font size="+2">NSSSessionCacheSize</font><br>
<br>
Specifies the number of SSL sessions that can be cached. <br>
@@ -386,7 +438,7 @@
If the number of bytes to read is specified it just reads that amount.
Be aware that some operating systems block on /dev/random if not enough
entropy is available. This means that the server will wait until that
-data is available to continue startup. These systems generally offer a
+/data is available to continue startup. These systems generally offer a
non-blocking device as well, /dev/urandom.</li>
<li><code>exec:/path/to/program: Executes the given program and takes
the stdout of it as the entryop. If the bytes argument is included it
@@ -459,7 +511,7 @@
<br>
Available ciphers are:<br>
<br>
-<table style="width: 50%; text-align: left;" border="1" cellpadding="2"
+<table style="width: 70%; text-align: left;" border="1" cellpadding="2"
cellspacing="2">
<tbody>
<tr>
@@ -630,6 +682,147 @@
</tbody>
</table>
<br>
+Additionally there are a number of ECC ciphers:<br>
+<br>
+<table style="width: 70%;" border="1" cellpadding="2" cellspacing="2">
+ <tbody>
+ <tr>
+ <td style="vertical-align: top; font-weight: bold;">Cipher Name<br>
+ </td>
+ <td style="vertical-align: top; font-weight: bold;">NSS Cipher
+Definition<br>
+ </td>
+ <td style="vertical-align: top; font-weight: bold;">Protocol<br>
+ </td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_null_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_NULL_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_rc4_128_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_RC4_128_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_3des_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_aes_128_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_aes_256_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_null_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_NULL_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_rc4_128_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_RC4_128_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_3des_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_aes_128_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_aes_256_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_null_sha</td>
+ <td>TLS_ECDH_RSA_WITH_NULL_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_128_sha</td>
+ <td>TLS_ECDH_RSA_WITH_RC4_128_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_3des_sha</td>
+ <td>TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_aes_128_sha</td>
+ <td>TLS_ECDH_RSA_WITH_AES_128_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_aes_256_sha</td>
+ <td>TLS_ECDH_RSA_WITH_AES_256_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>echde_rsa_null</td>
+ <td>TLS_ECDHE_RSA_WITH_NULL_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_rsa_rc4_128_sha</td>
+ <td>TLS_ECDHE_RSA_WITH_RC4_128_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_rsa_3des_sha</td>
+ <td>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_rsa_aes_128_sha</td>
+ <td>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdhe_rsa_aes_256_sha</td>
+ <td>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_null_sha</td>
+ <td>TLS_ECDH_anon_WITH_NULL_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_rc4_128sha</td>
+ <td>TLS_ECDH_anon_WITH_RC4_128_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_3des_sha</td>
+ <td>TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_aes_128_sha</td>
+ <td>TLS_ECDH_anon_WITH_AES_128_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_aes_256_sha</td>
+ <td>TLS_ECDH_anon_WITH_AES_256_CBC_SHA</td>
+ <td>TLSv1</td>
+ </tr>
+ </tbody>
+</table>
+<br>
<span style="font-weight: bold;">Example</span><br>
<br>
<code>NSSCipherSuite
@@ -651,7 +844,7 @@
</ul>
Note that this differs from mod_ssl in that you can't add or subtract
protocols.<br>
-<a href="#SSLv2">SSLv2</a> is not supported at this time.<br>
+<a href="#SSLv2">SSLv2</a> is not supported by default at this time.<br>
<br>
<span style="font-weight: bold;">Example</span><br>
<br>
@@ -670,7 +863,23 @@
style="font-weight: bold;">
<br>
<code>NSSNickname Server-Cert</code><br>
-<code>NSSNickname "This contains a space"</code><br>
+<code>NSSNickname "This contains a space"<br>
+<br>
+NOTE: There is nothing magical about the string "Server-Cert." A
+nickname can be anything. Historically this was Server-Cert in the
+Netscape server products that used NSS.<br>
+<br>
+</code><big><big>NSSECCNickname</big></big><br>
+<br>
+Similar to NSSNickname but designed for use with ECC certificates. This
+allows you to have both an RSA certificate and an ECC certificate
+available on the same listening port. This allows newer clients that
+support ECC to connect with those ciphers but also allows older clients
+to connect with an RSA cipher.<br>
+<br>
+<span style="font-weight: bold;">Example</span><br>
+<br>
+<code>NSSNickname Server-Cert-ECC</code><br>
<br>
<big><big>NSSEnforceValidCerts</big></big><br>
<br>
@@ -930,6 +1139,13 @@
time</td>
</tr>
<tr>
+ <td style="vertical-align: top;"><code>SSL_CLIENT_V_REMAIN</code><br>
+ </td>
+ <td style="vertical-align: top;">Number of days that the
+certificate is valid<br>
+ </td>
+ </tr>
+ <tr>
<td style="vertical-align: top; width: 45%;"><code>SSL_CLIENT_M_VERSION<br>
</code></td>
<td style="vertical-align: top;">X.509 version of the client
17 years, 7 months