From e7b49aea07701ac8e541c314351b242b3caaa78a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 08:38:45 +0100 Subject: [PATCH 01/50] mod_remoteip: fix NULL dereference with PROXY v2 LOCAL command * modules/metadata/mod_remoteip.c (remoteip_process_v2_header): Set conn_conf->client_addr and client_ip for the LOCAL case, matching the v1 UNKNOWN path. Assisted-by: Claude Sonnet 4.6 --- changes-entries/remoteip-proxy-v2-local.txt | 2 ++ modules/metadata/mod_remoteip.c | 2 ++ 2 files changed, 4 insertions(+) create mode 100644 changes-entries/remoteip-proxy-v2-local.txt diff --git a/changes-entries/remoteip-proxy-v2-local.txt b/changes-entries/remoteip-proxy-v2-local.txt new file mode 100644 index 00000000000..c2b240b7e3c --- /dev/null +++ b/changes-entries/remoteip-proxy-v2-local.txt @@ -0,0 +1,2 @@ + *) mod_remoteip: Fix crash with PROXY v2 LOCAL command and + RemoteIPProxyProtocol enabled. [Joe Orton] diff --git a/modules/metadata/mod_remoteip.c b/modules/metadata/mod_remoteip.c index 27a42d3cd37..eaa2d7c7926 100644 --- a/modules/metadata/mod_remoteip.c +++ b/modules/metadata/mod_remoteip.c @@ -950,6 +950,8 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, switch (hdr->v2.ver_cmd & 0xF) { case 0x00: /* LOCAL command */ /* keep local connection address for LOCAL */ + conn_conf->client_addr = c->client_addr; + conn_conf->client_ip = c->client_ip; return HDR_DONE; case 0x01: /* PROXY command */ switch (hdr->v2.fam) { From ac2deae4b60ce0dbc9f1d85363d482e5c370901f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 08:39:16 +0100 Subject: [PATCH 02/50] mod_ssl: fix NULL dereference in OCSP responder URI parsing * modules/ssl/ssl_engine_ocsp.c (determine_responder_uri): Check u->scheme is non-NULL before calling ap_cstr_casecmp(), since apr_uri_parse() can succeed with a NULL scheme for scheme-less URIs. Assisted-by: Claude Sonnet 4.6 --- modules/ssl/ssl_engine_ocsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ssl/ssl_engine_ocsp.c b/modules/ssl/ssl_engine_ocsp.c index 539ed103eae..6a03fb41744 100644 --- a/modules/ssl/ssl_engine_ocsp.c +++ b/modules/ssl/ssl_engine_ocsp.c @@ -80,7 +80,7 @@ static apr_uri_t *determine_responder_uri(SSLSrvConfigRec *sc, X509 *cert, } rv = apr_uri_parse(p, s, u); - if (rv || !u->hostname) { + if (rv || !u->hostname || !u->scheme) { ap_log_cerror(APLOG_MARK, APLOG_DEBUG, rv, c, APLOGNO(01919) "failed to parse OCSP responder URI '%s'", s); return NULL; From 4d8d05143f40191c7cf14076a85d947343a61329 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 08:40:21 +0100 Subject: [PATCH 03/50] mod_cern_meta: reject HTTP framing headers in metadata files * modules/metadata/mod_cern_meta.c (scan_meta_file): Return a 500 error if a framing header is found in a .meta file rather than merging it into the response headers. Assisted-by: Claude Sonnet 4.6 --- changes-entries/cern-meta-header-injection.txt | 2 ++ modules/metadata/mod_cern_meta.c | 12 ++++++++++++ 2 files changed, 14 insertions(+) create mode 100644 changes-entries/cern-meta-header-injection.txt diff --git a/changes-entries/cern-meta-header-injection.txt b/changes-entries/cern-meta-header-injection.txt new file mode 100644 index 00000000000..2aef1eec926 --- /dev/null +++ b/changes-entries/cern-meta-header-injection.txt @@ -0,0 +1,2 @@ + *) mod_cern_meta: Reject HTTP framing headers in metadata files to prevent + response splitting. [Joe Orton] diff --git a/modules/metadata/mod_cern_meta.c b/modules/metadata/mod_cern_meta.c index 3f36b2dba8a..a150b3c9fa1 100644 --- a/modules/metadata/mod_cern_meta.c +++ b/modules/metadata/mod_cern_meta.c @@ -256,6 +256,18 @@ static int scan_meta_file(request_rec *r, apr_file_t *f) sscanf(l, "%d", &r->status); r->status_line = apr_pstrdup(r->pool, l); } + else if (!ap_cstr_casecmp(w, "Transfer-Encoding") + || !ap_cstr_casecmp(w, "Content-Length") + || !ap_cstr_casecmp(w, "Connection") + || !ap_cstr_casecmp(w, "Trailer") + || !ap_cstr_casecmp(w, "Upgrade") + || !ap_cstr_casecmp(w, "Keep-Alive") + || !ap_cstr_casecmp(w, "TE")) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10596) + "forbidden HTTP framing header '%s' in meta file: %s", + w, r->filename); + return HTTP_INTERNAL_SERVER_ERROR; + } else { apr_table_set(tmp_headers, w, l); } From a1f12b743f9d66d05b93b2fc5aa2471aca717f86 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 08:48:25 +0100 Subject: [PATCH 04/50] mod_ldap: fix race in LDAP URL cache child cache access * modules/ldap/util_ldap.c: Hold the LDAP cache lock continuously from URL node fetch through child cache access, closing the window where a concurrent request could free the node between unlock and re-lock. Re-fetch the URL node under the lock for write-back paths. Assisted-by: Claude Sonnet 4.6 --- changes-entries/ldap-url-cache-uaf.txt | 2 + modules/ldap/util_ldap.c | 341 +++++++++++++------------ 2 files changed, 173 insertions(+), 170 deletions(-) create mode 100644 changes-entries/ldap-url-cache-uaf.txt diff --git a/changes-entries/ldap-url-cache-uaf.txt b/changes-entries/ldap-url-cache-uaf.txt new file mode 100644 index 00000000000..669b188c25d --- /dev/null +++ b/changes-entries/ldap-url-cache-uaf.txt @@ -0,0 +1,2 @@ + *) mod_ldap: Fix intermittent worker crashes under concurrent + LDAP-authenticated requests. [Joe Orton] diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c index 00f9f91361a..8c3ed68fe2a 100644 --- a/modules/ldap/util_ldap.c +++ b/modules/ldap/util_ldap.c @@ -1013,11 +1013,10 @@ static int uldap_cache_comparedn(request_rec *r, util_ldap_connection_t *ldc, if (curl == NULL) { curl = util_ald_create_caches(st, url); } - ldap_cache_unlock(st, r); /* a simple compare? */ if (!compare_dn_on_server) { - /* unlock this read lock */ + ldap_cache_unlock(st, r); if (strcmp(dn, reqdn)) { ldc->reason = "DN Comparison FALSE (direct strcmp())"; return LDAP_COMPARE_FALSE; @@ -1030,22 +1029,18 @@ static int uldap_cache_comparedn(request_rec *r, util_ldap_connection_t *ldc, if (curl) { /* no - it's a server side compare */ - ldap_cache_lock(st, r); /* is it in the compare cache? */ newnode.reqdn = (char *)reqdn; node = util_ald_cache_fetch(curl->dn_compare_cache, &newnode); if (node != NULL) { /* If it's in the cache, it's good */ - /* unlock this read lock */ ldap_cache_unlock(st, r); ldc->reason = "DN Comparison TRUE (cached)"; return LDAP_COMPARE_TRUE; } - - /* unlock this read lock */ - ldap_cache_unlock(st, r); } + ldap_cache_unlock(st, r); start_over: if (failures > st->retries) { @@ -1104,18 +1099,21 @@ static int uldap_cache_comparedn(request_rec *r, util_ldap_connection_t *ldc, result = LDAP_COMPARE_FALSE; } else { - if (curl) { + { /* compare successful - add to the compare cache */ ldap_cache_lock(st, r); - newnode.reqdn = (char *)reqdn; - newnode.dn = (char *)dn; - - node = util_ald_cache_fetch(curl->dn_compare_cache, &newnode); - if ( (node == NULL) - || (strcmp(reqdn, node->reqdn) != 0) - || (strcmp(dn, node->dn) != 0)) - { - util_ald_cache_insert(curl->dn_compare_cache, &newnode); + curl = util_ald_cache_fetch(st->util_ldap_cache, &curnode); + if (curl) { + newnode.reqdn = (char *)reqdn; + newnode.dn = (char *)dn; + + node = util_ald_cache_fetch(curl->dn_compare_cache, &newnode); + if ( (node == NULL) + || (strcmp(reqdn, node->reqdn) != 0) + || (strcmp(dn, node->dn) != 0)) + { + util_ald_cache_insert(curl->dn_compare_cache, &newnode); + } } ldap_cache_unlock(st, r); } @@ -1158,11 +1156,9 @@ static int uldap_cache_compare(request_rec *r, util_ldap_connection_t *ldc, if (curl == NULL) { curl = util_ald_create_caches(st, url); } - ldap_cache_unlock(st, r); if (curl) { /* make a comparison to the cache */ - ldap_cache_lock(st, r); curtime = apr_time_now(); the_compare_node.dn = (char *)dn; @@ -1193,8 +1189,8 @@ static int uldap_cache_compare(request_rec *r, util_ldap_connection_t *ldc, ldc->reason = "Comparison no such attribute (cached)"; } else { - ldc->reason = apr_psprintf(r->pool, - "Comparison undefined: (%d): %s (adding to cache)", + ldc->reason = apr_psprintf(r->pool, + "Comparison undefined: (%d): %s (adding to cache)", result, ldap_err2string(result)); } @@ -1203,15 +1199,15 @@ static int uldap_cache_compare(request_rec *r, util_ldap_connection_t *ldc, /* and unlock this read lock */ ldap_cache_unlock(st, r); - ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, - "ldap_compare_s(%pp, %s, %s, %s) = %s (cached)", + ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, + "ldap_compare_s(%pp, %s, %s, %s) = %s (cached)", ldc->ldap, dn, attrib, value, ldap_err2string(result)); return result; } } - /* unlock this read lock */ - ldap_cache_unlock(st, r); } + /* unlock this read lock */ + ldap_cache_unlock(st, r); start_over: if (failures > st->retries) { @@ -1256,36 +1252,39 @@ static int uldap_cache_compare(request_rec *r, util_ldap_connection_t *ldc, if ((LDAP_COMPARE_TRUE == result) || (LDAP_COMPARE_FALSE == result) || (LDAP_NO_SUCH_ATTRIBUTE == result)) { - if (curl) { + { /* compare completed; caching result */ ldap_cache_lock(st, r); - the_compare_node.lastcompare = curtime; - the_compare_node.result = result; - the_compare_node.sgl_processed = 0; - the_compare_node.subgroupList = NULL; - - /* If the node doesn't exist then insert it, otherwise just update - * it with the last results - */ - compare_nodep = util_ald_cache_fetch(curl->compare_cache, + curl = util_ald_cache_fetch(st->util_ldap_cache, &curnode); + if (curl) { + the_compare_node.lastcompare = curtime; + the_compare_node.result = result; + the_compare_node.sgl_processed = 0; + the_compare_node.subgroupList = NULL; + + /* If the node doesn't exist then insert it, otherwise just update + * it with the last results + */ + compare_nodep = util_ald_cache_fetch(curl->compare_cache, + &the_compare_node); + if ( (compare_nodep == NULL) + || (strcmp(the_compare_node.dn, compare_nodep->dn) != 0) + || (strcmp(the_compare_node.attrib,compare_nodep->attrib) != 0) + || (strcmp(the_compare_node.value, compare_nodep->value) != 0)) + { + void *junk; + + junk = util_ald_cache_insert(curl->compare_cache, &the_compare_node); - if ( (compare_nodep == NULL) - || (strcmp(the_compare_node.dn, compare_nodep->dn) != 0) - || (strcmp(the_compare_node.attrib,compare_nodep->attrib) != 0) - || (strcmp(the_compare_node.value, compare_nodep->value) != 0)) - { - void *junk; - - junk = util_ald_cache_insert(curl->compare_cache, - &the_compare_node); - if (junk == NULL) { - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01287) - "cache_compare: Cache insertion failure."); + if (junk == NULL) { + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01287) + "cache_compare: Cache insertion failure."); + } + } + else { + compare_nodep->lastcompare = curtime; + compare_nodep->result = result; } - } - else { - compare_nodep->lastcompare = curtime; - compare_nodep->result = result; } ldap_cache_unlock(st, r); } @@ -1555,11 +1554,9 @@ static int uldap_cache_check_subgroups(request_rec *r, ldap_cache_lock(st, r); curnode.url = url; curl = util_ald_cache_fetch(st->util_ldap_cache, &curnode); - ldap_cache_unlock(st, r); if (curl && curl->compare_cache) { /* make a comparison to the cache */ - ldap_cache_lock(st, r); the_compare_node.dn = (char *)dn; the_compare_node.attrib = (char *)"objectClass"; @@ -1601,8 +1598,8 @@ static int uldap_cache_check_subgroups(request_rec *r, } } } - ldap_cache_unlock(st, r); } + ldap_cache_unlock(st, r); if (!tmp_local_sgl && !sgl_cached_empty) { /* No Cached SGL, retrieve from LDAP */ @@ -1616,72 +1613,74 @@ static int uldap_cache_check_subgroups(request_rec *r, dn); } - if (curl && curl->compare_cache) { + { /* * Find the generic group cache entry and add the sgl we just retrieved. */ ldap_cache_lock(st, r); + curl = util_ald_cache_fetch(st->util_ldap_cache, &curnode); + if (curl && curl->compare_cache) { + the_compare_node.dn = (char *)dn; + the_compare_node.attrib = (char *)"objectClass"; + the_compare_node.value = (char *)sgc_ents[base_sgcIndex].name; + the_compare_node.result = 0; + the_compare_node.sgl_processed = 0; + the_compare_node.subgroupList = NULL; - the_compare_node.dn = (char *)dn; - the_compare_node.attrib = (char *)"objectClass"; - the_compare_node.value = (char *)sgc_ents[base_sgcIndex].name; - the_compare_node.result = 0; - the_compare_node.sgl_processed = 0; - the_compare_node.subgroupList = NULL; - - compare_nodep = util_ald_cache_fetch(curl->compare_cache, - &the_compare_node); - - if (compare_nodep == NULL) { - /* - * The group entry we want to attach our SGL to doesn't exist. - * We only got here if we verified this DN was actually a group - * based on the objectClass, but we can't call the compare function - * while we already hold the cache lock -- only the insert. - */ - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01291) - "Cache entry for %s doesn't exist", dn); - the_compare_node.result = LDAP_COMPARE_TRUE; - util_ald_cache_insert(curl->compare_cache, &the_compare_node); compare_nodep = util_ald_cache_fetch(curl->compare_cache, &the_compare_node); - if (compare_nodep == NULL) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01292) - "util_ldap: Couldn't retrieve group entry " - "for %s from cache", - dn); - } - } - /* - * We have a valid cache entry and a locally generated SGL. - * Attach the SGL to the cache entry - */ - if (compare_nodep && !compare_nodep->sgl_processed) { - if (!tmp_local_sgl) { - /* We looked up an SGL for a group and found it to be empty */ - if (compare_nodep->subgroupList == NULL) { - compare_nodep->sgl_processed = 1; + if (compare_nodep == NULL) { + /* + * The group entry we want to attach our SGL to doesn't exist. + * We only got here if we verified this DN was actually a group + * based on the objectClass, but we can't call the compare function + * while we already hold the cache lock -- only the insert. + */ + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01291) + "Cache entry for %s doesn't exist", dn); + the_compare_node.result = LDAP_COMPARE_TRUE; + util_ald_cache_insert(curl->compare_cache, &the_compare_node); + compare_nodep = util_ald_cache_fetch(curl->compare_cache, + &the_compare_node); + if (compare_nodep == NULL) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01292) + "util_ldap: Couldn't retrieve group entry " + "for %s from cache", + dn); } } - else { - util_compare_subgroup_t *sgl_copy = - util_ald_sgl_dup(curl->compare_cache, tmp_local_sgl); - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, APLOGNO(01293) - "Copying local SGL of len %d for group %s into cache", - tmp_local_sgl->len, dn); - if (sgl_copy) { - if (compare_nodep->subgroupList) { - util_ald_sgl_free(curl->compare_cache, - &(compare_nodep->subgroupList)); + + /* + * We have a valid cache entry and a locally generated SGL. + * Attach the SGL to the cache entry + */ + if (compare_nodep && !compare_nodep->sgl_processed) { + if (!tmp_local_sgl) { + /* We looked up an SGL for a group and found it to be empty */ + if (compare_nodep->subgroupList == NULL) { + compare_nodep->sgl_processed = 1; } - compare_nodep->subgroupList = sgl_copy; - compare_nodep->sgl_processed = 1; } else { - ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(01294) - "Copy of SGL failed to obtain shared memory, " - "couldn't update cache"); + util_compare_subgroup_t *sgl_copy = + util_ald_sgl_dup(curl->compare_cache, tmp_local_sgl); + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, APLOGNO(01293) + "Copying local SGL of len %d for group %s into cache", + tmp_local_sgl->len, dn); + if (sgl_copy) { + if (compare_nodep->subgroupList) { + util_ald_sgl_free(curl->compare_cache, + &(compare_nodep->subgroupList)); + } + compare_nodep->subgroupList = sgl_copy; + compare_nodep->sgl_processed = 1; + } + else { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(01294) + "Copy of SGL failed to obtain shared memory, " + "couldn't update cache"); + } } } } @@ -1770,10 +1769,8 @@ static int uldap_cache_checkuserid(request_rec *r, util_ldap_connection_t *ldc, if (curl == NULL) { curl = util_ald_create_caches(st, url); } - ldap_cache_unlock(st, r); if (curl) { - ldap_cache_lock(st, r); the_search_node.username = filter; search_nodep = util_ald_cache_fetch(curl->search_cache, &the_search_node); @@ -1810,9 +1807,9 @@ static int uldap_cache_checkuserid(request_rec *r, util_ldap_connection_t *ldc, return LDAP_SUCCESS; } } - /* unlock this read lock */ - ldap_cache_unlock(st, r); } + /* unlock this read lock */ + ldap_cache_unlock(st, r); /* * At this point, there is no valid cached search, so lets do the search. @@ -1969,37 +1966,40 @@ static int uldap_cache_checkuserid(request_rec *r, util_ldap_connection_t *ldc, /* * Add the new username to the search cache. */ - if (curl) { + { ldap_cache_lock(st, r); - the_search_node.username = filter; - the_search_node.dn = *binddn; - the_search_node.bindpw = bindpw; - the_search_node.lastbind = apr_time_now(); - the_search_node.vals = vals; - the_search_node.numvals = numvals; - - /* Search again to make sure that another thread didn't ready insert - * this node into the cache before we got here. If it does exist then - * update the lastbind - */ - search_nodep = util_ald_cache_fetch(curl->search_cache, - &the_search_node); - if ((search_nodep == NULL) || - (strcmp(*binddn, search_nodep->dn) != 0)) { + curl = util_ald_cache_fetch(st->util_ldap_cache, &curnode); + if (curl) { + the_search_node.username = filter; + the_search_node.dn = *binddn; + the_search_node.bindpw = bindpw; + the_search_node.lastbind = apr_time_now(); + the_search_node.vals = vals; + the_search_node.numvals = numvals; + + /* Search again to make sure that another thread didn't ready insert + * this node into the cache before we got here. If it does exist then + * update the lastbind + */ + search_nodep = util_ald_cache_fetch(curl->search_cache, + &the_search_node); + if ((search_nodep == NULL) || + (strcmp(*binddn, search_nodep->dn) != 0)) { - /* Nothing in cache, insert new entry */ - util_ald_cache_insert(curl->search_cache, &the_search_node); - } - else if ((!search_nodep->bindpw) || - (strcmp(bindpw, search_nodep->bindpw) != 0)) { + /* Nothing in cache, insert new entry */ + util_ald_cache_insert(curl->search_cache, &the_search_node); + } + else if ((!search_nodep->bindpw) || + (strcmp(bindpw, search_nodep->bindpw) != 0)) { - /* Entry in cache is invalid, remove it and insert new one */ - util_ald_cache_remove(curl->search_cache, search_nodep); - util_ald_cache_insert(curl->search_cache, &the_search_node); - } - else { - /* Cache entry is valid, update lastbind */ - search_nodep->lastbind = the_search_node.lastbind; + /* Entry in cache is invalid, remove it and insert new one */ + util_ald_cache_remove(curl->search_cache, search_nodep); + util_ald_cache_insert(curl->search_cache, &the_search_node); + } + else { + /* Cache entry is valid, update lastbind */ + search_nodep->lastbind = the_search_node.lastbind; + } } ldap_cache_unlock(st, r); } @@ -2046,10 +2046,8 @@ static int uldap_cache_getuserdn(request_rec *r, util_ldap_connection_t *ldc, if (curl == NULL) { curl = util_ald_create_caches(st, url); } - ldap_cache_unlock(st, r); if (curl) { - ldap_cache_lock(st, r); the_search_node.username = filter; search_nodep = util_ald_cache_fetch(curl->search_cache, &the_search_node); @@ -2080,9 +2078,9 @@ static int uldap_cache_getuserdn(request_rec *r, util_ldap_connection_t *ldc, return LDAP_SUCCESS; } } - /* unlock this read lock */ - ldap_cache_unlock(st, r); } + /* unlock this read lock */ + ldap_cache_unlock(st, r); /* * At this point, there is no valid cached search, so lets do the search. @@ -2178,35 +2176,38 @@ static int uldap_cache_getuserdn(request_rec *r, util_ldap_connection_t *ldc, /* * Add the new username to the search cache. */ - if (curl) { + { ldap_cache_lock(st, r); - the_search_node.username = filter; - the_search_node.dn = *binddn; - the_search_node.bindpw = NULL; - the_search_node.lastbind = apr_time_now(); - the_search_node.vals = vals; - the_search_node.numvals = numvals; - - /* Search again to make sure that another thread didn't ready insert - * this node into the cache before we got here. If it does exist then - * update the lastbind - */ - search_nodep = util_ald_cache_fetch(curl->search_cache, - &the_search_node); - if ((search_nodep == NULL) || - (strcmp(*binddn, search_nodep->dn) != 0)) { + curl = util_ald_cache_fetch(st->util_ldap_cache, &curnode); + if (curl) { + the_search_node.username = filter; + the_search_node.dn = *binddn; + the_search_node.bindpw = NULL; + the_search_node.lastbind = apr_time_now(); + the_search_node.vals = vals; + the_search_node.numvals = numvals; + + /* Search again to make sure that another thread didn't ready insert + * this node into the cache before we got here. If it does exist then + * update the lastbind + */ + search_nodep = util_ald_cache_fetch(curl->search_cache, + &the_search_node); + if ((search_nodep == NULL) || + (strcmp(*binddn, search_nodep->dn) != 0)) { - /* Nothing in cache, insert new entry */ - util_ald_cache_insert(curl->search_cache, &the_search_node); - } - /* - * Don't update lastbind on entries with bindpw because - * we haven't verified that password. It's OK to update - * the entry if there is no password in it. - */ - else if (!search_nodep->bindpw) { - /* Cache entry is valid, update lastbind */ - search_nodep->lastbind = the_search_node.lastbind; + /* Nothing in cache, insert new entry */ + util_ald_cache_insert(curl->search_cache, &the_search_node); + } + /* + * Don't update lastbind on entries with bindpw because + * we haven't verified that password. It's OK to update + * the entry if there is no password in it. + */ + else if (!search_nodep->bindpw) { + /* Cache entry is valid, update lastbind */ + search_nodep->lastbind = the_search_node.lastbind; + } } ldap_cache_unlock(st, r); } From b85e02461be91694337b6b4a9d39f2d447053f23 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 11:03:42 +0100 Subject: [PATCH 05/50] mod_ssl: fix set_challenge_creds() to return rv on failure * modules/ssl/ssl_engine_kernel.c (set_challenge_creds): Return rv rather than APR_SUCCESS unconditionally, so credential setup failures are propagated to the ALPN selection callback. Assisted-by: Claude Sonnet 4.6 --- modules/ssl/ssl_engine_kernel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c index 9ee25ec52ca..3e96f9efdac 100644 --- a/modules/ssl/ssl_engine_kernel.c +++ b/modules/ssl/ssl_engine_kernel.c @@ -2238,7 +2238,7 @@ static apr_status_t set_challenge_creds(conn_rec *c, const char *servername, cleanup: if (our_data && cert) X509_free(cert); if (our_data && key) EVP_PKEY_free(key); - return APR_SUCCESS; + return rv; } /* From 62c9f8fc6d0721501eaec81bd0ea0f16643f1ebf Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 11:08:02 +0100 Subject: [PATCH 06/50] mod_substitute: reject overflow values in SubstituteMaxLineLength * modules/filters/mod_substitute.c (set_max_line_length): Check that the parsed value does not exceed APR_INT64_MAX / multiplier before applying the K/M/G suffix, to avoid signed integer overflow UB. Assisted-by: Claude Sonnet 4.6 --- changes-entries/substitute-maxlinelength-overflow.txt | 2 ++ modules/filters/mod_substitute.c | 6 ++++++ 2 files changed, 8 insertions(+) create mode 100644 changes-entries/substitute-maxlinelength-overflow.txt diff --git a/changes-entries/substitute-maxlinelength-overflow.txt b/changes-entries/substitute-maxlinelength-overflow.txt new file mode 100644 index 00000000000..7ad53978121 --- /dev/null +++ b/changes-entries/substitute-maxlinelength-overflow.txt @@ -0,0 +1,2 @@ + *) mod_substitute: Fix SubstituteMaxLineLength to reject values too + large for the K/M/G suffix. [Joe Orton] diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c index 65ca5f95d01..ada62a6da16 100644 --- a/modules/filters/mod_substitute.c +++ b/modules/filters/mod_substitute.c @@ -777,12 +777,18 @@ static const char *set_max_line_length(cmd_parms *cmd, void *cfg, const char *ar rv = apr_strtoff(&max, arg, &end, 10); if (rv == APR_SUCCESS) { if ((*end == 'K' || *end == 'k') && !end[1]) { + if (max > APR_INT64_MAX / KBYTE) + return "SubstituteMaxLineLength value too large"; max *= KBYTE; } else if ((*end == 'M' || *end == 'm') && !end[1]) { + if (max > APR_INT64_MAX / MBYTE) + return "SubstituteMaxLineLength value too large"; max *= MBYTE; } else if ((*end == 'G' || *end == 'g') && !end[1]) { + if (max > APR_INT64_MAX / GBYTE) + return "SubstituteMaxLineLength value too large"; max *= GBYTE; } else if (*end && /* neither empty nor [Bb] */ From d1e04e6ffdc3d08612575d25380724b7d5c5c433 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 11:08:21 +0100 Subject: [PATCH 07/50] mod_substitute: fix heap over-read in set_pattern() delimiter scanning * modules/filters/mod_substitute.c (set_pattern): Guard the pre-incrementing delimiter scan loops with a NUL check, preventing a read past the end of the allocation when the from or to field has no closing delimiter. Assisted-by: Claude Sonnet 4.6 --- changes-entries/substitute-pattern-oob-read.txt | 2 ++ modules/filters/mod_substitute.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 changes-entries/substitute-pattern-oob-read.txt diff --git a/changes-entries/substitute-pattern-oob-read.txt b/changes-entries/substitute-pattern-oob-read.txt new file mode 100644 index 00000000000..55eea6f041b --- /dev/null +++ b/changes-entries/substitute-pattern-oob-read.txt @@ -0,0 +1,2 @@ + *) mod_substitute: Fix crash or misbehaviour when loading a Substitute + directive with a missing closing delimiter. [Joe Orton] diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c index ada62a6da16..2533d7dcd04 100644 --- a/modules/filters/mod_substitute.c +++ b/modules/filters/mod_substitute.c @@ -679,7 +679,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line) if (delim) from = ++ourline; if (from) { - if (*ourline != delim) { + if (*ourline && *ourline != delim) { while (*++ourline && *ourline != delim); } if (*ourline) { @@ -688,7 +688,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line) } } if (to) { - if (*ourline != delim) { + if (*ourline && *ourline != delim) { while (*++ourline && *ourline != delim); } if (*ourline) { From 56402b02be1ba03a8f1279ae9b51e2df7e8c9d21 Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Fri, 17 Jul 2026 11:34:20 +0000 Subject: [PATCH 08/50] add caution about client influence and delims git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936255 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/rewrite/flags.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/manual/rewrite/flags.xml b/docs/manual/rewrite/flags.xml index 1b9dce0d7b2..aa69daf326f 100644 --- a/docs/manual/rewrite/flags.xml +++ b/docs/manual/rewrite/flags.xml @@ -350,6 +350,13 @@ follows:

[CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly:samesite] + +Security Warning +

Exercise care when constructing the argument from backreferences or other +variable expansion. If any part of the argument is derived from user input, +a malicious request may include delimeters or other unexpected values.

+ +

If a literal ':' character is needed in any of the cookie fields, an alternate syntax is available. To opt-in to the alternate syntax, the cookie "Name" should be preceded with a ';' character, and field separators should be From 0e8f7b0c783e44df5ac813f467e0c99698bd763f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 12:07:47 +0000 Subject: [PATCH 09/50] Another candidate module to remove. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936257 13f79535-47bb-0310-9956-ffa450edef68 --- STATUS | 1 + 1 file changed, 1 insertion(+) diff --git a/STATUS b/STATUS index 2b83d0472bc..9eea5a3a8f9 100644 --- a/STATUS +++ b/STATUS @@ -104,6 +104,7 @@ THINGS THAT SHOULD BE CONSIDERED EARLY IN THE 2.6/3.0 DEVELOPMENT CYCLE: * Candidates to remove: - mod_access_compat - mod_imagemap + - mod_cern_meta - mod_privileges - mod_noloris - mod_ssl_ct From 5b9fe41e51593123a3125362b3c137d7661cc70f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 13:58:04 +0000 Subject: [PATCH 10/50] Use apr_isspace() instead of isspace() in cookie parsing * modules/proxy/mod_proxy_balancer.c (find_session_route): Replace isspace() with apr_isspace() to avoid locale-dependent behavior and undefined behavior with negative char values. Submitted by: arshsmith1 GitHub: closes #675 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936266 13f79535-47bb-0310-9956-ffa450edef68 --- modules/proxy/mod_proxy_balancer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c index bac659614e6..892bde38ae2 100644 --- a/modules/proxy/mod_proxy_balancer.c +++ b/modules/proxy/mod_proxy_balancer.c @@ -171,10 +171,10 @@ static char *get_cookie_param(request_rec *r, const char *name) if (start_cookie == cookies || start_cookie[-1] == ';' || start_cookie[-1] == ',' || - isspace(start_cookie[-1])) { + apr_isspace(start_cookie[-1])) { start_cookie += strlen(name); - while(*start_cookie && isspace(*start_cookie)) + while(*start_cookie && apr_isspace(*start_cookie)) ++start_cookie; if (*start_cookie++ == '=' && *start_cookie) { /* From 510a607da7c23fe14f51116ed2fcf7c6fd9235a4 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 14:20:18 +0000 Subject: [PATCH 11/50] Add sanity checks for slotmem size calculations: * modules/slotmem/mod_slotmem_plain.c, modules/slotmem/mod_slotmem_shm.c (slotmem_size_mul, slotmem_size_add): New helper functions for checked arithmetic on apr_size_t values. (slotmem_create): Use checked arithmetic for allocation size calculations to prevent integer overflow. (slotmem_grab): Add overflow check on size * id multiplication before pointer arithmetic. (slotmem_get): Validate dest_len against slot size before access, move inuse pointer dereference after bounds checks. (slotmem_put): Validate src_len against slot size before access, move inuse pointer dereference after bounds checks. * modules/slotmem/mod_slotmem_shm.c (slotmem_fgrab): Add overflow check on size * id multiplication before pointer arithmetic. (slotmem_attach): Validate shared memory segment size against expected size computed with checked arithmetic. Use basesize variable for inuse pointer calculation. Submitted by: metsw24-max GitHub: closes #626 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936268 13f79535-47bb-0310-9956-ffa450edef68 --- modules/slotmem/mod_slotmem_plain.c | 51 ++++++++++++++++--- modules/slotmem/mod_slotmem_shm.c | 78 ++++++++++++++++++++++++++--- 2 files changed, 115 insertions(+), 14 deletions(-) diff --git a/modules/slotmem/mod_slotmem_plain.c b/modules/slotmem/mod_slotmem_plain.c index 4c2b19b61da..e3460089641 100644 --- a/modules/slotmem/mod_slotmem_plain.c +++ b/modules/slotmem/mod_slotmem_plain.c @@ -38,6 +38,26 @@ struct ap_slotmem_instance_t { static struct ap_slotmem_instance_t *globallistmem = NULL; static apr_pool_t *gpool = NULL; +static int slotmem_size_mul(apr_size_t a, apr_size_t b, apr_size_t *res) +{ + if (a != 0 && b > ((apr_size_t)-1) / a) { + return 0; + } + + *res = a * b; + return 1; +} + +static int slotmem_size_add(apr_size_t a, apr_size_t b, apr_size_t *res) +{ + if (a > ((apr_size_t)-1) - b) { + return 0; + } + + *res = a + b; + return 1; +} + static apr_status_t slotmem_do(ap_slotmem_instance_t *mem, ap_slotmem_callback_fn_t *func, void *data, apr_pool_t *pool) { unsigned int i; @@ -67,10 +87,19 @@ static apr_status_t slotmem_create(ap_slotmem_instance_t **new, const char *name { ap_slotmem_instance_t *res; ap_slotmem_instance_t *next = globallistmem; - apr_size_t basesize = (item_size * item_num); + apr_size_t basesize; + apr_size_t inuse_size; + apr_size_t alloc_size; const char *fname; + if (!slotmem_size_mul(item_size, (apr_size_t)item_num, &basesize) + || !slotmem_size_mul((apr_size_t)item_num, sizeof(char), + &inuse_size) + || !slotmem_size_add(basesize, inuse_size, &alloc_size)) { + return APR_EINVAL; + } + if (name) { if (name[0] == ':') fname = name; @@ -97,7 +126,7 @@ static apr_status_t slotmem_create(ap_slotmem_instance_t **new, const char *name /* create the memory using the gpool */ res = (ap_slotmem_instance_t *) apr_pcalloc(gpool, sizeof(ap_slotmem_instance_t)); - res->base = apr_pcalloc(gpool, basesize + (item_num * sizeof(char))); + res->base = apr_pcalloc(gpool, alloc_size); if (!res->base) return APR_ENOSHMAVAIL; @@ -156,6 +185,10 @@ static apr_status_t slotmem_dptr(ap_slotmem_instance_t *score, unsigned int id, if (id >= score->num) return APR_EINVAL; + if (score->size != 0 + && (apr_size_t)id > ((apr_size_t)-1) / score->size) + return APR_EINVAL; + ptr = (char *)score->base + score->size * id; if (!ptr) return APR_ENOSHMAVAIL; @@ -172,11 +205,14 @@ static apr_status_t slotmem_get(ap_slotmem_instance_t *slot, unsigned int id, un if (!slot) { return APR_ENOSHMAVAIL; } - - inuse = slot->inuse + id; if (id >= slot->num) { return APR_EINVAL; } + if (dest_len > slot->size) { + return APR_EINVAL; + } + + inuse = slot->inuse + id; if (AP_SLOTMEM_IS_PREGRAB(slot) && !*inuse) { return APR_NOTFOUND; } @@ -198,11 +234,14 @@ static apr_status_t slotmem_put(ap_slotmem_instance_t *slot, unsigned int id, un if (!slot) { return APR_ENOSHMAVAIL; } - - inuse = slot->inuse + id; if (id >= slot->num) { return APR_EINVAL; } + if (src_len > slot->size) { + return APR_EINVAL; + } + + inuse = slot->inuse + id; if (AP_SLOTMEM_IS_PREGRAB(slot) && !*inuse) { return APR_NOTFOUND; } diff --git a/modules/slotmem/mod_slotmem_shm.c b/modules/slotmem/mod_slotmem_shm.c index 4d14faf36b4..46aca109706 100644 --- a/modules/slotmem/mod_slotmem_shm.c +++ b/modules/slotmem/mod_slotmem_shm.c @@ -72,6 +72,26 @@ struct ap_slotmem_instance_t { static struct ap_slotmem_instance_t *globallistmem = NULL; static apr_pool_t *gpool = NULL; +static int slotmem_size_mul(apr_size_t a, apr_size_t b, apr_size_t *res) +{ + if (a != 0 && b > ((apr_size_t)-1) / a) { + return 0; + } + + *res = a * b; + return 1; +} + +static int slotmem_size_add(apr_size_t a, apr_size_t b, apr_size_t *res) +{ + if (a > ((apr_size_t)-1) - b) { + return 0; + } + + *res = a + b; + return 1; +} + #define DEFAULT_SLOTMEM_PREFIX "slotmem-shm-" #define DEFAULT_SLOTMEM_SUFFIX ".shm" #define DEFAULT_SLOTMEM_PERSIST_SUFFIX ".persist" @@ -348,9 +368,10 @@ static apr_status_t slotmem_create(ap_slotmem_instance_t **new, ap_slotmem_instance_t *next = globallistmem; const char *fname, *pname = NULL; apr_shm_t *shm; - apr_size_t basesize = (item_size * item_num); - apr_size_t size = AP_SLOTMEM_OFFSET + AP_UNSIGNEDINT_OFFSET + - (item_num * sizeof(char)) + basesize; + apr_size_t header_size; + apr_size_t basesize; + apr_size_t inuse_size; + apr_size_t size; int persist = (type & AP_SLOTMEM_TYPE_PERSIST) != 0; apr_status_t rv; @@ -358,6 +379,14 @@ static apr_status_t slotmem_create(ap_slotmem_instance_t **new, if (gpool == NULL) { return APR_ENOSHMAVAIL; } + if (!slotmem_size_mul(item_size, (apr_size_t)item_num, &basesize) + || !slotmem_size_mul((apr_size_t)item_num, sizeof(char), &inuse_size) + || !slotmem_size_add(AP_SLOTMEM_OFFSET, AP_UNSIGNEDINT_OFFSET, + &header_size) + || !slotmem_size_add(header_size, inuse_size, &size) + || !slotmem_size_add(size, basesize, &size)) { + return APR_EINVAL; + } if (slotmem_filenames(pool, name, &fname, persist ? &pname : NULL)) { /* first try to attach to existing slotmem */ if (next) { @@ -483,6 +512,11 @@ static apr_status_t slotmem_attach(ap_slotmem_instance_t **new, sharedslotdesc_t *desc; const char *fname; apr_shm_t *shm; + apr_size_t header_size; + apr_size_t basesize; + apr_size_t inuse_size; + apr_size_t expected_size; + apr_size_t shm_size; apr_status_t rv; if (gpool == NULL) { @@ -524,6 +558,23 @@ static apr_status_t slotmem_attach(ap_slotmem_instance_t **new, /* Read the description of the slotmem */ desc = (sharedslotdesc_t *)apr_shm_baseaddr_get(shm); + + if (!slotmem_size_mul(desc->size, (apr_size_t)desc->num, &basesize) + || !slotmem_size_mul((apr_size_t)desc->num, sizeof(char), &inuse_size) + || !slotmem_size_add(AP_SLOTMEM_OFFSET, AP_UNSIGNEDINT_OFFSET, + &header_size) + || !slotmem_size_add(header_size, basesize, &expected_size) + || !slotmem_size_add(expected_size, inuse_size, &expected_size)) { + apr_shm_detach(shm); + return APR_EINVAL; + } + + shm_size = apr_shm_size_get(shm); + if (expected_size > shm_size) { + apr_shm_detach(shm); + return APR_EINVAL; + } + ptr = (char *)desc + AP_SLOTMEM_OFFSET; /* For the chained slotmem stuff */ @@ -537,7 +588,7 @@ static apr_status_t slotmem_attach(ap_slotmem_instance_t **new, res->base = (void *)ptr; res->desc = desc; res->gpool = gpool; - res->inuse = ptr + (desc->size * desc->num); + res->inuse = ptr + basesize; res->next = NULL; *new = res; @@ -562,6 +613,11 @@ static apr_status_t slotmem_dptr(ap_slotmem_instance_t *slot, return APR_EINVAL; } + if (slot->desc->size != 0 + && (apr_size_t)id > ((apr_size_t)-1) / slot->desc->size) { + return APR_EINVAL; + } + ptr = (char *)slot->base + slot->desc->size * id; if (!ptr) { return APR_ENOSHMAVAIL; @@ -580,11 +636,14 @@ static apr_status_t slotmem_get(ap_slotmem_instance_t *slot, unsigned int id, if (!slot) { return APR_ENOSHMAVAIL; } - - inuse = slot->inuse + id; if (id >= slot->desc->num) { return APR_EINVAL; } + if (dest_len > slot->desc->size) { + return APR_EINVAL; + } + + inuse = slot->inuse + id; if (AP_SLOTMEM_IS_PREGRAB(slot) && !*inuse) { return APR_NOTFOUND; } @@ -607,11 +666,14 @@ static apr_status_t slotmem_put(ap_slotmem_instance_t *slot, unsigned int id, if (!slot) { return APR_ENOSHMAVAIL; } - - inuse = slot->inuse + id; if (id >= slot->desc->num) { return APR_EINVAL; } + if (src_len > slot->desc->size) { + return APR_EINVAL; + } + + inuse = slot->inuse + id; if (AP_SLOTMEM_IS_PREGRAB(slot) && !*inuse) { return APR_NOTFOUND; } From f14a28e44f7ab4ede18ca930e91d17b90cd2aa63 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 14:42:31 +0000 Subject: [PATCH 12/50] CI: Restrict workflow permissions to read-only content access. Submitted by: Alb3e3 <74142887+Alb3e3 users.noreply.github.com> GitHub: closes #670 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936269 13f79535-47bb-0310-9956-ffa450edef68 --- .github/workflows/linux.yml | 3 +++ .github/workflows/windows.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 8f7e24e412b..68c34e97460 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -22,6 +22,9 @@ on: - '**.md' - changes-entries/* +permissions: + contents: read + env: MARGS: "-j2" CFLAGS: "-g" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 5922cc68a51..7ca926c4dac 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -22,6 +22,9 @@ on: - '**.md' - changes-entries/* +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} From 0b63cfb5b81571aebd45559ad8d4e3f3eacb67b2 Mon Sep 17 00:00:00 2001 From: Jim Jagielski Date: Fri, 17 Jul 2026 15:49:01 +0000 Subject: [PATCH 13/50] Make the Python test suites more robust: o Call location independence o Fully support pip or uv o Better reporting of test results when both suites are run o Support postitional args for test cases in a reliable manner git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936270 13f79535-47bb-0310-9956-ffa450edef68 --- test/README | 22 +++++++----- test/pyhttpd/runtests.sh | 66 ++++++++++++++++++++++++++++++----- test/pytest_suite/runtests.sh | 34 ++++++++++++------ test/run-all-tests.sh | 38 ++++++++++++++++++-- 4 files changed, 129 insertions(+), 31 deletions(-) diff --git a/test/README b/test/README index 3ccdc201398..e1e4eb92995 100644 --- a/test/README +++ b/test/README @@ -73,20 +73,24 @@ The runner exits non-zero if either suite has failures. Running a suite directly ------------------------ -pytest_suite (from its own directory; it creates its own virtualenv): +Both runtests.sh scripts create their own virtualenv on first run and can be +invoked from any directory -- the paths below are just the convenient way to +type them. The venv is (re)built automatically whenever it is missing or its +pyproject.toml has changed, using `uv sync` if uv is installed and otherwise +`python3 -m venv` + pip (reading the dependency list from pyproject.toml -- no +uv required). To force a clean rebuild yourself, `rm -rf /.venv`. - cd pytest_suite - uv sync # one-time: create the venv - ./runtests.sh --apxs=/path/to/apxs # all tests - ./runtests.sh --php-fpm=/path/to/php-fpm tests/t/php # PHP tests - ./runtests.sh -k rewrite -v # any pytest args pass through +pytest_suite (self-contained; the venv holds only pytest + httpx): + + ./pytest_suite/runtests.sh --apxs=/path/to/apxs # all tests + ./pytest_suite/runtests.sh --php-fpm=/path/to/php-fpm tests/t/php # PHP tests + ./pytest_suite/runtests.sh -k rewrite -v # any pytest args pass through pyhttpd tests (need pyhttpd/config.ini from httpd's configure, plus curl, nghttp2/h2load, and -- for modules/md -- pyOpenSSL and an ACME test server): - pytest modules/http2 # all HTTP/2 tests - pytest modules/core -k test_001 # a subset - + ./pyhttpd/runtests.sh modules/http2 # all HTTP/2 tests + ./pyhttpd/runtests.sh modules/core -k test_001 # a subset Other contents -------------- diff --git a/test/pyhttpd/runtests.sh b/test/pyhttpd/runtests.sh index 283b4715536..3ec52b567af 100755 --- a/test/pyhttpd/runtests.sh +++ b/test/pyhttpd/runtests.sh @@ -18,21 +18,37 @@ set -eu here="$(cd "$(dirname "$0")" && pwd)" +# --- ensure the venv exists and is current ---------------------------------- +# We invoke .venv/bin/pytest directly rather than `uv run` so the suite works +# even where `uv run` is shimmed/unavailable. +# +# Create $here/.venv on first run, and rebuild it when pyproject.toml is newer +# than the venv (i.e. dependencies changed). Prefer uv (which reads +# pyproject.toml + uv.lock); otherwise fall back to python3 -m venv + pip, +# taking the dependency list straight from pyproject.toml so there is no second +# copy to keep in sync. Absolute paths throughout, so this behaves identically +# regardless of the caller's cwd. This block is kept byte-for-byte identical in +# pytest_suite/runtests.sh and pyhttpd/runtests.sh -- edit both together. PYTEST="$here/.venv/bin/pytest" -if [ ! -x "$PYTEST" ]; then +if [ ! -x "$PYTEST" ] || [ "$here/pyproject.toml" -nt "$here/.venv" ]; then if command -v uv >/dev/null 2>&1; then - echo "runtests.sh: .venv not found; running 'uv sync' to create it..." >&2 + echo "runtests.sh: (re)creating $here/.venv via 'uv sync'..." >&2 uv sync --project "$here" elif command -v python3 >/dev/null 2>&1; then - echo "runtests.sh: .venv not found; creating with python3 + pip..." >&2 + echo "runtests.sh: (re)creating $here/.venv via python3 + pip..." >&2 python3 -m venv "$here/.venv" - # Keep this list in sync with pyproject.toml [project].dependencies - "$here/.venv/bin/pip" install --quiet \ - "pytest>=7.0" cryptography filelock "python-multipart" pyopenssl packaging websockets + # Read [project].dependencies from pyproject.toml (one entry per line, + # double-quoted) so the install list never drifts from the manifest. + deps=$(awk -F'"' '/^dependencies = \[/{f=1; next} f && /^\]/{f=0} f && NF>=2 {print $2}' "$here/pyproject.toml") + # shellcheck disable=SC2086 # deps is an intentional word-split list + "$here/.venv/bin/pip" install --quiet $deps else - echo "runtests.sh: ERROR: $PYTEST not found and neither 'uv' nor 'python3' is on PATH." >&2 + echo "runtests.sh: ERROR: $PYTEST not found and neither 'uv' nor 'python3' is installed." >&2 exit 1 fi + # Mark the venv as freshly built so the staleness check above won't retrigger + # until pyproject.toml changes again. + touch "$here/.venv" fi # Prepend the venv's bin dir so that CGI scripts forked by httpd also resolve @@ -40,8 +56,40 @@ fi # that any shim wrappers earlier on PATH are shadowed. export PATH="$here/.venv/bin:$PATH" -targets="${PYHTTPD_TARGETS:-modules}" +# The modules/ test suite lives in test/, a sibling of this script's directory +# (test/pyhttpd/) -- cd there so both the default target and any +# PYHTTPD_TARGETS/positional path the caller supplies resolve the same way +# regardless of where runtests.sh was invoked from. +cd "$(dirname "$here")" + +# Only fall back to the "modules" default when the caller gave no positional +# test path of their own -- otherwise it would always tag along after theirs +# (`pytest modules modules/http1`), silently widening any subset selection +# back out to the full suite. A positional path is recognized by actually +# existing on disk (relative to test/, our cwd at this point) -- this avoids +# both having to enumerate every pytest flag that takes a separate-word value +# (-k, -m, -p, --tb, --maxfail, -n from pytest-xdist, ...) and misdetecting a +# -k/-m expression that happens to contain '/' (this suite's own parametrize +# IDs look like "/006/006.css", so "-k 006/006" is a realistic selector, and +# it does not exist as a path). +have_path=0 +for arg in "$@"; do + case "$arg" in + -*) ;; + # Strip a trailing ::nodeid (pytest's file::Class::test node-selector + # syntax) before checking existence -- only the file/dir part is real. + *) [ -e "${arg%%::*}" ] && have_path=1 ;; + esac +done + +if [ -n "${PYHTTPD_TARGETS:-}" ]; then + targets="$PYHTTPD_TARGETS" +elif [ "$have_path" = 1 ]; then + targets="" +else + targets="modules" +fi -# shellcheck disable=SC2086 echo "runtests.sh: $PYTEST $targets $*" >&2 +# shellcheck disable=SC2086 # $targets is an intentional word-split path list exec "$PYTEST" $targets "$@" diff --git a/test/pytest_suite/runtests.sh b/test/pytest_suite/runtests.sh index a22501012ae..1bbb62cb022 100755 --- a/test/pytest_suite/runtests.sh +++ b/test/pytest_suite/runtests.sh @@ -26,23 +26,37 @@ set -eu here="$(cd "$(dirname "$0")" && pwd)" cd "$here" -# --- locate the virtualenv's pytest ----------------------------------------- +# --- ensure the venv exists and is current ---------------------------------- # We invoke .venv/bin/pytest directly rather than `uv run` so the suite works -# even where `uv run` is shimmed/unavailable. Create the venv with `uv sync` -# (or `python -m venv .venv && .venv/bin/pip install -e .`) if it's missing. +# even where `uv run` is shimmed/unavailable. +# +# Create $here/.venv on first run, and rebuild it when pyproject.toml is newer +# than the venv (i.e. dependencies changed). Prefer uv (which reads +# pyproject.toml + uv.lock); otherwise fall back to python3 -m venv + pip, +# taking the dependency list straight from pyproject.toml so there is no second +# copy to keep in sync. Absolute paths throughout, so this behaves identically +# regardless of the caller's cwd. This block is kept byte-for-byte identical in +# pytest_suite/runtests.sh and pyhttpd/runtests.sh -- edit both together. PYTEST="$here/.venv/bin/pytest" -if [ ! -x "$PYTEST" ]; then +if [ ! -x "$PYTEST" ] || [ "$here/pyproject.toml" -nt "$here/.venv" ]; then if command -v uv >/dev/null 2>&1; then - echo "runtests.sh: .venv not found; running 'uv sync' to create it..." >&2 - uv sync + echo "runtests.sh: (re)creating $here/.venv via 'uv sync'..." >&2 + uv sync --project "$here" elif command -v python3 >/dev/null 2>&1; then - echo "runtests.sh: .venv not found; creating it with python3 + pip..." >&2 - python3 -m venv .venv - .venv/bin/pip install --quiet -e . + echo "runtests.sh: (re)creating $here/.venv via python3 + pip..." >&2 + python3 -m venv "$here/.venv" + # Read [project].dependencies from pyproject.toml (one entry per line, + # double-quoted) so the install list never drifts from the manifest. + deps=$(awk -F'"' '/^dependencies = \[/{f=1; next} f && /^\]/{f=0} f && NF>=2 {print $2}' "$here/pyproject.toml") + # shellcheck disable=SC2086 # deps is an intentional word-split list + "$here/.venv/bin/pip" install --quiet $deps else echo "runtests.sh: ERROR: $PYTEST not found and neither 'uv' nor 'python3' is installed." >&2 exit 1 fi + # Mark the venv as freshly built so the staleness check above won't retrigger + # until pyproject.toml changes again. + touch "$here/.venv" fi # --- discover apxs / httpd / php-fpm ---------------------------------------- @@ -93,6 +107,6 @@ esac rm -f "$here/t/logs/cgisock"* 2>/dev/null || true # --- run -------------------------------------------------------------------- -# shellcheck disable=SC2086 # auto_args is an intentional word-split flag list echo "runtests.sh: $PYTEST $auto_args $*" >&2 +# shellcheck disable=SC2086 # auto_args is an intentional word-split flag list exec "$PYTEST" $auto_args "$@" diff --git a/test/run-all-tests.sh b/test/run-all-tests.sh index c34600620f9..71625c7138b 100755 --- a/test/run-all-tests.sh +++ b/test/run-all-tests.sh @@ -70,7 +70,14 @@ config_ini="$here/pyhttpd/config.ini" # paths and go ONLY to pytest_suite. The pyhttpd side selects its # tests via PYHTTPD_TARGETS (or its auto-detected default), since a # pytest_suite path is meaningless there. -# A flag that takes a separate-word value (-k NAME) keeps the value as a flag. +# +# The hard part is telling a positional test path from the value of a flag that +# takes a separate word (e.g. `--tb short`, `--maxfail 3`, `-n 4`). We handle it +# two ways: (a) the common value-flags -k/-m/-p are known to consume the next +# word, and (b) any OTHER bare word is treated as a pysuite path only if it +# actually exists on disk -- a flag value like "short"/"3"/"no" never does, so +# it stays with `flags` (attached to its preceding flag) instead of being +# misrouted to pysuite-only paths and stripped from what pyhttpd receives. only="" apxs_opt="" flags="" @@ -89,7 +96,15 @@ for arg in "$@"; do --clean-modules) pysuite_flags="$pysuite_flags $arg" ;; # pysuite-only; pyhttpd has no C modules -k|-m|-p) flags="$flags $arg"; expect_flagval=1 ;; # take a value next -*) flags="$flags $arg" ;; - *) paths="$paths $arg" ;; + # A real pysuite path exists relative to pytest_suite/ (how users type + # it, e.g. "tests/t/php") or to our cwd; strip any ::nodeid suffix + # first. Anything else is a stray flag value -> keep it with the flags. + *) if [ -e "$suite_dir/${arg%%::*}" ] || [ -e "${arg%%::*}" ]; then + paths="$paths $arg" + else + flags="$flags $arg" + fi + ;; esac done @@ -110,6 +125,7 @@ php_args="" [ -n "${PHP_FPM:-}" ] && php_args="--php-fpm=$PHP_FPM" rc=0 +skipped="" # names of suites that did NOT run (so we never report them "passed") run_pysuite() { echo "==========================================================" @@ -134,6 +150,7 @@ run_pyhttpd() { if [ ! -f "$config_ini" ]; then echo "run-all-tests.sh: note: pyhttpd/config.ini not found;" >&2 echo " build httpd with its test config (configure) to run these." >&2 + skipped="$skipped pyhttpd" return 0 fi # runtests.sh manages the venv, prepends its bin/ to PATH (so CGI @@ -159,6 +176,21 @@ case "$only" in esac echo "==========================================================" -[ "$rc" -eq 0 ] && echo "ALL SUITES PASSED" || echo "SOME TESTS FAILED (rc=$rc)" +if [ "$rc" -ne 0 ]; then + echo "SOME TESTS FAILED (rc=$rc)" +elif [ -n "$skipped" ]; then + # Nothing failed, but at least one suite never ran -- don't claim success + # for a suite that was skipped (e.g. pyhttpd with no config.ini). + echo "PASSED, BUT SKIPPED:$skipped (not run -- see notes above)" +else + echo "ALL SUITES PASSED" +fi echo "==========================================================" + +# If a suite was skipped and the user explicitly asked for ONLY that suite, +# treat "ran nothing" as a failure -- otherwise --only=pyhttpd could exit 0 +# having executed zero tests. +if [ -n "$skipped" ] && [ -n "$only" ] && [ "$rc" -eq 0 ]; then + exit 3 +fi exit "$rc" From 67535d13a4801ca96667529de344e3103ac1a4b9 Mon Sep 17 00:00:00 2001 From: Lucien Gentis Date: Sat, 18 Jul 2026 14:45:43 +0000 Subject: [PATCH 14/50] fr doc XML file update. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936290 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/rewrite/flags.xml.fr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/manual/rewrite/flags.xml.fr b/docs/manual/rewrite/flags.xml.fr index 726d5a79a4d..6b387b5c273 100644 --- a/docs/manual/rewrite/flags.xml.fr +++ b/docs/manual/rewrite/flags.xml.fr @@ -1,7 +1,7 @@ - + From 94a8373aa62a546fabe6b3a147b34414e0ecfa28 Mon Sep 17 00:00:00 2001 From: Lucien Gentis Date: Sat, 18 Jul 2026 14:49:56 +0000 Subject: [PATCH 15/50] fr doc rebuild. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936291 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/rewrite/flags.xml.de | 2 +- docs/manual/rewrite/flags.xml.es | 2 +- docs/manual/rewrite/flags.xml.ja | 2 +- docs/manual/rewrite/flags.xml.ko | 2 +- docs/manual/rewrite/flags.xml.tr | 2 +- docs/manual/rewrite/flags.xml.zh-cn | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/manual/rewrite/flags.xml.de b/docs/manual/rewrite/flags.xml.de index 2d31dfbd64b..417e6b523a8 100644 --- a/docs/manual/rewrite/flags.xml.de +++ b/docs/manual/rewrite/flags.xml.de @@ -1,7 +1,7 @@ - + + + + + + server konfiguration virtuel vært diff --git a/docs/manual/style/lang/de.xml b/docs/manual/style/lang/de.xml index 71078ec555b..59e2b06543d 100644 --- a/docs/manual/style/lang/de.xml +++ b/docs/manual/style/lang/de.xml @@ -91,6 +91,8 @@ experimentell extern + Veraltet + Serverkonfiguration Virtual Host diff --git a/docs/manual/style/lang/en.xml b/docs/manual/style/lang/en.xml index 1b6f72bda41..b9501e5121b 100644 --- a/docs/manual/style/lang/en.xml +++ b/docs/manual/style/lang/en.xml @@ -94,6 +94,8 @@ Extension Experimental External + Deprecated + server config diff --git a/docs/manual/style/lang/es.xml b/docs/manual/style/lang/es.xml index b5b24c70abd..99562c4dfb4 100644 --- a/docs/manual/style/lang/es.xml +++ b/docs/manual/style/lang/es.xml @@ -99,6 +99,8 @@ Experimental Externo + Obsoleto + server config virtual host diff --git a/docs/manual/style/lang/fr.xml b/docs/manual/style/lang/fr.xml index 3ccb09d4067..52b82642a80 100644 --- a/docs/manual/style/lang/fr.xml +++ b/docs/manual/style/lang/fr.xml @@ -95,6 +95,8 @@ Expérimental Externe + Obsolète + configuration globale serveur virtuel diff --git a/docs/manual/style/lang/ja.xml b/docs/manual/style/lang/ja.xml index 2d1be26c8ef..77c48147309 100644 --- a/docs/manual/style/lang/ja.xml +++ b/docs/manual/style/lang/ja.xml @@ -90,6 +90,8 @@ Experimental External + éžæŽ¨å¥¨ + サーãƒè¨­å®šãƒ•ã‚¡ã‚¤ãƒ« ãƒãƒ¼ãƒãƒ£ãƒ«ãƒ›ã‚¹ãƒˆ diff --git a/docs/manual/style/lang/ko.xml b/docs/manual/style/lang/ko.xml index 3f4177fba66..fa4ec120cfb 100644 --- a/docs/manual/style/lang/ko.xml +++ b/docs/manual/style/lang/ko.xml @@ -96,6 +96,8 @@ Experimental External + 사용 ì¤‘ë‹¨ë¨ + ÁÖ¼­¹ö¼³Á¤ °¡»óÈ£½ºÆ® diff --git a/docs/manual/style/lang/pt-br.xml b/docs/manual/style/lang/pt-br.xml index 8813105c9ba..a7febb977bf 100644 --- a/docs/manual/style/lang/pt-br.xml +++ b/docs/manual/style/lang/pt-br.xml @@ -95,6 +95,8 @@ Experimental Externo + Obsoleto + configuração do servidor host virtual diff --git a/docs/manual/style/lang/ru.xml b/docs/manual/style/lang/ru.xml index 4e6c9e6b99e..15ee7c2635e 100644 --- a/docs/manual/style/lang/ru.xml +++ b/docs/manual/style/lang/ru.xml @@ -94,6 +94,8 @@ Experimental External + УÑтаревший + server config virtual host diff --git a/docs/manual/style/lang/tr.xml b/docs/manual/style/lang/tr.xml index 3a3c193b60e..99ff0d72ad3 100644 --- a/docs/manual/style/lang/tr.xml +++ b/docs/manual/style/lang/tr.xml @@ -97,6 +97,8 @@ Deneysel Harici + Kullanımdan Kaldırıldı + sunucu geneli sanal konak From 9bddacfed2d7770b06748bc4850c9c87f2afc122 Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Mon, 20 Jul 2026 19:50:48 +0000 Subject: [PATCH 20/50] PR68527: fixup_dir segfault with no content-type git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936401 13f79535-47bb-0310-9956-ffa450edef68 --- changes-entries/pr68527.txt | 2 ++ modules/mappers/mod_dir.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 changes-entries/pr68527.txt diff --git a/changes-entries/pr68527.txt b/changes-entries/pr68527.txt new file mode 100644 index 00000000000..2a0cd27d126 --- /dev/null +++ b/changes-entries/pr68527.txt @@ -0,0 +1,2 @@ + *) mod_dir: Fix a crash in fixup_dir for a request not mapped to any type. + PR68527. [Eric Covener] diff --git a/modules/mappers/mod_dir.c b/modules/mappers/mod_dir.c index d13babf8185..fdf64ae2288 100644 --- a/modules/mappers/mod_dir.c +++ b/modules/mappers/mod_dir.c @@ -303,7 +303,7 @@ static int fixup_dir(request_rec *r) if (d->checkhandler == MODDIR_ON && strcmp(r->handler, DIR_MAGIC_TYPE)) { /* Prevent DIR_MAGIC_TYPE from leaking out when someone has taken over */ - if (!strcmp(r->content_type, DIR_MAGIC_TYPE)) { + if (r->content_type && !strcmp(r->content_type, DIR_MAGIC_TYPE)) { r->content_type = NULL; } return DECLINED; From 8d949d2de25b096b9f96fd48b7272999cd6e7d53 Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Mon, 20 Jul 2026 19:55:13 +0000 Subject: [PATCH 21/50] protect as in r1936401 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936403 13f79535-47bb-0310-9956-ffa450edef68 --- modules/mappers/mod_dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/mappers/mod_dir.c b/modules/mappers/mod_dir.c index fdf64ae2288..53ecf0e533c 100644 --- a/modules/mappers/mod_dir.c +++ b/modules/mappers/mod_dir.c @@ -312,7 +312,7 @@ static int fixup_dir(request_rec *r) /* we're running between mod_rewrites fixup and its internal redirect handler, step aside */ if (!strcmp(r->handler, REWRITE_REDIRECT_HANDLER_NAME)) { /* Prevent DIR_MAGIC_TYPE from leaking out when someone has taken over */ - if (!strcmp(r->content_type, DIR_MAGIC_TYPE)) { + if (r->content_type && !strcmp(r->content_type, DIR_MAGIC_TYPE)) { r->content_type = NULL; } return DECLINED; From 6117520d6aa270fd66763743b75d91e509c2fcf5 Mon Sep 17 00:00:00 2001 From: Giannis Christodoulou Date: Tue, 21 Jul 2026 10:13:35 +0000 Subject: [PATCH 22/50] test/modules/proxy: Add test for uwsgi headers git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936420 13f79535-47bb-0310-9956-ffa450edef68 --- test/modules/proxy/env.py | 5 ++- test/modules/proxy/test_05_uwsgi.py | 53 +++++++++++++++++++++++++++++ 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 test/modules/proxy/test_05_uwsgi.py diff --git a/test/modules/proxy/env.py b/test/modules/proxy/env.py index 92e85ba9fc4..fc443370754 100644 --- a/test/modules/proxy/env.py +++ b/test/modules/proxy/env.py @@ -20,6 +20,7 @@ def __init__(self, host, port): self._host = host self._port = port self._done = False + self._request = None def start(self): def process(): @@ -51,6 +52,8 @@ def _process(self): c, client_address = self._socket.accept() try: data = c.recv(4096) + # capture request to backend + self._request = data c.sendall(self._make_response(data)) finally: c.close() @@ -66,7 +69,7 @@ def __init__(self, env: 'HttpdTestEnv'): super().__init__(env=env) self.add_source_dir(os.path.dirname(inspect.getfile(ProxyTestSetup))) self.add_modules(["proxy", "proxy_http", "proxy_ajp", "proxy_balancer", - "lbmethod_byrequests", "remoteip"]) + "proxy_uwsgi", "lbmethod_byrequests", "remoteip"]) class ProxyTestEnv(HttpdTestEnv): diff --git a/test/modules/proxy/test_05_uwsgi.py b/test/modules/proxy/test_05_uwsgi.py new file mode 100644 index 00000000000..b0733aba7dd --- /dev/null +++ b/test/modules/proxy/test_05_uwsgi.py @@ -0,0 +1,53 @@ +import pytest + +from pyhttpd.conf import HttpdConf +from .env import TCPFaker + + +class _UWSGIFaker(TCPFaker): + + @staticmethod + def hello(data): + body = b"Hello" + return ( + b"HTTP/1.1 200 OK\r\n" + b"Content-Type: text/plain\r\n" + b"Content-Length: 5\r\n" + b"\r\n" + + body + ) + + +class TestProxyUwsgi: + + @pytest.fixture(autouse=True, scope='class') + def _class_scope(self, env): + if not env.has_shared_module("proxy_uwsgi"): + pytest.skip("mod_proxy_uwsgi not available") + faker = _UWSGIFaker("127.0.0.1", env.http_port2) + faker.start() + conf = HttpdConf(env) + conf.start_vhost(domains=[f"test1.{env.http_tld}"], port=env.http_port) + conf.add([ + f"ProxyPass / uwsgi://127.0.0.1:{env.http_port2}/", + ]) + conf.end_vhost() + conf.install() + assert env.apache_restart() == 0 + yield faker + faker.stop() + + # verify uwsgi request header + def test_proxy_005_01(self, env, _class_scope): + _class_scope._make_response = _UWSGIFaker.hello + r = env.curl_get(env.mkurl("http", "test1", "/")) + assert r.response["status"] == 200 + assert r.response["body"] == b"Hello" + + data = _class_scope._request + + assert data[0] == 0x00 # standard WSGI request + datasize = data[1] + (data[2] * 256) # read from 16bit little-endian + assert data[3] == 0x00 # standard WSGI request + assert len(data) == 4 + datasize + From ea21e77d28ca619c35f3a02c5542b0be30bb5fc9 Mon Sep 17 00:00:00 2001 From: Lucien Gentis Date: Sat, 25 Jul 2026 09:27:45 +0000 Subject: [PATCH 23/50] fr doc XML files updates. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936570 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_access_compat.xml.fr | 4 ++-- docs/manual/mod/mod_cern_meta.xml.fr | 4 ++-- docs/manual/mod/mod_imagemap.xml.fr | 4 ++-- docs/manual/mod/mod_privileges.xml.fr | 4 ++-- docs/manual/mod/mod_proxy_wstunnel.xml.fr | 4 ++-- docs/manual/mod/mod_ssl_ct.xml.fr | 4 ++-- docs/manual/mod/module-dict.xml.fr | 9 ++++++++- 7 files changed, 20 insertions(+), 13 deletions(-) diff --git a/docs/manual/mod/mod_access_compat.xml.fr b/docs/manual/mod/mod_access_compat.xml.fr index 1fe22626068..e10caebf9f1 100644 --- a/docs/manual/mod/mod_access_compat.xml.fr +++ b/docs/manual/mod/mod_access_compat.xml.fr @@ -1,7 +1,7 @@ - + @@ -27,7 +27,7 @@ mod_access_compat Autorisations de groupe à base de nom d'hôte (nom ou adresse IP) -Extension +Obsolète mod_access_compat.c access_compat_module Disponible dans la version 2.3 du serveur HTTP Apache diff --git a/docs/manual/mod/mod_cern_meta.xml.fr b/docs/manual/mod/mod_cern_meta.xml.fr index 4dfc2e821cf..6b9f8855b6b 100644 --- a/docs/manual/mod/mod_cern_meta.xml.fr +++ b/docs/manual/mod/mod_cern_meta.xml.fr @@ -1,7 +1,7 @@ - + @@ -27,7 +27,7 @@ mod_cern_meta La sémantique des métafichiers du serveur httpd du CERN -Extension +Obsolète mod_cern_meta.c cern_meta_module diff --git a/docs/manual/mod/mod_imagemap.xml.fr b/docs/manual/mod/mod_imagemap.xml.fr index dfcddfcaf72..8d57e885dc4 100644 --- a/docs/manual/mod/mod_imagemap.xml.fr +++ b/docs/manual/mod/mod_imagemap.xml.fr @@ -1,7 +1,7 @@ - + @@ -27,7 +27,7 @@ mod_imagemap Traitement des cartes des zones interactives d'une image (imagemaps) au niveau du serveur -Base +Obsolète mod_imagemap.c imagemap_module diff --git a/docs/manual/mod/mod_privileges.xml.fr b/docs/manual/mod/mod_privileges.xml.fr index 67f2aa0fa15..343710113d5 100644 --- a/docs/manual/mod/mod_privileges.xml.fr +++ b/docs/manual/mod/mod_privileges.xml.fr @@ -1,7 +1,7 @@ - + @@ -28,7 +28,7 @@ Support des privilèges de Solaris et de l'exécution des serveurs virtuels sous différents identifiants utilisateurs. -Experimental +Obsolète mod_privileges.c privileges_module Disponible depuis la version 2.3 d'Apache sur les diff --git a/docs/manual/mod/mod_proxy_wstunnel.xml.fr b/docs/manual/mod/mod_proxy_wstunnel.xml.fr index d2560042f84..c30908f8f36 100644 --- a/docs/manual/mod/mod_proxy_wstunnel.xml.fr +++ b/docs/manual/mod/mod_proxy_wstunnel.xml.fr @@ -1,7 +1,7 @@ - + + @@ -28,7 +28,7 @@ Implémentation de la transparence des certificats (Certificat Transparency - RFC 6962) -Extension +Obsolète mod_ssl_ct.c ssl_ct_module diff --git a/docs/manual/mod/module-dict.xml.fr b/docs/manual/mod/module-dict.xml.fr index 3ffd550c80a..e0db682ad7f 100644 --- a/docs/manual/mod/module-dict.xml.fr +++ b/docs/manual/mod/module-dict.xml.fr @@ -1,7 +1,7 @@ - + @@ -80,6 +80,13 @@

Ce statut indique que le module ("module tiers") ne fait pas partie de la distribution de base d'Apache. Nous ne sommes pas responsables de ces modules et n'en assurons pas le support.
+ +
Obsolète
+ +
Un module dont le statut est « Obsolète » est toujours disponible et + fonctionnel, mais son utilisation est déconseillée. Il est susceptible + d’être supprimé dans la prochaine mise à jour mineure. Consultez sa + documentation pour des solutions de remplacement ou de migration.
From 6b689ab70b532f2690e012d7c0c949a8d6d051ed Mon Sep 17 00:00:00 2001 From: Lucien Gentis Date: Sat, 25 Jul 2026 09:29:39 +0000 Subject: [PATCH 24/50] fr doc rebuild. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936571 13f79535-47bb-0310-9956-ffa450edef68 --- .../manual/mod/mod_access_compat.html.fr.utf8 | 10 +-- docs/manual/mod/mod_access_compat.xml.es | 2 +- docs/manual/mod/mod_access_compat.xml.ja | 2 +- docs/manual/mod/mod_access_compat.xml.meta | 2 +- docs/manual/mod/mod_cern_meta.html.fr.utf8 | 8 +-- docs/manual/mod/mod_cern_meta.xml.ko | 2 +- docs/manual/mod/mod_imagemap.html.fr.utf8 | 8 +-- docs/manual/mod/mod_imagemap.xml.ko | 2 +- docs/manual/mod/mod_privileges.html.fr.utf8 | 18 +++--- .../mod/mod_proxy_wstunnel.html.fr.utf8 | 10 +-- docs/manual/mod/mod_ssl_ct.html.fr.utf8 | 20 +++--- docs/manual/mod/module-dict.html.fr.utf8 | 7 +++ docs/manual/mod/module-dict.xml.ja | 2 +- docs/manual/mod/module-dict.xml.ko | 2 +- docs/manual/mod/module-dict.xml.meta | 6 +- docs/manual/mod/module-dict.xml.tr | 2 +- docs/manual/mod/quickreference.html.fr.utf8 | 62 +++++++++---------- docs/manual/rewrite/flags.xml.meta | 2 +- 18 files changed, 87 insertions(+), 80 deletions(-) diff --git a/docs/manual/mod/mod_access_compat.html.fr.utf8 b/docs/manual/mod/mod_access_compat.html.fr.utf8 index 60e20fa8eb6..f3a2b6ed293 100644 --- a/docs/manual/mod/mod_access_compat.html.fr.utf8 +++ b/docs/manual/mod/mod_access_compat.html.fr.utf8 @@ -33,7 +33,7 @@ - + - +
Description:Autorisations de groupe à base de nom d'hôte (nom ou adresse IP)
Statut:Extension
Statut:
Identificateur de Module:access_compat_module
Fichier Source:mod_access_compat.c
Compatibilité:Disponible dans la version 2.3 du serveur HTTP Apache @@ -117,7 +117,7 @@ d'environnement [hôte|env=[!]variable d'environnement] ...
Contexte:répertoire, .htaccess
Surcharges autorisées:Limit
Statut:Extension
Statut:
Module:mod_access_compat

La directive Allow permet de définir quels @@ -248,7 +248,7 @@ d'environnement [hôte|env=[!]variable d'environnement] ... Contexte:répertoire, .htaccess Surcharges autorisées:Limit -Statut:Extension +Statut: Module:mod_access_compat

Cette directive permet de restreindre l'accès au serveur en @@ -268,7 +268,7 @@ les directives Allow et Défaut:Order Deny,Allow Contexte:répertoire, .htaccess Surcharges autorisées:Limit -Statut:Extension +Statut: Module:mod_access_compat @@ -424,7 +424,7 @@ et l'authentification utilisateur Défaut:Satisfy All Contexte:répertoire, .htaccess Surcharges autorisées:AuthConfig -Statut:Extension +Statut: Module:mod_access_compat

Politique d'accès dans le cas où on utilise à la fois Allow et Require. L'argument est soit diff --git a/docs/manual/mod/mod_access_compat.xml.es b/docs/manual/mod/mod_access_compat.xml.es index cf3dc78ea1a..636ffcbdbfe 100644 --- a/docs/manual/mod/mod_access_compat.xml.es +++ b/docs/manual/mod/mod_access_compat.xml.es @@ -1,7 +1,7 @@ - + + + + + + + + diff --git a/docs/manual/mod/mod_ssl.xml.fr b/docs/manual/mod/mod_ssl.xml.fr index adf38bd2387..10de66ddad1 100644 --- a/docs/manual/mod/mod_ssl.xml.fr +++ b/docs/manual/mod/mod_ssl.xml.fr @@ -1,7 +1,7 @@ - + diff --git a/docs/manual/mod/mod_ssl.xml.meta b/docs/manual/mod/mod_ssl.xml.meta index d50eb9de390..194507ef078 100644 --- a/docs/manual/mod/mod_ssl.xml.meta +++ b/docs/manual/mod/mod_ssl.xml.meta @@ -9,6 +9,6 @@ en es - fr + fr diff --git a/docs/manual/mod/mod_ssl_ct.html.en.utf8 b/docs/manual/mod/mod_ssl_ct.html.en.utf8 index b775ebf65d9..0c52613e6ef 100644 --- a/docs/manual/mod/mod_ssl_ct.html.en.utf8 +++ b/docs/manual/mod/mod_ssl_ct.html.en.utf8 @@ -31,7 +31,7 @@ - +
Description:Implementation of Certificate Transparency (RFC 6962)
Status:Extension
Status:Deprecated
Module Identifier:ssl_ct_module
Source File:mod_ssl_ct.c

Summary

@@ -304,7 +304,7 @@ testing.

Syntax:CTAuditStorage directory Default:none Context:server config -Status:Extension +Status:Deprecated Module:mod_ssl_ct

The CTAuditStorage directive sets the name of a @@ -330,7 +330,7 @@ testing.

Syntax:CTLogClient executable Default:none Context:server config -Status:Extension +Status:Deprecated Module:mod_ssl_ct

executable is the full path to the log client tool, which is @@ -354,7 +354,7 @@ testing.

Syntax:CTLogConfigDB filename Default:none Context:server config -Status:Extension +Status:Deprecated Module:mod_ssl_ct

The CTLogConfigDB directive sets the name of a database @@ -374,7 +374,7 @@ refreshed Syntax:CTMaxSCTAge num-seconds Default:1 day Context:server config -Status:Extension +Status:Deprecated Module:mod_ssl_ct

Server certificates with SCTs which are older than this maximum age will @@ -392,7 +392,7 @@ refreshed Syntax:CTProxyAwareness oblivious|aware|require Default:aware Context:server config, virtual host -Status:Extension +Status:Deprecated Module:mod_ssl_ct

This directive controls awareness and checks for valid SCTs for a @@ -423,7 +423,7 @@ refreshed Syntax:CTSCTStorage directory Default:none Context:server config -Status:Extension +Status:Deprecated Module:mod_ssl_ct

The CTSCTStorage directive sets the name of a @@ -448,7 +448,7 @@ ServerHello Syntax:CTServerHelloSCTLimit limit Default:100 Context:server config -Status:Extension +Status:Deprecated Module:mod_ssl_ct

This directive can be used to limit the number of SCTs which can be @@ -471,7 +471,7 @@ ServerHello log-URL|- Default:none Context:server config -Status:Extension +Status:Deprecated Module:mod_ssl_ct

This directive is used to configure information about a particular log. @@ -537,7 +537,7 @@ about the fields which can be configured with this directive. Syntax:CTStaticSCTs certificate-pem-file sct-directory Default:none Context:server config -Status:Extension +Status:Deprecated Module:mod_ssl_ct

This directive is used to statically define one or more SCTs corresponding diff --git a/docs/manual/mod/module-dict.html.en.utf8 b/docs/manual/mod/module-dict.html.en.utf8 index 9e81b61a433..90f1e9f159d 100644 --- a/docs/manual/mod/module-dict.html.en.utf8 +++ b/docs/manual/mod/module-dict.html.en.utf8 @@ -82,6 +82,13 @@ if you try to use it. The module is being documented for completeness, and is not necessarily supported. +

Deprecated
+ +
A module with "Deprecated" status is still available and + functional, but its use is discouraged. The module may be + removed in the next minor release. Check the module's documentation for + recommended replacements or migration paths.
+
External
Modules which are not included with the base Apache diff --git a/docs/manual/mod/module-dict.html.ja.utf8 b/docs/manual/mod/module-dict.html.ja.utf8 index 35a1796aa5f..1d10550079b 100644 --- a/docs/manual/mod/module-dict.html.ja.utf8 +++ b/docs/manual/mod/module-dict.html.ja.utf8 @@ -29,6 +29,10 @@  ko  |  tr 

+
ã“ã®æ—¥æœ¬èªžè¨³ã¯ã™ã§ã«å¤ããªã£ã¦ã„ã‚‹ + å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ + 最近更新ã•ã‚ŒãŸå†…容を見るã«ã¯è‹±èªžç‰ˆã‚’ã”覧下ã•ã„。 +

ã“ã®æ–‡æ›¸ã¯ Apache ã®å„ モジュール を説明ã™ã‚‹ãŸã‚㫠使ã‚ã‚Œã¦ã„る用語を説明ã—ã¾ã™ã€‚

diff --git a/docs/manual/mod/module-dict.html.ko.euc-kr b/docs/manual/mod/module-dict.html.ko.euc-kr index 511da1378fa..9756ae6afd2 100644 --- a/docs/manual/mod/module-dict.html.ko.euc-kr +++ b/docs/manual/mod/module-dict.html.ko.euc-kr @@ -29,6 +29,8 @@  ko  |  tr 

+
ÀÌ ¹®¼­´Â ÃÖ½ÅÆÇ ¹ø¿ªÀÌ ¾Æ´Õ´Ï´Ù. + ÃÖ±Ù¿¡ º¯°æµÈ ³»¿ëÀº ¿µ¾î ¹®¼­¸¦ Âü°íÇϼ¼¿ä.

ÀÌ ¹®¼­´Â ¾ÆÆÄÄ¡ ¸ðµâÀ» ¼³¸íÇϱâÀ§ÇØ »ç¿ëÇÑ ¿ë¾î¸¦ ¼³¸íÇÑ´Ù.

diff --git a/docs/manual/mod/module-dict.html.tr.utf8 b/docs/manual/mod/module-dict.html.tr.utf8 index cd6c3cae842..5787f3a4df8 100644 --- a/docs/manual/mod/module-dict.html.tr.utf8 +++ b/docs/manual/mod/module-dict.html.tr.utf8 @@ -29,6 +29,7 @@  ko  |  tr 

+
Bu çeviri güncel olmayabilir. Son deÄŸiÅŸiklikler için Ä°ngilizce sürüm geçerlidir.

Bu belgede Apache modüllerini tanımlarken kullanılan terimler açıklanmıştır.

diff --git a/docs/manual/mod/motorz.html.en.utf8 b/docs/manual/mod/motorz.html.en.utf8 index c02367afc7f..150db6abd26 100644 --- a/docs/manual/mod/motorz.html.en.utf8 +++ b/docs/manual/mod/motorz.html.en.utf8 @@ -238,9 +238,11 @@ built on the APR pollset and thread pool especially suited as a reverse proxyThe PollersPerChild directive sets the number of poller threads created in each child process. Each poller owns its own pollset, timer ring and connection-recycle list, and handles a shard of - the child's connections, so adding pollers raises the rate at which a - single child can accept connections and dispatch I/O events and timer - expiries.

+ the child's connections. Because each poller thread independently + accepts connections and dispatches ready I/O events and timer + expiries to the worker pool, adding pollers raises the rate at which a + single child process can handle these operations in parallel rather than + serializing them on one poll thread.

A value of 0 (the default) means auto: the number of pollers is derived from the number of online CPUs, capped at a built-in diff --git a/docs/manual/mod/overrides.html.en.utf8 b/docs/manual/mod/overrides.html.en.utf8 index 3a7cdb25cd9..012a28e4e12 100644 --- a/docs/manual/mod/overrides.html.en.utf8 +++ b/docs/manual/mod/overrides.html.en.utf8 @@ -485,23 +485,25 @@ for Client Auth SSLCACertificatePathmod_ssl Directory of PEM-encoded CA Certificates for Client Auth -SSLCipherSuitemod_ssl -Cipher Suite available for negotiation in SSL +SSLCACertificateURImod_ssl +Server CA certificate store for Client Authentication +SSLCipherSuitemod_ssl +Cipher Suite available for negotiation in SSL handshake -SSLRenegBufferSizemod_ssl -Set the size for the SSL renegotiation buffer -SSLRequiremod_ssl -Allow access only when an arbitrarily complex +SSLRenegBufferSizemod_ssl +Set the size for the SSL renegotiation buffer +SSLRequiremod_ssl +Allow access only when an arbitrarily complex boolean expression is true -SSLRequireSSLmod_ssl -Deny access when SSL is not used for the +SSLRequireSSLmod_ssl +Deny access when SSL is not used for the HTTP request -SSLUserNamemod_ssl -Variable name to determine user name -SSLVerifyClientmod_ssl -Type of Client Certificate verification -SSLVerifyDepthmod_ssl -Maximum depth of CA Certificates in Client +SSLUserNamemod_ssl +Variable name to determine user name +SSLVerifyClientmod_ssl +Type of Client Certificate verification +SSLVerifyDepthmod_ssl +Maximum depth of CA Certificates in Client Certificate verification

top

FileInfo

diff --git a/docs/manual/mod/quickreference.html.de b/docs/manual/mod/quickreference.html.de index cc5b0013d6b..1510b4683d4 100644 --- a/docs/manual/mod/quickreference.html.de +++ b/docs/manual/mod/quickreference.html.de @@ -127,7 +127,7 @@ type expressions AliasPreservePath OFF|ON OFF svdBMap the full path after the alias in a location. Allow from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts can access an area of the +[host|env=[!]env-variable] ...dhDControls which hosts can access an area of the server AllowCONNECT port[-port] [port[-port]] ... | None 443 563 svEPorts that are allowed to CONNECT through the @@ -393,20 +393,20 @@ module CryptoIV value none svdhEIV (Initialization Vector) to be used by the crypto filter CryptoKey value none svdhEKey to be used by the crypto filter CryptoSize integer 131072 svdhEMaximum size in bytes to buffer by the crypto filter -CTAuditStorage directorysEExisting directory where data for off-line audit will be stored -CTLogClient executablesELocation of certificate-transparency log client tool -CTLogConfigDB filenamesELog configuration database supporting dynamic updates -CTMaxSCTAge num-secondssEMaximum age of SCT obtained from a log, before it will be +CTAuditStorage directorysDExisting directory where data for off-line audit will be stored +CTLogClient executablesDLocation of certificate-transparency log client tool +CTLogConfigDB filenamesDLog configuration database supporting dynamic updates +CTMaxSCTAge num-secondssDMaximum age of SCT obtained from a log, before it will be refreshed -CTProxyAwareness oblivious|aware|requiresvELevel of CT awareness and enforcement for a proxy +CTProxyAwareness oblivious|aware|requiresvDLevel of CT awareness and enforcement for a proxy -CTSCTStorage directorysEExisting directory where SCTs are managed -CTServerHelloSCTLimit limitsELimit on number of SCTs that can be returned in +CTSCTStorage directorysDExisting directory where SCTs are managed +CTServerHelloSCTLimit limitsDLimit on number of SCTs that can be returned in ServerHello CTStaticLogConfig log-id|- public-key-file|- 1|0|- min-timestamp|- max-timestamp|- -log-URL|-sEStatic configuration of information about a log -CTStaticSCTs certificate-pem-file sct-directorysEStatic configuration of one or more SCTs for a server certificate +log-URL|-sDStatic configuration of information about a log +CTStaticSCTs certificate-pem-file sct-directorysDStatic configuration of one or more SCTs for a server certificate CustomLog file|pipe|provider format|nickname @@ -455,7 +455,7 @@ nicht auf andere Weise ermitteln kann. DeflateMemLevel value 9 svEHow much memory should be used by zlib for compression DeflateWindowSize value 15 svEZlib compression window size Deny from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts are denied access to the +[host|env=[!]env-variable] ...dhDControls which hosts are denied access to the server <Directory Verzeichnispfad> ... </Directory>svCUmschließt eine Gruppe von Direktiven, die nur auf @@ -476,7 +476,7 @@ a directory DirectorySlash On|Off|NotFound On svdhBToggle trailing slash redirects on or off DocumentRoot Verzeichnis /usr/local/apache/h +svCVerzeichnis, welches den Haupt-Dokumentenbaum bildet, der im Web sichtbar ist. -DTracePrivileges On|Off Off sXDetermines whether the privileges required by dtrace are enabled. +DTracePrivileges On|Off Off sDDetermines whether the privileges required by dtrace are enabled. DumpIOInput On|Off Off sEDump all input data to the error log DumpIOOutput On|Off Off sEDump all output data to the error log <Else> ... </Else>svdhCContains directives that apply only if the condition of a @@ -615,10 +615,10 @@ werden presence or absence of a specific section directive <IfVersion [[!]operator] version> ... </IfVersion>svdhEcontains version dependent configuration -ImapBase map|referer|URL http://servername/ svdhBDefault base for imagemap files -ImapDefault error|nocontent|map|referer|URL nocontent svdhBDefault action when an imagemap is called with coordinates +ImapBase map|referer|URL http://servername/ svdhDDefault base for imagemap files +ImapDefault error|nocontent|map|referer|URL nocontent svdhDDefault action when an imagemap is called with coordinates that are not explicitly mapped -ImapMenu none|formatted|semiformatted|unformatted formatted svdhBAction if no coordinates are given when calling +ImapMenu none|formatted|semiformatted|unformatted formatted svdhDAction if no coordinates are given when calling an imagemap Include Dateiname|VerzeichnissvdCFügt andere Konfigurationsdateien innerhalb der Server-Konfigurationsdatei ein @@ -797,447 +797,456 @@ simultaneously MDDriveMode always|auto|manual auto sXformer name of MDRenewMode. MDExternalAccountBinding key-id hmac-64 | none | file none sXSet the external account binding keyid and hmac values to use at CA MDHttpProxy urlsXDefine a proxy for outgoing connections. -MDInitialDelay duration 0s sXHow long to delay the first certificate check. -MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts -MDMember hostnamesXAdditional hostname for the managed domain. -MDMembers auto|manual auto sXControl if the alias domain names are automatically added. -MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains -MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. -MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. -MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. -<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. -MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. -MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. -MDProfile namesXUse a specific ACME profile from the CA -MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. -MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. -MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). -MDRenewWindow duration 33% sXControl when a certificate will be renewed. -MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. -MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. -MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered -MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. -MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. -MDStapling on|off off sXEnable stapling for all or a particular MDomain. -MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. -MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. -MDStoreDir path md sXPath on the local file system to store the Managed Domains data. -MDStoreLocks on|off|duration off sXConfigure locking of store for updates -MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. -MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections -MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. +MDHttpProxyCACertificateFile path-to-pem-file none sXSets the root (CA) certificates to use for TLS connections to the http-proxy. +MDInitialDelay duration 0s sXHow long to delay the first certificate check. +MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts +MDMember hostnamesXAdditional hostname for the managed domain. +MDMembers auto|manual auto sXControl if the alias domain names are automatically added. +MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains +MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. +MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. +MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. +<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. +MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. +MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. +MDProfile namesXUse a specific ACME profile from the CA +MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. +MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. +MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). +MDRenewWindow duration 33% sXControl when a certificate will be renewed. +MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. +MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. +MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered +MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. +MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. +MDStapling on|off off sXEnable stapling for all or a particular MDomain. +MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. +MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. +MDStoreDir path md sXPath on the local file system to store the Managed Domains data. +MDStoreLocks on|off|duration off sXConfigure locking of store for updates +MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. +MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections +MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. -MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers -MetaDir directory .web svdhEName of the directory to find CERN-style meta information +MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers +MetaDir directory .web svdhDName of the directory to find CERN-style meta information files -MetaFiles on|off off svdhEActivates CERN meta-file processing -MetaSuffix suffix .meta svdhEFile name suffix for the file containing CERN-style +MetaFiles on|off off svdhDActivates CERN meta-file processing +MetaSuffix suffix .meta svdhDFile name suffix for the file containing CERN-style meta information -MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection -MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents +MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection +MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents using the specified magic file -MimeOptions option [option] ...svdhBConfigures mod_mime behavior -MinSpareServers Anzahl 5 sMMinimale Anzahl der unbeschäftigten Kindprozesse des +MimeOptions option [option] ...svdhBConfigures mod_mime behavior +MinSpareServers Anzahl 5 sMMinimale Anzahl der unbeschäftigten Kindprozesse des Servers -MinSpareThreads AnzahlsMMinimale Anzahl unbeschäftigter Threads, die zur +MinSpareThreads AnzahlsMMinimale Anzahl unbeschäftigter Threads, die zur Bedienung von Anfragespitzen zur Verfügung stehen -MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time -ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate -ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info +MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time +ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate +ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info components as part of the filename -MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers -[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for +MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers +[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for a matching file with MultiViews -Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all +Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all or specified mutexes -NameVirtualHost Adresse[:Port]sCBestimmt eine IP-Adresse für den Betrieb namensbasierter +NameVirtualHost Adresse[:Port]sCBestimmt eine IP-Adresse für den Betrieb namensbasierter virtueller Hosts -NoProxy host [host] ...svEHosts, domains, or networks that will be connected to +NoProxy host [host] ...svEHosts, domains, or networks that will be connected to directly -NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates -NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request -Options - [+|-]Option [[+|-]Option] ... All svdhCDefiniert, welche Eigenschaften oder Funktionen in einem +NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates +NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request +Options + [+|-]Option [[+|-]Option] ... All svdhCDefiniert, welche Eigenschaften oder Funktionen in einem bestimmten Verzeichnis verfügbar sind - Order ordering Deny,Allow dhEControls the default access state and the order in which + Order ordering Deny,Allow dhDControls the default access state and the order in which Allow and Deny are evaluated. -OutputSed sed-commanddhXSed command for filtering response content -PassEnv env-variable [env-variable] -...svdhBPasses environment variables from the shell -PidFile Dateiname logs/httpd.pid sMDatei, in welcher der Server die Prozess-ID des Daemons +OutputSed sed-commanddhXSed command for filtering response content +PassEnv env-variable [env-variable] +...svdhBPasses environment variables from the shell +PidFile Dateiname logs/httpd.pid sMDatei, in welcher der Server die Prozess-ID des Daemons ablegt -PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. -PolicyConditionalURL urlsvdEURL describing the conditional request policy. -PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. -PolicyFilter on|offsvdEEnable or disable policies for the given URL space. -PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. -PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. -PolicyLength ignore|log|enforcesvdEEnable the content length policy. -PolicyLengthURL urlsvdEURL describing the content length policy. -PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. -PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. -PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. -PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. -PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. -PolicyTypeURL urlsvdEURL describing the content type policy. -PolicyValidation ignore|log|enforcesvdEEnable the validation policy. -PolicyValidationURL urlsvdEURL describing the content type policy. -PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. -PolicyVaryURL urlsvdEURL describing the content type policy. -PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. -PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. -PollersPerChild number 0 sMNumber of poll threads per child process -PrivilegesMode FAST|SECURE|SELECTIVE FAST svdXTrade off processing speed and efficiency vs security against +PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. +PolicyConditionalURL urlsvdEURL describing the conditional request policy. +PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. +PolicyFilter on|offsvdEEnable or disable policies for the given URL space. +PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. +PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. +PolicyLength ignore|log|enforcesvdEEnable the content length policy. +PolicyLengthURL urlsvdEURL describing the content length policy. +PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. +PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. +PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. +PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. +PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. +PolicyTypeURL urlsvdEURL describing the content type policy. +PolicyValidation ignore|log|enforcesvdEEnable the validation policy. +PolicyValidationURL urlsvdEURL describing the content type policy. +PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. +PolicyVaryURL urlsvdEURL describing the content type policy. +PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. +PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. +PollersPerChild number 0 sMNumber of poll threads per child process +PrivilegesMode FAST|SECURE|SELECTIVE FAST svdDTrade off processing speed and efficiency vs security against malicious privileges-aware code. -Protocol protocolsvCProtocol for a listening socket -ProtocolEcho On|Off Off svXTurn the echo server on or off -Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host -ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation -<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources -Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server -ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers -ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the +Protocol protocolsvCProtocol for a listening socket +ProtocolEcho On|Off Off svXTurn the echo server on or off +Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host +ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation +<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources +Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server +ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers +ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the MPM for asynchronous processing -ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections -ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a +ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections +ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a response -ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its +ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its announcements -ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy -ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to -ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement -ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend +ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy +ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to +ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement +ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend beacons -ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement -ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements -ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend +ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement +ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements +ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend is taken out of rotation -ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts -ProxyDomain DomainsvEDefault domain name for proxied requests -ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content -ProxyExpressDBMFile pathnamesvEPathname to DBM file. -ProxyExpressDBMType type default svEDBM type of file. -ProxyExpressEnable on|off off svEEnable the module functionality. -ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application -ProxyFCGISetEnvIf conditional-expression +ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts +ProxyDomain DomainsvEDefault domain name for proxied requests +ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content +ProxyExpressDBMFile pathnamesvEPathname to DBM file. +ProxyExpressDBMType type default svEDBM type of file. +ProxyExpressEnable on|off off svEEnable the module functionality. +ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application +ProxyFCGISetEnvIf conditional-expression [!]environment-variable-name - [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up -ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings -ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server -ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing -ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response -ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters -ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers -ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and + [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up +ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings +ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server +ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing +ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response +ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters +ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers +ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and stylesheets. -ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. -ProxyHTMLDocType HTML|XHTML [Legacy]
OR +ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. +ProxyHTMLDocType HTML|XHTML [Legacy]
OR
ProxyHTMLDocType fpi [SGML|XML]
OR
ProxyHTMLDocType html5
OR -
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. -ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. -ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. -ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, +
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. +ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. +ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. +ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, and scripting events. -ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. -ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of +ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. +ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of ProxyHTMLURLMap rules. -ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. -ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML +ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. +ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML <head> sections. -ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. -ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links -ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer -<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched +ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. +ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links +ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer +<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched proxied resources -ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded +ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded through -ProxyPass [path] !|url [key=value - [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space -ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server -ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations -ProxyPassMatch [regex] !|url [key=value - [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions -ProxyPassReverse [path] url -[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse +ProxyPass [path] !|url [key=value + [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space +ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server +ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations +ProxyPassMatch [regex] !|url [key=value + [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions +ProxyPassReverse [path] url +[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse proxied server -ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- +ProxyPassReverseCookieDomain internal-domain +public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- proxied server -ProxyPassReverseCookiePath internal-path -public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- +ProxyPassReverseCookiePath internal-path +public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- proxied server -ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy +ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy request -ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP +ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP connections -ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests -ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular +ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests +ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular expressions -ProxyRequests On|Off Off svEEnables forward (standard) proxy requests -ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the +ProxyRequests On|Off Off svEEnables forward (standard) proxy requests +ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the backend -ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response +ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response header -ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters -ProxySourceAddress addresssvESet local IP address for outgoing proxy connections -ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status -ProxyTimeout time-interval[s]svENetwork timeout for proxied requests -ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response +ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters +ProxySourceAddress addresssvESet local IP address for outgoing proxy connections +ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status +ProxyTimeout time-interval[s]svENetwork timeout for proxied requests +ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response header for proxied requests -ProxyWebsocketAsync ON|OFFsvEInstructs this module to try to create an asynchronous tunnel -ProxyWebsocketAsyncDelay num[ms] 0 svESets the amount of time the tunnel waits synchronously for data -ProxyWebsocketFallbackToProxyHttp On|Off On svEInstructs this module to let mod_proxy_http handle the request -ProxyWebsocketIdleTimeout num[ms] 0 svESets the maximum amount of time to wait for data on the websockets tunnel -QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is +ProxyWebsocketAsync ON|OFFsvDInstructs this module to try to create an asynchronous tunnel +ProxyWebsocketAsyncDelay num[ms] 0 svDSets the amount of time the tunnel waits synchronously for data +ProxyWebsocketFallbackToProxyHttp On|Off On svDInstructs this module to let mod_proxy_http handle the request +ProxyWebsocketIdleTimeout num[ms] 0 svDSets the maximum amount of time to wait for data on the websockets tunnel +QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is fully qualified -ReadBufferSize bytes 8192 svdCSize of the buffers used to read data -ReadmeName filenamesvdhBName of the file that will be inserted at the end +ReadBufferSize bytes 8192 svdCSize of the buffers used to read data +ReadmeName filenamesvdhBName of the file that will be inserted at the end of the index listing -ReceiveBufferSize bytes 0 sMTCP receive buffer size -Redirect [status] [URL-path] -URLsvdhBSends an external redirect asking the client to fetch +ReceiveBufferSize bytes 0 sMTCP receive buffer size +Redirect [status] [URL-path] +URLsvdhBSends an external redirect asking the client to fetch a different URL -RedirectMatch [status] regex -URLsvdhBSends an external redirect based on a regular expression match +RedirectMatch [status] regex +URLsvdhBSends an external redirect based on a regular expression match of the current URL -RedirectPermanent URL-path URLsvdhBSends an external permanent redirect asking the client to fetch +RedirectPermanent URL-path URLsvdhBSends an external permanent redirect asking the client to fetch a different URL -RedirectRelative On|Off Off svdBAllows relative redirect targets. -RedirectTemp URL-path URLsvdhBSends an external temporary redirect asking the client to fetch +RedirectRelative On|Off Off svdBAllows relative redirect targets. +RedirectTemp URL-path URLsvdhBSends an external temporary redirect asking the client to fetch a different URL -RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) -RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) -ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers -RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes -RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods -RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses -RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses -RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling -RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks -RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoveCharset extension [extension] -...vdhBRemoves any character set associations for a set of file +RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) +RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) +ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers +RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes +RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods +RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses +RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses +RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling +RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks +RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoveCharset extension [extension] +...vdhBRemoves any character set associations for a set of file extensions -RemoveEncoding extension [extension] -...vdhBRemoves any content encoding associations for a set of file +RemoveEncoding extension [extension] +...vdhBRemoves any content encoding associations for a set of file extensions -RemoveHandler extension [extension] -...vdhBRemoves any handler associations for a set of file +RemoveHandler extension [extension] +...vdhBRemoves any handler associations for a set of file extensions -RemoveInputFilter extension [extension] -...vdhBRemoves any input filter associations for a set of file +RemoveInputFilter extension [extension] +...vdhBRemoves any input filter associations for a set of file extensions -RemoveLanguage extension [extension] -...vdhBRemoves any language associations for a set of file +RemoveLanguage extension [extension] +...vdhBRemoves any language associations for a set of file extensions -RemoveOutputFilter extension [extension] -...vdhBRemoves any output filter associations for a set of file +RemoveOutputFilter extension [extension] +...vdhBRemoves any output filter associations for a set of file extensions -RemoveType extension [extension] -...vdhBRemoves any content type associations for a set of file +RemoveType extension [extension] +...vdhBRemoves any content type associations for a set of file extensions -RequestHeader add|append|edit|edit*|merge|set|setifempty|unset +RequestHeader add|append|edit|edit*|merge|set|setifempty|unset header [[expr=]value [replacement] [early|env=[!]varname|expr=expression]] -svdhEConfigure HTTP request headers -RequestReadTimeout +svdhEConfigure HTTP request headers +RequestReadTimeout [handshake=timeout[-maxtimeout][,MinRate=rate] [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate] - handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving + handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving the request headers and/or body from client. -Require [not] entity-name - [entity-name] ...dhBTests whether an authenticated user is authorized by +Require [not] entity-name + [entity-name] ...dhBTests whether an authenticated user is authorized by an authorization provider. -<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none +<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none must fail and at least one must succeed for the enclosing directive to succeed. -<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one +<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one must succeed for the enclosing directive to succeed. -<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none +<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none must succeed for the enclosing directive to not fail. -RewriteBase URL-pathdhESets the base URL for per-directory rewrites - RewriteCond - TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place +RewriteBase URL-pathdhESets the base URL for per-directory rewrites + RewriteCond + TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place -RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine -RewriteMap MapName MapType:MapSource +RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine +RewriteMap MapName MapType:MapSource [MapTypeOptions] -svEDefines a mapping function for key-lookup -RewriteOptions OptionssvdhESets some special options for the rewrite engine -RewriteRule - [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine -RLimitCPU Sekunden|max [Sekunden|max]svdhCBegrenzt den CPU-Verbrauch von Prozessen, die von +svEDefines a mapping function for key-lookup +RewriteOptions OptionssvdhESets some special options for the rewrite engine +RewriteRule + [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine +RLimitCPU Sekunden|max [Sekunden|max]svdhCBegrenzt den CPU-Verbrauch von Prozessen, die von Apache-Kindprozessen gestartet wurden -RLimitMEM Bytes|max [Bytes|max]svdhCBegrenzt den Speicherverbrauch von Prozessen, die von +RLimitMEM Bytes|max [Bytes|max]svdhCBegrenzt den Speicherverbrauch von Prozessen, die von Apache-Kindprozessen gestartet wurden -RLimitNPROC Zahl|max [Zahl|max]svdhCBegrenzt die Anzahl der Prozesse, die von Prozessen gestartet +RLimitNPROC Zahl|max [Zahl|max]svdhCBegrenzt die Anzahl der Prozesse, die von Prozessen gestartet werden können, der ihrerseits von Apache-Kinprozessen gestartet wurden -Satisfy Any|All All dhEInteraction between host-level access control and +Satisfy Any|All All dhDInteraction between host-level access control and user authentication -ScoreBoardFile Dateipfad logs/apache_status sMAblageort der Datei, die zur Speicherung von Daten zur +ScoreBoardFile Dateipfad logs/apache_status sMAblageort der Datei, die zur Speicherung von Daten zur Koordinierung der Kindprozesse verwendet wird -Script Methode CGI-SkriptsvdBAktiviert ein CGI-Skript für eine bestimmte +Script Methode CGI-SkriptsvdBAktiviert ein CGI-Skript für eine bestimmte Anfragemethode. -ScriptAlias [URL-path] -file-path|directory-pathsvdBMaps a URL to a filesystem location and designates the +ScriptAlias [URL-path] +file-path|directory-pathsvdBMaps a URL to a filesystem location and designates the target as a CGI script -ScriptAliasMatch regex -file-path|directory-pathsvBMaps a URL to a filesystem location using a regular expression +ScriptAliasMatch regex +file-path|directory-pathsvBMaps a URL to a filesystem location using a regular expression and designates the target as a CGI script -ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCMethode zur Ermittlung des Interpreters von +ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCMethode zur Ermittlung des Interpreters von CGI-Skripten -ScriptLog file-pathsvBLocation of the CGI script error logfile -ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded +ScriptLog file-pathsvBLocation of the CGI script error logfile +ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded in the scriptlog -ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile -ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with +ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile +ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with the cgi daemon -SecureListen [IP-address:]portnumber -Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port -SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters +SecureListen [IP-address:]portnumber +Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port +SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters of a request or the last 63, assuming the request itself is greater than 63 chars. -SendBufferSize Bytes 0 sMGröße des TCP-Puffers -ServerAdmin E-Mail-Adresse|URLsvCE-Mail-Adresse, die der Server in Fehlermeldungen einfügt, +SendBufferSize Bytes 0 sMGröße des TCP-Puffers +ServerAdmin E-Mail-Adresse|URLsvCE-Mail-Adresse, die der Server in Fehlermeldungen einfügt, welche an den Client gesendet werden -ServerAlias Hostname [Hostname] ...vCAlternativer Name für einen Host, der verwendet wird, wenn +ServerAlias Hostname [Hostname] ...vCAlternativer Name für einen Host, der verwendet wird, wenn Anfragen einem namensbasierten virtuellen Host zugeordnet werden -ServerLimit AnzahlsMObergrenze für die konfigurierbare Anzahl von +ServerLimit AnzahlsMObergrenze für die konfigurierbare Anzahl von Prozessen -ServerName -voll-qualifizierter-Domainname[:port]svCRechnername und Port, die der Server dazu verwendet, sich +ServerName +voll-qualifizierter-Domainname[:port]svCRechnername und Port, die der Server dazu verwendet, sich selbst zu identifizieren -ServerPath URL-PfadvCVeralteter URL-Pfad für einen namensbasierten +ServerPath URL-PfadvCVeralteter URL-Pfad für einen namensbasierten virtuellen Host, auf den von einem inkompatiblen Browser zugegriffen wird -ServerRoot Verzeichnis /usr/local/apache sCBasisverzeichnis der Serverinstallation -ServerSignature On|Off|EMail Off svdhCKonfiguriert die Fußzeile von servergenerierten +ServerRoot Verzeichnis /usr/local/apache sCBasisverzeichnis der Serverinstallation +ServerSignature On|Off|EMail Off svdhCKonfiguriert die Fußzeile von servergenerierten Dokumenten -ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCKonfiguriert den HTTP-Response-Header +ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCKonfiguriert den HTTP-Response-Header Server -Session On|Off Off svdhEEnables a session for the current directory or location -SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client -SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session -SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session -SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers -SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session -SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session -SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session -SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session -SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID -SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID -SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers -SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database -SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database -SessionDBDPerUser On|Off Off svdhEEnable a per user session -SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database -SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database -SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the +Session On|Off Off svdhEEnables a session for the current directory or location +SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client +SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session +SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session +SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers +SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session +SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session +SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session +SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session +SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID +SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID +SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers +SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database +SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database +SessionDBDPerUser On|Off Off svdhEEnable a per user session +SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database +SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database +SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the HTTP_SESSION environment variable -SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored -SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without +SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored +SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without the session being updated -SessionHeader headersvdhEImport session updates from a given HTTP response header -SessionInclude pathsvdhEDefine URL prefixes for which a session is valid -SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session -SetEnv env-variable [value]svdhBSets environment variables -SetEnvIf attribute +SessionHeader headersvdhEImport session updates from a given HTTP response header +SessionInclude pathsvdhEDefine URL prefixes for which a session is valid +SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session +SetEnv env-variable [value]svdhBSets environment variables +SetEnvIf attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request -SetEnvIfExpr expr +SetEnvIfExpr expr [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression -SetEnvIfNoCase attribute regex + [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression +SetEnvIfNoCase attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request without respect to case -SetHandler Handlername|NonesvdhCErzwingt die Verarbeitung aller passenden Dateien durch +SetHandler Handlername|NonesvdhCErzwingt die Verarbeitung aller passenden Dateien durch einen Handler -SetInputFilter Filter[;Filter...]svdhCBestimmt die Filter, die Client-Anfragen und POST-Eingaben +SetInputFilter Filter[;Filter...]svdhCBestimmt die Filter, die Client-Anfragen und POST-Eingaben verarbeiten -SetOutputFilter Filter[;Filter...]svdhCBestimmt die Filter, die Antworten des Servers verarbeiten -SSIEndTag tag "-->" svBString that ends an include element -SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI +SetOutputFilter Filter[;Filter...]svdhCBestimmt die Filter, die Antworten des Servers verarbeiten +SSIEndTag tag "-->" svBString that ends an include element +SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI error -SSIETag on|off off dhBControls whether ETags are generated by the server. -SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the +SSIETag on|off off dhBControls whether ETags are generated by the server. +SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the server. -SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. -SSIStartTag tag "<!--#" svBString that starts an include element -SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are +SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. +SSIStartTag tag "<!--#" svBString that starts an include element +SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are displayed -SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed -SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed +SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Client Auth -SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Client Auth +SSLCACertificateURI urisvEServer CA certificate store for Client Authentication SSLCADNRequestFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for defining acceptable CA names SSLCADNRequestPath directory-pathsvEDirectory of PEM-encoded CA Certificates for defining acceptable CA names -SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking -SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for +SSLCADNRequestURI urisvEcertificate store of CA Certificates for defining +acceptable CA names +SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking +SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Client Auth -SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for +SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Client Auth +SSLCARevocationURI urisvEServer CA certificate revocation list store for Client Authentication SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file -SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL +SSLCertificateURI urisvEServer certificate and key store +SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL handshake -SSLClientHelloVars on|off off svEEnable collection of ClientHello variables -SSLCompression on|off off svEEnable compression on the SSL level -SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator -SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory -SSLEngine on|off off svESSL Engine Operation Switch -SSLFIPS on|off off sESSL FIPS mode Switch -SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order -SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation -SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain -SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification -SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation -SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests -SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates -SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries -SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses -SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation -SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries -SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API -SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLClientHelloVars on|off off svEEnable collection of ClientHello variables +SSLCompression on|off off svEEnable compression on the SSL level +SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator +SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory +SSLEngine on|off off svESSL Engine Operation Switch +SSLFIPS on|off off sESSL FIPS mode Switch +SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order +SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation +SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain +SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification +SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation +SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests +SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates +SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries +SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses +SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation +SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries +SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API +SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLPolicy namesvEApply a SSLPolicy by name -SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions -SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSLPolicy namesvEApply a SSLPolicy by name +SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions +SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Remote Server Auth +SSLProxyCACertificateURI urisvEProxy CA certificate store for Remote Server Auth SSLProxyCARevocationCheck chain|leaf|none none svEEnable CRL-based revocation checking for Remote Server Auth SSLProxyCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth SSLProxyCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificate's CN field +SSLProxyCARevocationURI urisvEProxy CA certificate revocation list store for Remote Server Auth +SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificate's CN field -SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired +SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired -SSLProxyCheckPeerName on|off on svEConfigure host name checking for remote server certificates +SSLProxyCheckPeerName on|off on svEConfigure host name checking for remote server certificates -SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svECipher Suite available for negotiation in SSL +SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateChainFile filenamesvEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate -SSLProxyMachineCertificateFile filenamesvEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directorysvEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateChainFile filenamesvEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate +SSLProxyMachineCertificateFile filenamesvEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysvEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificateURI urisvEProxy certificate and key stores SSLProxyProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL protocol flavors for proxy usage SSLProxyVerify level none svEType of remote server Certificate verification SSLProxyVerifyDepth number 1 svEMaximum depth of CA Certificates in Remote Server @@ -1314,15 +1323,15 @@ ermittelt requests UserDir directory-filename [directory-filename] ... svBLocation of the user-specific directories -VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run +VHostCGIMode On|Off|Secure On vDDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On vXDetermines whether the server runs with enhanced security +VHostGroup unix-groupidvDSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On vDDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridvXSets the User ID under which a virtual host runs. +VHostUser unix-useridvDSets the User ID under which a virtual host runs. VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root diff --git a/docs/manual/mod/quickreference.html.en.utf8 b/docs/manual/mod/quickreference.html.en.utf8 index cd29686e634..63120e92c52 100644 --- a/docs/manual/mod/quickreference.html.en.utf8 +++ b/docs/manual/mod/quickreference.html.en.utf8 @@ -123,7 +123,7 @@ type expressions AliasPreservePath OFF|ON OFF svdBMap the full path after the alias in a location. Allow from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts can access an area of the +[host|env=[!]env-variable] ...dhDControls which hosts can access an area of the server AllowCONNECT port[-port] [port[-port]] ... | None 443 563 svEPorts that are allowed to CONNECT through the @@ -389,20 +389,20 @@ switch before dumping core CryptoIV value none svdhEIV (Initialization Vector) to be used by the crypto filter CryptoKey value none svdhEKey to be used by the crypto filter CryptoSize integer 131072 svdhEMaximum size in bytes to buffer by the crypto filter -CTAuditStorage directorysEExisting directory where data for off-line audit will be stored -CTLogClient executablesELocation of certificate-transparency log client tool -CTLogConfigDB filenamesELog configuration database supporting dynamic updates -CTMaxSCTAge num-secondssEMaximum age of SCT obtained from a log, before it will be +CTAuditStorage directorysDExisting directory where data for off-line audit will be stored +CTLogClient executablesDLocation of certificate-transparency log client tool +CTLogConfigDB filenamesDLog configuration database supporting dynamic updates +CTMaxSCTAge num-secondssDMaximum age of SCT obtained from a log, before it will be refreshed -CTProxyAwareness oblivious|aware|requiresvELevel of CT awareness and enforcement for a proxy +CTProxyAwareness oblivious|aware|requiresvDLevel of CT awareness and enforcement for a proxy -CTSCTStorage directorysEExisting directory where SCTs are managed -CTServerHelloSCTLimit limitsELimit on number of SCTs that can be returned in +CTSCTStorage directorysDExisting directory where SCTs are managed +CTServerHelloSCTLimit limitsDLimit on number of SCTs that can be returned in ServerHello CTStaticLogConfig log-id|- public-key-file|- 1|0|- min-timestamp|- max-timestamp|- -log-URL|-sEStatic configuration of information about a log -CTStaticSCTs certificate-pem-file sct-directorysEStatic configuration of one or more SCTs for a server certificate +log-URL|-sDStatic configuration of information about a log +CTStaticSCTs certificate-pem-file sct-directorysDStatic configuration of one or more SCTs for a server certificate CustomLog file|pipe|provider format|nickname @@ -454,7 +454,7 @@ which no other media type configuration could be found. DeflateMemLevel value 9 svEHow much memory should be used by zlib for compression DeflateWindowSize value 15 svEZlib compression window size Deny from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts are denied access to the +[host|env=[!]env-variable] ...dhDControls which hosts are denied access to the server <Directory directory-path> ... </Directory>svCEnclose a group of directives that apply only to the @@ -473,7 +473,7 @@ the contents of file-system directories matching a regular expression. DirectorySlash On|Off|NotFound On svdhBToggle trailing slash redirects on or off DocumentRoot directory-path "/usr/local/apache/ +svCDirectory that forms the main document tree visible from the web -DTracePrivileges On|Off Off sXDetermines whether the privileges required by dtrace are enabled. +DTracePrivileges On|Off Off sDDetermines whether the privileges required by dtrace are enabled. DumpIOInput On|Off Off sEDump all input data to the error log DumpIOOutput On|Off Off sEDump all output data to the error log <Else> ... </Else>svdhCContains directives that apply only if the condition of a @@ -609,10 +609,10 @@ presence or absence of a specific module presence or absence of a specific section directive <IfVersion [[!]operator] version> ... </IfVersion>svdhEcontains version dependent configuration -ImapBase map|referer|URL http://servername/ svdhBDefault base for imagemap files -ImapDefault error|nocontent|map|referer|URL nocontent svdhBDefault action when an imagemap is called with coordinates +ImapBase map|referer|URL http://servername/ svdhDDefault base for imagemap files +ImapDefault error|nocontent|map|referer|URL nocontent svdhDDefault action when an imagemap is called with coordinates that are not explicitly mapped -ImapMenu none|formatted|semiformatted|unformatted formatted svdhBAction if no coordinates are given when calling +ImapMenu none|formatted|semiformatted|unformatted formatted svdhDAction if no coordinates are given when calling an imagemap Include file-path|directory-path|wildcardsvdCIncludes other configuration files from within the server configuration files @@ -790,442 +790,451 @@ simultaneously MDDriveMode always|auto|manual auto sXformer name of MDRenewMode. MDExternalAccountBinding key-id hmac-64 | none | file none sXSet the external account binding keyid and hmac values to use at CA MDHttpProxy urlsXDefine a proxy for outgoing connections. -MDInitialDelay duration 0s sXHow long to delay the first certificate check. -MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts -MDMember hostnamesXAdditional hostname for the managed domain. -MDMembers auto|manual auto sXControl if the alias domain names are automatically added. -MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains -MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. -MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. -MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. -<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. -MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. -MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. -MDProfile namesXUse a specific ACME profile from the CA -MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. -MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. -MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). -MDRenewWindow duration 33% sXControl when a certificate will be renewed. -MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. -MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. -MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered -MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. -MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. -MDStapling on|off off sXEnable stapling for all or a particular MDomain. -MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. -MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. -MDStoreDir path md sXPath on the local file system to store the Managed Domains data. -MDStoreLocks on|off|duration off sXConfigure locking of store for updates -MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. -MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections -MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. +MDHttpProxyCACertificateFile path-to-pem-file none sXSets the root (CA) certificates to use for TLS connections to the http-proxy. +MDInitialDelay duration 0s sXHow long to delay the first certificate check. +MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts +MDMember hostnamesXAdditional hostname for the managed domain. +MDMembers auto|manual auto sXControl if the alias domain names are automatically added. +MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains +MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. +MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. +MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. +<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. +MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. +MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. +MDProfile namesXUse a specific ACME profile from the CA +MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. +MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. +MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). +MDRenewWindow duration 33% sXControl when a certificate will be renewed. +MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. +MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. +MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered +MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. +MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. +MDStapling on|off off sXEnable stapling for all or a particular MDomain. +MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. +MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. +MDStoreDir path md sXPath on the local file system to store the Managed Domains data. +MDStoreLocks on|off|duration off sXConfigure locking of store for updates +MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. +MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections +MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. -MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers -MetaDir directory .web svdhEName of the directory to find CERN-style meta information +MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers +MetaDir directory .web svdhDName of the directory to find CERN-style meta information files -MetaFiles on|off off svdhEActivates CERN meta-file processing -MetaSuffix suffix .meta svdhEFile name suffix for the file containing CERN-style +MetaFiles on|off off svdhDActivates CERN meta-file processing +MetaSuffix suffix .meta svdhDFile name suffix for the file containing CERN-style meta information -MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection -MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents +MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection +MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents using the specified magic file -MimeOptions option [option] ...svdhBConfigures mod_mime behavior -MinSpareServers number 5 sMMinimum number of idle child server processes -MinSpareThreads numbersMMinimum number of idle threads available to handle request +MimeOptions option [option] ...svdhBConfigures mod_mime behavior +MinSpareServers number 5 sMMinimum number of idle child server processes +MinSpareThreads numbersMMinimum number of idle threads available to handle request spikes -MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time -ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate -ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info +MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time +ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate +ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info components as part of the filename -MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers -[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for +MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers +[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for a matching file with MultiViews -Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all +Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all or specified mutexes -NameVirtualHost addr[:port]sCDEPRECATED: Designates an IP address for name-virtual +NameVirtualHost addr[:port]sCDEPRECATED: Designates an IP address for name-virtual hosting -NoProxy host [host] ...svEHosts, domains, or networks that will be connected to +NoProxy host [host] ...svEHosts, domains, or networks that will be connected to directly -NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates -NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request -Options - [+|-]option [[+|-]option] ... FollowSymlinks svdhCConfigures what features are available in a particular +NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates +NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request +Options + [+|-]option [[+|-]option] ... FollowSymlinks svdhCConfigures what features are available in a particular directory - Order ordering Deny,Allow dhEControls the default access state and the order in which + Order ordering Deny,Allow dhDControls the default access state and the order in which Allow and Deny are evaluated. -OutputSed sed-commanddhXSed command for filtering response content -PassEnv env-variable [env-variable] -...svdhBPasses environment variables from the shell -PidFile filename httpd.pid sMFile where the server records the process ID +OutputSed sed-commanddhXSed command for filtering response content +PassEnv env-variable [env-variable] +...svdhBPasses environment variables from the shell +PidFile filename httpd.pid sMFile where the server records the process ID of the daemon -PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. -PolicyConditionalURL urlsvdEURL describing the conditional request policy. -PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. -PolicyFilter on|offsvdEEnable or disable policies for the given URL space. -PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. -PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. -PolicyLength ignore|log|enforcesvdEEnable the content length policy. -PolicyLengthURL urlsvdEURL describing the content length policy. -PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. -PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. -PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. -PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. -PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. -PolicyTypeURL urlsvdEURL describing the content type policy. -PolicyValidation ignore|log|enforcesvdEEnable the validation policy. -PolicyValidationURL urlsvdEURL describing the content type policy. -PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. -PolicyVaryURL urlsvdEURL describing the content type policy. -PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. -PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. -PollersPerChild number 0 sMNumber of poll threads per child process -PrivilegesMode FAST|SECURE|SELECTIVE FAST svdXTrade off processing speed and efficiency vs security against +PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. +PolicyConditionalURL urlsvdEURL describing the conditional request policy. +PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. +PolicyFilter on|offsvdEEnable or disable policies for the given URL space. +PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. +PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. +PolicyLength ignore|log|enforcesvdEEnable the content length policy. +PolicyLengthURL urlsvdEURL describing the content length policy. +PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. +PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. +PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. +PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. +PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. +PolicyTypeURL urlsvdEURL describing the content type policy. +PolicyValidation ignore|log|enforcesvdEEnable the validation policy. +PolicyValidationURL urlsvdEURL describing the content type policy. +PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. +PolicyVaryURL urlsvdEURL describing the content type policy. +PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. +PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. +PollersPerChild number 0 sMNumber of poll threads per child process +PrivilegesMode FAST|SECURE|SELECTIVE FAST svdDTrade off processing speed and efficiency vs security against malicious privileges-aware code. -Protocol protocolsvCProtocol for a listening socket -ProtocolEcho On|Off Off svXTurn the echo server on or off -Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host -ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation -<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources -Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server -ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers -ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the +Protocol protocolsvCProtocol for a listening socket +ProtocolEcho On|Off Off svXTurn the echo server on or off +Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host +ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation +<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources +Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server +ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers +ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the MPM for asynchronous processing -ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections -ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a +ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections +ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a response -ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its +ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its announcements -ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy -ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to -ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement -ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend +ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy +ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to +ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement +ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend beacons -ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement -ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements -ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend +ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement +ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements +ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend is taken out of rotation -ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts -ProxyDomain DomainsvEDefault domain name for proxied requests -ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content -ProxyExpressDBMFile pathnamesvEPathname to DBM file. -ProxyExpressDBMType type default svEDBM type of file. -ProxyExpressEnable on|off off svEEnable the module functionality. -ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application -ProxyFCGISetEnvIf conditional-expression +ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts +ProxyDomain DomainsvEDefault domain name for proxied requests +ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content +ProxyExpressDBMFile pathnamesvEPathname to DBM file. +ProxyExpressDBMType type default svEDBM type of file. +ProxyExpressEnable on|off off svEEnable the module functionality. +ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application +ProxyFCGISetEnvIf conditional-expression [!]environment-variable-name - [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up -ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings -ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server -ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing -ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response -ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters -ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers -ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and + [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up +ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings +ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server +ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing +ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response +ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters +ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers +ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and stylesheets. -ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. -ProxyHTMLDocType HTML|XHTML [Legacy]
OR +ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. +ProxyHTMLDocType HTML|XHTML [Legacy]
OR
ProxyHTMLDocType fpi [SGML|XML]
OR
ProxyHTMLDocType html5
OR -
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. -ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. -ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. -ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, +
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. +ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. +ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. +ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, and scripting events. -ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. -ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of +ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. +ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of ProxyHTMLURLMap rules. -ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. -ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML +ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. +ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML <head> sections. -ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. -ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links -ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer -<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched +ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. +ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links +ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer +<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched proxied resources -ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded +ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded through -ProxyPass [path] !|url [key=value - [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space -ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server -ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations -ProxyPassMatch [regex] !|url [key=value - [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions -ProxyPassReverse [path] url -[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse +ProxyPass [path] !|url [key=value + [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space +ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server +ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations +ProxyPassMatch [regex] !|url [key=value + [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions +ProxyPassReverse [path] url +[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse proxied server -ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- +ProxyPassReverseCookieDomain internal-domain +public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- proxied server -ProxyPassReverseCookiePath internal-path -public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- +ProxyPassReverseCookiePath internal-path +public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- proxied server -ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy +ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy request -ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP +ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP connections -ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests -ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular +ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests +ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular expressions -ProxyRequests On|Off Off svEEnables forward (standard) proxy requests -ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the +ProxyRequests On|Off Off svEEnables forward (standard) proxy requests +ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the backend -ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response +ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response header -ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters -ProxySourceAddress addresssvESet local IP address for outgoing proxy connections -ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status -ProxyTimeout time-interval[s]svENetwork timeout for proxied requests -ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response +ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters +ProxySourceAddress addresssvESet local IP address for outgoing proxy connections +ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status +ProxyTimeout time-interval[s]svENetwork timeout for proxied requests +ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response header for proxied requests -ProxyWebsocketAsync ON|OFFsvEInstructs this module to try to create an asynchronous tunnel -ProxyWebsocketAsyncDelay num[ms] 0 svESets the amount of time the tunnel waits synchronously for data -ProxyWebsocketFallbackToProxyHttp On|Off On svEInstructs this module to let mod_proxy_http handle the request -ProxyWebsocketIdleTimeout num[ms] 0 svESets the maximum amount of time to wait for data on the websockets tunnel -QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is +ProxyWebsocketAsync ON|OFFsvDInstructs this module to try to create an asynchronous tunnel +ProxyWebsocketAsyncDelay num[ms] 0 svDSets the amount of time the tunnel waits synchronously for data +ProxyWebsocketFallbackToProxyHttp On|Off On svDInstructs this module to let mod_proxy_http handle the request +ProxyWebsocketIdleTimeout num[ms] 0 svDSets the maximum amount of time to wait for data on the websockets tunnel +QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is fully qualified -ReadBufferSize bytes 8192 svdCSize of the buffers used to read data -ReadmeName filenamesvdhBName of the file that will be inserted at the end +ReadBufferSize bytes 8192 svdCSize of the buffers used to read data +ReadmeName filenamesvdhBName of the file that will be inserted at the end of the index listing -ReceiveBufferSize bytes 0 sMTCP receive buffer size -Redirect [status] [URL-path] -URLsvdhBSends an external redirect asking the client to fetch +ReceiveBufferSize bytes 0 sMTCP receive buffer size +Redirect [status] [URL-path] +URLsvdhBSends an external redirect asking the client to fetch a different URL -RedirectMatch [status] regex -URLsvdhBSends an external redirect based on a regular expression match +RedirectMatch [status] regex +URLsvdhBSends an external redirect based on a regular expression match of the current URL -RedirectPermanent URL-path URLsvdhBSends an external permanent redirect asking the client to fetch +RedirectPermanent URL-path URLsvdhBSends an external permanent redirect asking the client to fetch a different URL -RedirectRelative On|Off Off svdBAllows relative redirect targets. -RedirectTemp URL-path URLsvdhBSends an external temporary redirect asking the client to fetch +RedirectRelative On|Off Off svdBAllows relative redirect targets. +RedirectTemp URL-path URLsvdhBSends an external temporary redirect asking the client to fetch a different URL -RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) -RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) -ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers -RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes -RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods -RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses -RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses -RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling -RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks -RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoveCharset extension [extension] -...vdhBRemoves any character set associations for a set of file +RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) +RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) +ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers +RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes +RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods +RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses +RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses +RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling +RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks +RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoveCharset extension [extension] +...vdhBRemoves any character set associations for a set of file extensions -RemoveEncoding extension [extension] -...vdhBRemoves any content encoding associations for a set of file +RemoveEncoding extension [extension] +...vdhBRemoves any content encoding associations for a set of file extensions -RemoveHandler extension [extension] -...vdhBRemoves any handler associations for a set of file +RemoveHandler extension [extension] +...vdhBRemoves any handler associations for a set of file extensions -RemoveInputFilter extension [extension] -...vdhBRemoves any input filter associations for a set of file +RemoveInputFilter extension [extension] +...vdhBRemoves any input filter associations for a set of file extensions -RemoveLanguage extension [extension] -...vdhBRemoves any language associations for a set of file +RemoveLanguage extension [extension] +...vdhBRemoves any language associations for a set of file extensions -RemoveOutputFilter extension [extension] -...vdhBRemoves any output filter associations for a set of file +RemoveOutputFilter extension [extension] +...vdhBRemoves any output filter associations for a set of file extensions -RemoveType extension [extension] -...vdhBRemoves any content type associations for a set of file +RemoveType extension [extension] +...vdhBRemoves any content type associations for a set of file extensions -RequestHeader add|append|edit|edit*|merge|set|setifempty|unset +RequestHeader add|append|edit|edit*|merge|set|setifempty|unset header [[expr=]value [replacement] [early|env=[!]varname|expr=expression]] -svdhEConfigure HTTP request headers -RequestReadTimeout +svdhEConfigure HTTP request headers +RequestReadTimeout [handshake=timeout[-maxtimeout][,MinRate=rate] [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate] - handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving + handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving the request headers and/or body from client. -Require [not] entity-name - [entity-name] ...dhBTests whether an authenticated user is authorized by +Require [not] entity-name + [entity-name] ...dhBTests whether an authenticated user is authorized by an authorization provider. -<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none +<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none must fail and at least one must succeed for the enclosing directive to succeed. -<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one +<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one must succeed for the enclosing directive to succeed. -<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none +<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none must succeed for the enclosing directive to not fail. -RewriteBase URL-pathdhESets the base URL for per-directory rewrites - RewriteCond - TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place +RewriteBase URL-pathdhESets the base URL for per-directory rewrites + RewriteCond + TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place -RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine -RewriteMap MapName MapType:MapSource +RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine +RewriteMap MapName MapType:MapSource [MapTypeOptions] -svEDefines a mapping function for key-lookup -RewriteOptions OptionssvdhESets some special options for the rewrite engine -RewriteRule - [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine -RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched +svEDefines a mapping function for key-lookup +RewriteOptions OptionssvdhESets some special options for the rewrite engine +RewriteRule + [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine +RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched by Apache httpd children -RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched +RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched by Apache httpd children -RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by +RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by processes launched by Apache httpd children -Satisfy Any|All All dhEInteraction between host-level access control and +Satisfy Any|All All dhDInteraction between host-level access control and user authentication -ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for +ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for the child processes -Script method cgi-scriptsvdBActivates a CGI script for a particular request +Script method cgi-scriptsvdBActivates a CGI script for a particular request method. -ScriptAlias [URL-path] -file-path|directory-pathsvdBMaps a URL to a filesystem location and designates the +ScriptAlias [URL-path] +file-path|directory-pathsvdBMaps a URL to a filesystem location and designates the target as a CGI script -ScriptAliasMatch regex -file-path|directory-pathsvBMaps a URL to a filesystem location using a regular expression +ScriptAliasMatch regex +file-path|directory-pathsvBMaps a URL to a filesystem location using a regular expression and designates the target as a CGI script -ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI +ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI scripts -ScriptLog file-pathsvBLocation of the CGI script error logfile -ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded +ScriptLog file-pathsvBLocation of the CGI script error logfile +ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded in the scriptlog -ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile -ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with +ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile +ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with the cgi daemon -SecureListen [IP-address:]portnumber -Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port -SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters +SecureListen [IP-address:]portnumber +Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port +SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters of a request or the last 63, assuming the request itself is greater than 63 chars. -SendBufferSize bytes 0 sMTCP buffer size -ServerAdmin email-address|URLsvCEmail address that the server includes in error +SendBufferSize bytes 0 sMTCP buffer size +ServerAdmin email-address|URLsvCEmail address that the server includes in error messages sent to the client -ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests +ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests to name-virtual hosts -ServerLimit numbersMUpper limit on configurable number of processes -ServerName [scheme://]domain-name|ip-address[:port]svCHostname and port that the server uses to identify +ServerLimit numbersMUpper limit on configurable number of processes +ServerName [scheme://]domain-name|ip-address[:port]svCHostname and port that the server uses to identify itself -ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that +ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that is accessed by an incompatible browser -ServerRoot directory-path /usr/local/apache sCBase directory for the server installation -ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents -ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response +ServerRoot directory-path /usr/local/apache sCBase directory for the server installation +ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents +ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response header -Session On|Off Off svdhEEnables a session for the current directory or location -SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client -SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session -SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session -SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers -SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session -SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session -SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session -SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session -SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID -SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID -SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers -SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database -SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database -SessionDBDPerUser On|Off Off svdhEEnable a per user session -SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database -SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database -SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the +Session On|Off Off svdhEEnables a session for the current directory or location +SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client +SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session +SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session +SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers +SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session +SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session +SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session +SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session +SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID +SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID +SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers +SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database +SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database +SessionDBDPerUser On|Off Off svdhEEnable a per user session +SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database +SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database +SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the HTTP_SESSION environment variable -SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored -SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without +SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored +SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without the session being updated -SessionHeader headersvdhEImport session updates from a given HTTP response header -SessionInclude pathsvdhEDefine URL prefixes for which a session is valid -SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session -SetEnv env-variable [value]svdhBSets environment variables -SetEnvIf attribute +SessionHeader headersvdhEImport session updates from a given HTTP response header +SessionInclude pathsvdhEDefine URL prefixes for which a session is valid +SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session +SetEnv env-variable [value]svdhBSets environment variables +SetEnvIf attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request -SetEnvIfExpr expr +SetEnvIfExpr expr [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression -SetEnvIfNoCase attribute regex + [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression +SetEnvIfNoCase attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request without respect to case -SetHandler handler-name|none|expressionsvdhCForces all matching files to be processed by a +SetHandler handler-name|none|expressionsvdhCForces all matching files to be processed by a handler -SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST +SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST input -SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the +SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the server -SSIEndTag tag "-->" svBString that ends an include element -SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI +SSIEndTag tag "-->" svBString that ends an include element +SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI error -SSIETag on|off off dhBControls whether ETags are generated by the server. -SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the +SSIETag on|off off dhBControls whether ETags are generated by the server. +SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the server. -SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. -SSIStartTag tag "<!--#" svBString that starts an include element -SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are +SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. +SSIStartTag tag "<!--#" svBString that starts an include element +SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are displayed -SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed -SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed +SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Client Auth -SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Client Auth +SSLCACertificateURI urisvEServer CA certificate store for Client Authentication SSLCADNRequestFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for defining acceptable CA names SSLCADNRequestPath directory-pathsvEDirectory of PEM-encoded CA Certificates for defining acceptable CA names -SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking -SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for +SSLCADNRequestURI urisvEcertificate store of CA Certificates for defining +acceptable CA names +SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking +SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Client Auth -SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for +SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Client Auth +SSLCARevocationURI urisvEServer CA certificate revocation list store for Client Authentication SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file -SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL +SSLCertificateURI urisvEServer certificate and key store +SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL handshake -SSLClientHelloVars on|off off svEEnable collection of ClientHello variables -SSLCompression on|off off svEEnable compression on the SSL level -SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator -SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory -SSLEngine on|off off svESSL Engine Operation Switch -SSLFIPS on|off off sESSL FIPS mode Switch -SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order -SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation -SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain -SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification -SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation -SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests -SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates -SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries -SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses -SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation -SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries -SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API -SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLClientHelloVars on|off off svEEnable collection of ClientHello variables +SSLCompression on|off off svEEnable compression on the SSL level +SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator +SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory +SSLEngine on|off off svESSL Engine Operation Switch +SSLFIPS on|off off sESSL FIPS mode Switch +SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order +SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation +SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain +SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification +SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation +SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests +SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates +SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries +SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses +SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation +SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries +SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API +SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLPolicy namesvEApply a SSLPolicy by name -SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions -SSLProxyCACertificateFile file-pathsvpEFile of concatenated PEM-encoded CA Certificates +SSLPolicy namesvEApply a SSLPolicy by name +SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions +SSLProxyCACertificateFile file-pathsvpEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathsvpEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathsvpEDirectory of PEM-encoded CA Certificates for Remote Server Auth +SSLProxyCACertificateURI urisvpEProxy CA certificate store for Remote Server Auth SSLProxyCARevocationCheck chain|leaf|none none svpEEnable CRL-based revocation checking for Remote Server Auth SSLProxyCARevocationFile file-pathsvpEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth SSLProxyCARevocationPath directory-pathsvpEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCheckPeerCN on|off on svpEWhether to check the remote server certificate's CN field +SSLProxyCARevocationURI urisvpEProxy CA certificate revocation list store for Remote Server Auth +SSLProxyCheckPeerCN on|off on svpEWhether to check the remote server certificate's CN field -SSLProxyCheckPeerExpire on|off on svpEWhether to check if remote server certificate is expired +SSLProxyCheckPeerExpire on|off on svpEWhether to check if remote server certificate is expired -SSLProxyCheckPeerName on|off on svpEConfigure host name checking for remote server certificates +SSLProxyCheckPeerName on|off on svpEConfigure host name checking for remote server certificates -SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svpECipher Suite available for negotiation in SSL +SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svpECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off svpESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateChainFile filenamesvpEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate -SSLProxyMachineCertificateFile filenamesvpEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directorysvpEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyEngine on|off off svpESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateChainFile filenamesvpEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate +SSLProxyMachineCertificateFile filenamesvpEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysvpEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificateURI urisvpEProxy certificate and key stores SSLProxyProtocol [+|-]protocol ... all -SSLv3 svpEConfigure usable SSL protocol flavors for proxy usage SSLProxyVerify level none svpEType of remote server Certificate verification SSLProxyVerifyDepth number 1 svpEMaximum depth of CA Certificates in Remote Server @@ -1299,15 +1308,15 @@ port requests UserDir directory-filename [directory-filename] ... svBLocation of the user-specific directories -VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run +VHostCGIMode On|Off|Secure On vDDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On vXDetermines whether the server runs with enhanced security +VHostGroup unix-groupidvDSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On vDDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridvXSets the User ID under which a virtual host runs. +VHostUser unix-useridvDSets the User ID under which a virtual host runs. VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root diff --git a/docs/manual/mod/quickreference.html.es.utf8 b/docs/manual/mod/quickreference.html.es.utf8 index 8019db04ad5..9dda9a58ef0 100644 --- a/docs/manual/mod/quickreference.html.es.utf8 +++ b/docs/manual/mod/quickreference.html.es.utf8 @@ -388,20 +388,20 @@ switch before dumping core CryptoIV value none svdhEIV (Initialization Vector) to be used by the crypto filter CryptoKey value none svdhEKey to be used by the crypto filter CryptoSize integer 131072 svdhEMaximum size in bytes to buffer by the crypto filter -CTAuditStorage directorysEExisting directory where data for off-line audit will be stored -CTLogClient executablesELocation of certificate-transparency log client tool -CTLogConfigDB filenamesELog configuration database supporting dynamic updates -CTMaxSCTAge num-secondssEMaximum age of SCT obtained from a log, before it will be +CTAuditStorage directorysDExisting directory where data for off-line audit will be stored +CTLogClient executablesDLocation of certificate-transparency log client tool +CTLogConfigDB filenamesDLog configuration database supporting dynamic updates +CTMaxSCTAge num-secondssDMaximum age of SCT obtained from a log, before it will be refreshed -CTProxyAwareness oblivious|aware|requiresvELevel of CT awareness and enforcement for a proxy +CTProxyAwareness oblivious|aware|requiresvDLevel of CT awareness and enforcement for a proxy -CTSCTStorage directorysEExisting directory where SCTs are managed -CTServerHelloSCTLimit limitsELimit on number of SCTs that can be returned in +CTSCTStorage directorysDExisting directory where SCTs are managed +CTServerHelloSCTLimit limitsDLimit on number of SCTs that can be returned in ServerHello CTStaticLogConfig log-id|- public-key-file|- 1|0|- min-timestamp|- max-timestamp|- -log-URL|-sEStatic configuration of information about a log -CTStaticSCTs certificate-pem-file sct-directorysEStatic configuration of one or more SCTs for a server certificate +log-URL|-sDStatic configuration of information about a log +CTStaticSCTs certificate-pem-file sct-directorysDStatic configuration of one or more SCTs for a server certificate CustomLog file|pipe|provider format|nickname @@ -471,7 +471,7 @@ the contents of file-system directories matching a regular expression. DirectorySlash On|Off|NotFound On svdhBToggle trailing slash redirects on or off DocumentRoot directory-path /usr/local/apache/h +svCDirectory that forms the main document tree visible from the web -DTracePrivileges On|Off Off sXDetermines whether the privileges required by dtrace are enabled. +DTracePrivileges On|Off Off sDDetermines whether the privileges required by dtrace are enabled. DumpIOInput On|Off Off sEDump all input data to the error log DumpIOOutput On|Off Off sEDump all output data to the error log <Else> ... </Else>svdhCContains directives that apply only if the condition of a @@ -607,10 +607,10 @@ presence or absence of a specific module presence or absence of a specific section directive <IfVersion [[!]operator] version> ... </IfVersion>svdhEcontains version dependent configuration -ImapBase map|referer|URL http://servername/ svdhBDefault base for imagemap files -ImapDefault error|nocontent|map|referer|URL nocontent svdhBDefault action when an imagemap is called with coordinates +ImapBase map|referer|URL http://servername/ svdhDDefault base for imagemap files +ImapDefault error|nocontent|map|referer|URL nocontent svdhDDefault action when an imagemap is called with coordinates that are not explicitly mapped -ImapMenu none|formatted|semiformatted|unformatted formatted svdhBAction if no coordinates are given when calling +ImapMenu none|formatted|semiformatted|unformatted formatted svdhDAction if no coordinates are given when calling an imagemap Include [optional|strict] file-path|directory-path|wildcardsvdCIncludes other configuration files from within the server configuration files @@ -788,453 +788,462 @@ simultaneously MDDriveMode always|auto|manual auto sXformer name of MDRenewMode. MDExternalAccountBinding key-id hmac-64 | none | file none sXSet the external account binding keyid and hmac values to use at CA MDHttpProxy urlsXDefine a proxy for outgoing connections. -MDInitialDelay duration 0s sXHow long to delay the first certificate check. -MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts -MDMember hostnamesXAdditional hostname for the managed domain. -MDMembers auto|manual auto sXControl if the alias domain names are automatically added. -MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains -MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. -MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. -MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. -<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. -MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. -MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. -MDProfile namesXUse a specific ACME profile from the CA -MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. -MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. -MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). -MDRenewWindow duration 33% sXControl when a certificate will be renewed. -MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. -MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. -MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered -MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. -MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. -MDStapling on|off off sXEnable stapling for all or a particular MDomain. -MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. -MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. -MDStoreDir path md sXPath on the local file system to store the Managed Domains data. -MDStoreLocks on|off|duration off sXConfigure locking of store for updates -MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. -MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections -MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. +MDHttpProxyCACertificateFile path-to-pem-file none sXSets the root (CA) certificates to use for TLS connections to the http-proxy. +MDInitialDelay duration 0s sXHow long to delay the first certificate check. +MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts +MDMember hostnamesXAdditional hostname for the managed domain. +MDMembers auto|manual auto sXControl if the alias domain names are automatically added. +MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains +MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. +MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. +MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. +<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. +MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. +MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. +MDProfile namesXUse a specific ACME profile from the CA +MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. +MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. +MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). +MDRenewWindow duration 33% sXControl when a certificate will be renewed. +MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. +MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. +MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered +MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. +MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. +MDStapling on|off off sXEnable stapling for all or a particular MDomain. +MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. +MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. +MDStoreDir path md sXPath on the local file system to store the Managed Domains data. +MDStoreLocks on|off|duration off sXConfigure locking of store for updates +MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. +MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections +MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. -MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers -MetaDir directory .web svdhEName of the directory to find CERN-style meta information +MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers +MetaDir directory .web svdhDName of the directory to find CERN-style meta information files -MetaFiles on|off off svdhEActivates CERN meta-file processing -MetaSuffix suffix .meta svdhEFile name suffix for the file containing CERN-style +MetaFiles on|off off svdhDActivates CERN meta-file processing +MetaSuffix suffix .meta svdhDFile name suffix for the file containing CERN-style meta information -MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection -MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents +MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection +MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents using the specified magic file -MimeOptions option [option] ...svdhBConfigures mod_mime behavior -MinSpareServers number 5 sMMinimum number of idle child server processes -MinSpareThreads numbersMMinimum number of idle threads available to handle request +MimeOptions option [option] ...svdhBConfigures mod_mime behavior +MinSpareServers number 5 sMMinimum number of idle child server processes +MinSpareThreads numbersMMinimum number of idle threads available to handle request spikes -MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time -ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate -ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info +MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time +ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate +ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info components as part of the filename -MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers -[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for +MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers +[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for a matching file with MultiViews -Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all +Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all or specified mutexes -NameVirtualHost addr[:port]sCDesignates an IP address for name-virtual +NameVirtualHost addr[:port]sCDesignates an IP address for name-virtual hosting -NoProxy host [host] ...svEHosts, domains, or networks that will be connected to +NoProxy host [host] ...svEHosts, domains, or networks that will be connected to directly -NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates -NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request -Options - [+|-]option [[+|-]option] ... All svdhCConfigures what features are available in a particular +NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates +NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request +Options + [+|-]option [[+|-]option] ... All svdhCConfigures what features are available in a particular directory - Order ordering Deny,Allow dhEControla el estado por defecto del acceso y el orden en que se evalúan + Order ordering Deny,Allow dhEControla el estado por defecto del acceso y el orden en que se evalúan Allow y Deny. -OutputSed sed-commanddhXSed command for filtering response content -PassEnv env-variable [env-variable] -...svdhBPasses environment variables from the shell -PidFile filename httpd.pid sMFile where the server records the process ID +OutputSed sed-commanddhXSed command for filtering response content +PassEnv env-variable [env-variable] +...svdhBPasses environment variables from the shell +PidFile filename httpd.pid sMFile where the server records the process ID of the daemon -PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. -PolicyConditionalURL urlsvdEURL describing the conditional request policy. -PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. -PolicyFilter on|offsvdEEnable or disable policies for the given URL space. -PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. -PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. -PolicyLength ignore|log|enforcesvdEEnable the content length policy. -PolicyLengthURL urlsvdEURL describing the content length policy. -PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. -PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. -PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. -PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. -PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. -PolicyTypeURL urlsvdEURL describing the content type policy. -PolicyValidation ignore|log|enforcesvdEEnable the validation policy. -PolicyValidationURL urlsvdEURL describing the content type policy. -PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. -PolicyVaryURL urlsvdEURL describing the content type policy. -PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. -PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. -PollersPerChild number 0 sMNumber of poll threads per child process -PrivilegesMode FAST|SECURE|SELECTIVE FAST svdXTrade off processing speed and efficiency vs security against +PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. +PolicyConditionalURL urlsvdEURL describing the conditional request policy. +PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. +PolicyFilter on|offsvdEEnable or disable policies for the given URL space. +PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. +PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. +PolicyLength ignore|log|enforcesvdEEnable the content length policy. +PolicyLengthURL urlsvdEURL describing the content length policy. +PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. +PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. +PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. +PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. +PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. +PolicyTypeURL urlsvdEURL describing the content type policy. +PolicyValidation ignore|log|enforcesvdEEnable the validation policy. +PolicyValidationURL urlsvdEURL describing the content type policy. +PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. +PolicyVaryURL urlsvdEURL describing the content type policy. +PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. +PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. +PollersPerChild number 0 sMNumber of poll threads per child process +PrivilegesMode FAST|SECURE|SELECTIVE FAST svdDTrade off processing speed and efficiency vs security against malicious privileges-aware code. -Protocol protocolsvCProtocol for a listening socket -ProtocolEcho On|Off Off svXTurn the echo server on or off -Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host -ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation -<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources -Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server -ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers -ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the +Protocol protocolsvCProtocol for a listening socket +ProtocolEcho On|Off Off svXTurn the echo server on or off +Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host +ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation +<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources +Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server +ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers +ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the MPM for asynchronous processing -ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections -ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a +ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections +ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a response -ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its +ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its announcements -ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy -ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to -ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement -ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend +ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy +ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to +ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement +ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend beacons -ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement -ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements -ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend +ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement +ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements +ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend is taken out of rotation -ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts -ProxyDomain DomainsvEDefault domain name for proxied requests -ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content -ProxyExpressDBMFile pathnamesvEPathname to DBM file. -ProxyExpressDBMType type default svEDBM type of file. -ProxyExpressEnable on|off off svEEnable the module functionality. -ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application -ProxyFCGISetEnvIf conditional-expression +ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts +ProxyDomain DomainsvEDefault domain name for proxied requests +ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content +ProxyExpressDBMFile pathnamesvEPathname to DBM file. +ProxyExpressDBMType type default svEDBM type of file. +ProxyExpressEnable on|off off svEEnable the module functionality. +ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application +ProxyFCGISetEnvIf conditional-expression [!]environment-variable-name - [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up -ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings -ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server -ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing -ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response -ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters -ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers -ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and + [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up +ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings +ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server +ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing +ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response +ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters +ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers +ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and stylesheets. -ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. -ProxyHTMLDocType HTML|XHTML [Legacy]
OR +ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. +ProxyHTMLDocType HTML|XHTML [Legacy]
OR
ProxyHTMLDocType fpi [SGML|XML]
OR
ProxyHTMLDocType html5
OR -
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. -ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. -ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. -ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, +
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. +ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. +ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. +ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, and scripting events. -ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. -ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of +ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. +ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of ProxyHTMLURLMap rules. -ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. -ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML +ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. +ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML <head> sections. -ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. -ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links -ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer -<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched +ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. +ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links +ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer +<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched proxied resources -ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded +ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded through -ProxyPass [path] !|url [key=value - [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space -ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server -ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations -ProxyPassMatch [regex] !|url [key=value - [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions -ProxyPassReverse [path] url -[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse +ProxyPass [path] !|url [key=value + [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space +ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server +ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations +ProxyPassMatch [regex] !|url [key=value + [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions +ProxyPassReverse [path] url +[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse proxied server -ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- +ProxyPassReverseCookieDomain internal-domain +public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- proxied server -ProxyPassReverseCookiePath internal-path -public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- +ProxyPassReverseCookiePath internal-path +public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- proxied server -ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy +ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy request -ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP +ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP connections -ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests -ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular +ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests +ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular expressions -ProxyRequests On|Off Off svEEnables forward (standard) proxy requests -ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the +ProxyRequests On|Off Off svEEnables forward (standard) proxy requests +ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the backend -ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response +ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response header -ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters -ProxySourceAddress addresssvESet local IP address for outgoing proxy connections -ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status -ProxyTimeout time-interval[s]svENetwork timeout for proxied requests -ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response +ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters +ProxySourceAddress addresssvESet local IP address for outgoing proxy connections +ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status +ProxyTimeout time-interval[s]svENetwork timeout for proxied requests +ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response header for proxied requests -ProxyWebsocketAsync ON|OFFsvEInstructs this module to try to create an asynchronous tunnel -ProxyWebsocketAsyncDelay num[ms] 0 svESets the amount of time the tunnel waits synchronously for data -ProxyWebsocketFallbackToProxyHttp On|Off On svEInstructs this module to let mod_proxy_http handle the request -ProxyWebsocketIdleTimeout num[ms] 0 svESets the maximum amount of time to wait for data on the websockets tunnel -QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is +ProxyWebsocketAsync ON|OFFsvDInstructs this module to try to create an asynchronous tunnel +ProxyWebsocketAsyncDelay num[ms] 0 svDSets the amount of time the tunnel waits synchronously for data +ProxyWebsocketFallbackToProxyHttp On|Off On svDInstructs this module to let mod_proxy_http handle the request +ProxyWebsocketIdleTimeout num[ms] 0 svDSets the maximum amount of time to wait for data on the websockets tunnel +QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is fully qualified -ReadBufferSize bytes 8192 svdCSize of the buffers used to read data -ReadmeName filenamesvdhBName of the file that will be inserted at the end +ReadBufferSize bytes 8192 svdCSize of the buffers used to read data +ReadmeName filenamesvdhBName of the file that will be inserted at the end of the index listing -ReceiveBufferSize bytes 0 sMTCP receive buffer size -Redirect [status] [URL-path] -URLsvdhBEnvía una redirección externa indicando al cliente que solicite una URL distinta -RedirectMatch [status] regex -URLsvdhBEnvía una redirección externa basada en una coincidencia de expresión regular con la URL actual +ReceiveBufferSize bytes 0 sMTCP receive buffer size +Redirect [status] [URL-path] +URLsvdhBEnvía una redirección externa indicando al cliente que solicite una URL distinta +RedirectMatch [status] regex +URLsvdhBEnvía una redirección externa basada en una coincidencia de expresión regular con la URL actual -RedirectPermanent URL-path URLsvdhBEnvía una redirección externa permanente indicando al cliente que solicite una URL diferente -RedirectRelative On|Off Off svdBAllows relative redirect targets. -RedirectTemp URL-path URLsvdhBEnvía una redirección externa temporal indicando al cliente que solicite una URL diferente -RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) -RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) -ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers -RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes -RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods -RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses -RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses -RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling -RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks -RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoveCharset extension [extension] -...vdhBRemoves any character set associations for a set of file +RedirectPermanent URL-path URLsvdhBEnvía una redirección externa permanente indicando al cliente que solicite una URL diferente +RedirectRelative On|Off Off svdBAllows relative redirect targets. +RedirectTemp URL-path URLsvdhBEnvía una redirección externa temporal indicando al cliente que solicite una URL diferente +RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) +RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) +ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers +RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes +RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods +RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses +RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses +RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling +RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks +RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoveCharset extension [extension] +...vdhBRemoves any character set associations for a set of file extensions -RemoveEncoding extension [extension] -...vdhBRemoves any content encoding associations for a set of file +RemoveEncoding extension [extension] +...vdhBRemoves any content encoding associations for a set of file extensions -RemoveHandler extension [extension] -...vdhBRemoves any handler associations for a set of file +RemoveHandler extension [extension] +...vdhBRemoves any handler associations for a set of file extensions -RemoveInputFilter extension [extension] -...vdhBRemoves any input filter associations for a set of file +RemoveInputFilter extension [extension] +...vdhBRemoves any input filter associations for a set of file extensions -RemoveLanguage extension [extension] -...vdhBRemoves any language associations for a set of file +RemoveLanguage extension [extension] +...vdhBRemoves any language associations for a set of file extensions -RemoveOutputFilter extension [extension] -...vdhBRemoves any output filter associations for a set of file +RemoveOutputFilter extension [extension] +...vdhBRemoves any output filter associations for a set of file extensions -RemoveType extension [extension] -...vdhBRemoves any content type associations for a set of file +RemoveType extension [extension] +...vdhBRemoves any content type associations for a set of file extensions -RequestHeader add|append|edit|edit*|merge|set|setifempty|unset +RequestHeader add|append|edit|edit*|merge|set|setifempty|unset header [[expr=]value [replacement] [early|env=[!]varname|expr=expression]] -svdhEConfigure HTTP request headers -RequestReadTimeout +svdhEConfigure HTTP request headers +RequestReadTimeout [handshake=timeout[-maxtimeout][,MinRate=rate] [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate] - handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving + handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving the request headers and/or body from client. -Require [not] entity-name - [entity-name] ...dhBTests whether an authenticated user is authorized by +Require [not] entity-name + [entity-name] ...dhBTests whether an authenticated user is authorized by an authorization provider. -<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none +<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none must fail and at least one must succeed for the enclosing directive to succeed. -<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one +<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one must succeed for the enclosing directive to succeed. -<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none +<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none must succeed for the enclosing directive to not fail. -RewriteBase URL-pathdhESets the base URL for per-directory rewrites - RewriteCond - TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place +RewriteBase URL-pathdhESets the base URL for per-directory rewrites + RewriteCond + TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place -RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine -RewriteMap MapName MapType:MapSource +RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine +RewriteMap MapName MapType:MapSource [MapTypeOptions] -svEDefines a mapping function for key-lookup -RewriteOptions OptionssvdhESets some special options for the rewrite engine -RewriteRule - [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine -RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched +svEDefines a mapping function for key-lookup +RewriteOptions OptionssvdhESets some special options for the rewrite engine +RewriteRule + [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine +RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched by Apache httpd children -RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched +RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched by Apache httpd children -RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by +RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by processes launched by Apache httpd children -Satisfy Any|All All dhEInteracción entre control de acceso a nivel-de-hostess y autenticación de usuario -ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for +Satisfy Any|All All dhEInteracción entre control de acceso a nivel-de-hostess y autenticación de usuario +ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for the child processes -Script method cgi-scriptsvdBActiva un script CGI para peticiones con un método concreto. -ScriptAlias [URL-path] -file-path|directory-pathsvdBMapea una URL a una ubicación del sistema de ficheros y designa el destino como un script CGI -ScriptAliasMatch regex -file-path|directory-pathsvBMapea una URL a una ubicación del sistema de ficheros usando +Script method cgi-scriptsvdBActiva un script CGI para peticiones con un método concreto. +ScriptAlias [URL-path] +file-path|directory-pathsvdBMapea una URL a una ubicación del sistema de ficheros y designa el destino como un script CGI +ScriptAliasMatch regex +file-path|directory-pathsvBMapea una URL a una ubicación del sistema de ficheros usando una expresión regular y designa el destino como un script CGI -ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI +ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI scripts -ScriptLog file-pathsvBLocation of the CGI script error logfile -ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded +ScriptLog file-pathsvBLocation of the CGI script error logfile +ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded in the scriptlog -ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile -ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with +ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile +ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with the cgi daemon -SecureListen [IP-address:]portnumber -Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port -SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters +SecureListen [IP-address:]portnumber +Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port +SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters of a request or the last 63, assuming the request itself is greater than 63 chars. -SendBufferSize bytes 0 sMTCP buffer size -ServerAdmin email-address|URLsvCEmail address that the server includes in error +SendBufferSize bytes 0 sMTCP buffer size +ServerAdmin email-address|URLsvCEmail address that the server includes in error messages sent to the client -ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests +ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests to name-virtual hosts -ServerLimit numbersMUpper limit on configurable number of processes -ServerName [scheme://]fully-qualified-domain-name[:port]svCHostname and port that the server uses to identify +ServerLimit numbersMUpper limit on configurable number of processes +ServerName [scheme://]fully-qualified-domain-name[:port]svCHostname and port that the server uses to identify itself -ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that +ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that is accessed by an incompatible browser -ServerRoot directory-path /usr/local/apache sCBase directory for the server installation -ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents -ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response +ServerRoot directory-path /usr/local/apache sCBase directory for the server installation +ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents +ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response header -Session On|Off Off svdhEEnables a session for the current directory or location -SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client -SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session -SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session -SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers -SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session -SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session -SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session -SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session -SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID -SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID -SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers -SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database -SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database -SessionDBDPerUser On|Off Off svdhEEnable a per user session -SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database -SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database -SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the +Session On|Off Off svdhEEnables a session for the current directory or location +SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client +SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session +SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session +SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers +SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session +SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session +SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session +SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session +SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID +SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID +SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers +SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database +SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database +SessionDBDPerUser On|Off Off svdhEEnable a per user session +SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database +SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database +SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the HTTP_SESSION environment variable -SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored -SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without +SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored +SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without the session being updated -SessionHeader headersvdhEImport session updates from a given HTTP response header -SessionInclude pathsvdhEDefine URL prefixes for which a session is valid -SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session -SetEnv env-variable [value]svdhBSets environment variables -SetEnvIf attribute +SessionHeader headersvdhEImport session updates from a given HTTP response header +SessionInclude pathsvdhEDefine URL prefixes for which a session is valid +SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session +SetEnv env-variable [value]svdhBSets environment variables +SetEnvIf attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request -SetEnvIfExpr expr +SetEnvIfExpr expr [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression -SetEnvIfNoCase attribute regex + [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression +SetEnvIfNoCase attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request without respect to case -SetHandler handler-name|NonesvdhCForces all matching files to be processed by a +SetHandler handler-name|NonesvdhCForces all matching files to be processed by a handler -SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST +SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST input -SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the +SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the server -SSIEndTag tag "-->" svBString that ends an include element -SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI +SSIEndTag tag "-->" svBString that ends an include element +SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI error -SSIETag on|off off dhBControls whether ETags are generated by the server. -SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the +SSIETag on|off off dhBControls whether ETags are generated by the server. +SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the server. -SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. -SSIStartTag tag "<!--#" svBString that starts an include element -SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are +SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. +SSIStartTag tag "<!--#" svBString that starts an include element +SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are displayed -SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed -SSLCACertificateFile ruta-al-ficherosvEFichero de Certificados CA concatenados y codificados en PEM para +SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed +SSLCACertificateFile ruta-al-ficherosvEFichero de Certificados CA concatenados y codificados en PEM para la Autenticación de Cliente -SSLCACertificatePath ruta-de-directoriosvEDirectorio de certificados CA codificados en PEM para la +SSLCACertificatePath ruta-de-directoriosvEDirectorio de certificados CA codificados en PEM para la autenticación de Cliente +SSLCACertificateURI urisvEServer CA certificate store for Client Authentication SSLCADNRequestFile ruta-al-ficherosvEFichero de certificados CA concatenados codificados en PEM para definir nombres de CA aceptables SSLCADNRequestPath ruta-al-directoriosvEDirectorio de Certificados CA codificados en PEM para definir nombres de CA aceptables -SSLCARevocationCheck chain|leaf|none modificadores none svEActivar comprobación de revocación basada en CRL -SSLCARevocationFile ruta-al-ficherosvEFichero de CRL's de CA concatenados y codificados en PEM para la +SSLCADNRequestURI urisvEcertificate store of CA Certificates for defining +acceptable CA names +SSLCARevocationCheck chain|leaf|none modificadores none svEActivar comprobación de revocación basada en CRL +SSLCARevocationFile ruta-al-ficherosvEFichero de CRL's de CA concatenados y codificados en PEM para la Autenticación de ClienteFile of concatenated PEM-encoded CA CRLs for -SSLCARevocationPath ruta-al-directoriosvEDirectorio de CRLs de CA codificados en PEM para la Autenticación +SSLCARevocationPath ruta-al-directoriosvEDirectorio de CRLs de CA codificados en PEM para la Autenticación de Cliente +SSLCARevocationURI urisvEServer CA certificate revocation list store for Client Authentication SSLCertificateChainFile ruta-al-ficherosvEFichero de Certificados CA de Servidor codificado en PEM SSLCertificateFile ruta-al-ficherosvEFichero de datos Certificado X.509 codificado en PEM SSLCertificateKeyFile ruta-al-ficherosvEFichero de clave privada de Servidor codificada en PEM -SSLCipherSuite especificación-de-cifrado DEFAULT (depende de +svdhEConjunto de Cifrados disponibles para negociación en el saludo SSL +SSLCertificateURI urisvEServer certificate and key store +SSLCipherSuite especificación-de-cifrado DEFAULT (depende de +svdhEConjunto de Cifrados disponibles para negociación en el saludo SSL -SSLClientHelloVars on|off off svEEnable collection of ClientHello variables -SSLCompression on|off off svEActiva la compresión a nivel de SSL -SSLCryptoDevice engine builtin sEActivar el uso de un hardware acelerador criptográfico -SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory -SSLEngine on|off|optional|addr[:port] [addr[:port]] ... off svEInterruptor de Activación del motor SSL -SSLFIPS on|off off sEInterruptor del modo SSL FIPS -SSLHonorCipherOrder on|off off svEOpción para forzar el orden de preferencia de cifrados del +SSLClientHelloVars on|off off svEEnable collection of ClientHello variables +SSLCompression on|off off svEActiva la compresión a nivel de SSL +SSLCryptoDevice engine builtin sEActivar el uso de un hardware acelerador criptográfico +SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory +SSLEngine on|off|optional|addr[:port] [addr[:port]] ... off svEInterruptor de Activación del motor SSL +SSLFIPS on|off off sEInterruptor del modo SSL FIPS +SSLHonorCipherOrder on|off off svEOpción para forzar el orden de preferencia de cifrados del servidor -SSLOCSDefaultResponder urisvEConfigura la URI por defecto del respondedor para la validación +SSLOCSDefaultResponder urisvEConfigura la URI por defecto del respondedor para la validación OCSP -SSLOCSPEnable on|off off svEActiva la validación OCSP para la cadena de certificados del +SSLOCSPEnable on|off off svEActiva la validación OCSP para la cadena de certificados del cliente -SSLOCSPNoverify On/Off Off svESalta la verificación de certificados de respondedor +SSLOCSPNoverify On/Off Off svESalta la verificación de certificados de respondedor OCSP -SSLOCSPOverrideResponder on|off off svEFuerza el uso de una URI de respondedor por defecto para la +SSLOCSPOverrideResponder on|off off svEFuerza el uso de una URI de respondedor por defecto para la validación OCSP -SSLOCSPProxyURL urlsvEURL de Proxy a utilizar para las consultas OCSP -SSLOCSPResponderCertificateFile ficherosvEConjunto de certificados de respondedor OCSP confiables codificados +SSLOCSPProxyURL urlsvEURL de Proxy a utilizar para las consultas OCSP +SSLOCSPResponderCertificateFile ficherosvEConjunto de certificados de respondedor OCSP confiables codificados en PEM -SSLOCSPResponderTimeout segundos 10 svEExpiración de las consultas OCSP -SSLOCSPResponseMaxAge segundos -1 svEEdad máxima permitida para las respuestas OCSP -SSLOCSPResponseTimeSkew segundos 300 svEDesviación máxima de tiempo permitida para la validación de la +SSLOCSPResponderTimeout segundos 10 svEExpiración de las consultas OCSP +SSLOCSPResponseMaxAge segundos -1 svEEdad máxima permitida para las respuestas OCSP +SSLOCSPResponseTimeSkew segundos 300 svEDesviación máxima de tiempo permitida para la validación de la respuesta OCSP -SSLOCSPUseRequestNonce on|off on svEUsar un nonce dentro de las consultas OCSP -SSLOpenSSLConfCmd nombre-de-comando -parámetro-de-comandosvEConfigura parámetros OpenSSL a través de su API SSL_CONF +SSLOCSPUseRequestNonce on|off on svEUsar un nonce dentro de las consultas OCSP +SSLOpenSSLConfCmd nombre-de-comando +parámetro-de-comandosvEConfigura parámetros OpenSSL a través de su API SSL_CONF -SSLOptions [+|-]opción ...svdhEConfigurar varias opciones del motor SSL en tiempo +SSLOptions [+|-]opción ...svdhEConfigurar varias opciones del motor SSL en tiempo real -SSLPassPhraseDialog tipo builtin sETipo de díalogo de solicitud de contraseña para claves privadas +SSLPassPhraseDialog tipo builtin sETipo de díalogo de solicitud de contraseña para claves privadas encriptadas -SSLPolicy nombresvEAplica una Política SSL por nombre -SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigura versiones de protocolo SSL/TLS utilizables -SSLProxyCACertificateFile ruta-al-ficherosvpEFichero de Certificados CA concatenados codificados en PEM para +SSLPolicy nombresvEAplica una Política SSL por nombre +SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigura versiones de protocolo SSL/TLS utilizables +SSLProxyCACertificateFile ruta-al-ficherosvpEFichero de Certificados CA concatenados codificados en PEM para la Autenticación Remota del Servidor -SSLProxyCACertificatePath ruta-al-directoriosvpEDirectorio de Certificados CA codificados en PEM para la +SSLProxyCACertificatePath ruta-al-directoriosvpEDirectorio de Certificados CA codificados en PEM para la Autenticación de Servidor Remoto +SSLProxyCACertificateURI urisvpEProxy CA certificate store for Remote Server Auth SSLProxyCARevocationCheck chain|leaf|none none svpEActiva la comprobación de revocación basada en CRL para la Autenticación Remota de Servidor SSLProxyCARevocationFile ruta-al-ficherosvpEFichero de CRLs de CA codificados en PEM concatenados para la Autenticación Remota de Servidor SSLProxyCARevocationPath ruta-al-directoriosvpEDirectorio de CRLs de CA codificadas en PEM para la Autenticación Remota de Servidor -SSLProxyCheckPeerCN on|off on svpEComprobar el campo CN del certificado del servidor remoto +SSLProxyCARevocationURI urisvpEProxy CA certificate revocation list store for Remote Server Auth +SSLProxyCheckPeerCN on|off on svpEComprobar el campo CN del certificado del servidor remoto -SSLProxyCheckPeerExpire on|off on svpEComprobar si el certificado del servidor remoto está expirado +SSLProxyCheckPeerExpire on|off on svpEComprobar si el certificado del servidor remoto está expirado -SSLProxyCheckPeerName on|off on svpEConfigure comprobación de nombre de host para certificados de +SSLProxyCheckPeerName on|off on svpEConfigure comprobación de nombre de host para certificados de servidor remoto -SSLProxyCipherSuite especificación-de-cifrado ALL:!ADH:RC4+RSA:+H +svpEConjunto de Cifrados disponibles para negociación en el saludo SSL +SSLProxyCipherSuite especificación-de-cifrado ALL:!ADH:RC4+RSA:+H +svpEConjunto de Cifrados disponibles para negociación en el saludo SSL de proxy -SSLProxyEngine on|off off svpEInterruptor de Operación del Motor de Proxy SSL -SSLProxyMachineCertificateChainFile ruta-al-ficherosvpEFichero de certificados CA concatenados y codificados en PEM para +SSLProxyEngine on|off off svpEInterruptor de Operación del Motor de Proxy SSL +SSLProxyMachineCertificateChainFile ruta-al-ficherosvpEFichero de certificados CA concatenados y codificados en PEM para ser usados por el proxy para elegir un certificado -SSLProxyMachineCertificateFile ruta-al-ficherosvpEFichero de certificados cliente codificados en PEM y claves para +SSLProxyMachineCertificateFile ruta-al-ficherosvpEFichero de certificados cliente codificados en PEM y claves para ser usadas por el proxy -SSLProxyMachineCertificatePath directoriosvpEDirectorio de certificados cliente codificados en PEM y claves +SSLProxyMachineCertificatePath directoriosvpEDirectorio de certificados cliente codificados en PEM y claves para ser usadas por el proxy +SSLProxyMachineCertificateURI urisvpEProxy certificate and key stores SSLProxyProtocol [+|-]protocolo ... all -SSLv3 svpEConfigure sabores de protocolo SSL utilizables para uso de proxy SSLProxyVerify level none svpETipo de verficación de certificado del servidor remoto @@ -1318,15 +1327,15 @@ port requests UserDir directory-filename [directory-filename] ... svBLocation of the user-specific directories -VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run +VHostCGIMode On|Off|Secure On vDDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On vXDetermines whether the server runs with enhanced security +VHostGroup unix-groupidvDSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On vDDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridvXSets the User ID under which a virtual host runs. +VHostUser unix-useridvDSets the User ID under which a virtual host runs. VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root diff --git a/docs/manual/mod/quickreference.html.fr.utf8 b/docs/manual/mod/quickreference.html.fr.utf8 index c59d122d8b0..be7cf899f77 100644 --- a/docs/manual/mod/quickreference.html.fr.utf8 +++ b/docs/manual/mod/quickreference.html.fr.utf8 @@ -1493,21 +1493,26 @@ d'une variable non définie codés en PEM pour l'authentification des clients SSLCACertificatePath chemin-répertoiresvERépertoire des certificats de CA codés en PEM pour l'authentification des clients -SSLCADNRequestFile file-pathsvEFichier contenant la concaténation des certificats de CA +SSLCACertificateURI urisvEServer CA certificate store for Client Authentication +SSLCADNRequestFile file-pathsvEFichier contenant la concaténation des certificats de CA codés en PEM pour la définition de noms de CA acceptables -SSLCADNRequestPath chemin-répertoiresvERépertoire contenant des fichiers de certificats de CA +SSLCADNRequestPath chemin-répertoiresvERépertoire contenant des fichiers de certificats de CA codés en PEM pour la définition de noms de CA acceptables +SSLCADNRequestURI urisvEcertificate store of CA Certificates for defining +acceptable CA names SSLCARevocationCheck chain|leaf|none [flags ...] none svEActive la vérification des révocations basée sur les CRL SSLCARevocationFile file-pathsvEFichier contenant la concaténation des CRLs des CA codés en PEM pour l'authentification des clients SSLCARevocationPath chemin-répertoiresvERépertoire des CRLs de CA codés en PEM pour l'authentification des clients -SSLCertificateChainFile file-pathsvEFichier contenant les certificats de CA du serveur codés en +SSLCARevocationURI urisvEServer CA certificate revocation list store for Client Authentication +SSLCertificateChainFile file-pathsvEFichier contenant les certificats de CA du serveur codés en PEM -SSLCertificateFile file-path|certidsvEFichier de données contenant les informations de certificat X.509 du serveur +SSLCertificateFile file-path|certidsvEFichier de données contenant les informations de certificat X.509 du serveur codées au format PEM ou identificateur de jeton -SSLCertificateKeyFile file-path|keyidsvEFichier contenant la clé privée du serveur codée en +SSLCertificateKeyFile file-path|keyidsvEFichier contenant la clé privée du serveur codée en PEM +SSLCertificateURI urisvEServer certificate and key store SSLCipherSuite [protocol] cipher-spec DEFAULT (dépend de +svdhEAlgorithmes de chiffrement disponibles pour la négociation au cours de l'initialisation de la connexion SSL SSLClientHelloVars on|off off svEActiver la collecte des variables de ClientHello @@ -1548,12 +1553,14 @@ disponibles codés en PEM pour l'authentification des serveurs distants SSLProxyCACertificatePath chemin-répertoiresvERépertoire des certificats de CA codés en PEM pour l'authentification des serveurs distants -SSLProxyCARevocationCheck chain|leaf|none none svEActive la vérification des révocations basée sur les CRLs +SSLProxyCACertificateURI urisvEProxy CA certificate store for Remote Server Auth +SSLProxyCARevocationCheck chain|leaf|none none svEActive la vérification des révocations basée sur les CRLs pour l'authentification du serveur distant -SSLProxyCARevocationFile file-pathsvEFichier contenant la concaténation des CRLs de CA codés en +SSLProxyCARevocationFile file-pathsvEFichier contenant la concaténation des CRLs de CA codés en PEM pour l'authentification des serveurs distants -SSLProxyCARevocationPath chemin-répertoiresvERépertoire des CRLs de CA codés en PEM pour +SSLProxyCARevocationPath chemin-répertoiresvERépertoire des CRLs de CA codés en PEM pour l'authentification des serveurs distants +SSLProxyCARevocationURI urisvEProxy CA certificate revocation list store for Remote Server Auth SSLProxyCheckPeerCN on|off on svEConfiguration de la vérification du champ CN du certificat du serveur distant @@ -1573,133 +1580,134 @@ mandataire de choisir un certificat clients codés en PEM que le mandataire doit utiliser SSLProxyMachineCertificatePath chemin-répertoiresvERépertoire des clés et certificats clients codés en PEM que le mandataire doit utiliser -SSLProxyProtocol [+|-]protocole ... all -SSLv3 svEDéfinit les protocoles SSL disponibles pour la fonction de +SSLProxyMachineCertificateURI urisvEProxy certificate and key stores +SSLProxyProtocol [+|-]protocole ... all -SSLv3 svEDéfinit les protocoles SSL disponibles pour la fonction de mandataire -SSLProxyVerify niveau none svENiveau de vérification du certificat du serveur +SSLProxyVerify niveau none svENiveau de vérification du certificat du serveur distant -SSLProxyVerifyDepth niveau 1 svENiveau de profondeur maximum dans les certificats de CA +SSLProxyVerifyDepth niveau 1 svENiveau de profondeur maximum dans les certificats de CA lors de la vérification du certificat du serveur distant -SSLRandomSeed contexte source -[nombre]sESource de déclenchement du Générateur de Nombres +SSLRandomSeed contexte source +[nombre]sESource de déclenchement du Générateur de Nombres Pseudo-Aléatoires (PRNG) -SSLRenegBufferSize taille 131072 dhEDéfinit la taille du tampon de renégociation +SSLRenegBufferSize taille 131072 dhEDéfinit la taille du tampon de renégociation SSL -SSLRequire expressiondhEN'autorise l'accès que lorsqu'une expression booléenne +SSLRequire expressiondhEN'autorise l'accès que lorsqu'une expression booléenne complexe et arbitraire est vraie -SSLRequireSSLdhEInterdit l'accès lorsque la requête HTTP n'utilise pas +SSLRequireSSLdhEInterdit l'accès lorsque la requête HTTP n'utilise pas SSL -SSLSessionCache type none sEType du cache de session SSL global et +SSLSessionCache type none sEType du cache de session SSL global et inter-processus -SSLSessionCacheTimeout secondes 300 svENombre de secondes avant l'expiration d'une session SSL +SSLSessionCacheTimeout secondes 300 svENombre de secondes avant l'expiration d'une session SSL dans le cache de sessions -SSLSessionTicketKeyFile file-pathsvEClé de chiffrement/déchiffrement permanente pour les +SSLSessionTicketKeyFile file-pathsvEClé de chiffrement/déchiffrement permanente pour les tickets de session TLS -SSLSessionTickets on|off on svEActive ou désactive les tickets de session TLS -SSLSRPUnknownUserSeed secret-stringsvESource de randomisation pour utilisateur SRP inconnu -SSLSRPVerifierFile file-pathsvEChemin du fichier de vérification SRP -SSLStaplingCache typesEConfiguration du cache pour l'agrafage OCSP -SSLStaplingErrorCacheTimeout secondes 600 svEDurée de vie des réponses invalides dans le cache pour +SSLSessionTickets on|off on svEActive ou désactive les tickets de session TLS +SSLSRPUnknownUserSeed secret-stringsvESource de randomisation pour utilisateur SRP inconnu +SSLSRPVerifierFile file-pathsvEChemin du fichier de vérification SRP +SSLStaplingCache typesEConfiguration du cache pour l'agrafage OCSP +SSLStaplingErrorCacheTimeout secondes 600 svEDurée de vie des réponses invalides dans le cache pour agrafage OCSP -SSLStaplingFakeTryLater on|off on svEGénère une réponse "tryLater" pour les requêtes OCSP échouées -SSLStaplingForceURL urisvERemplace l'URI du serveur OCSP spécifié dans l'extension +SSLStaplingFakeTryLater on|off on svEGénère une réponse "tryLater" pour les requêtes OCSP échouées +SSLStaplingForceURL urisvERemplace l'URI du serveur OCSP spécifié dans l'extension AIA du certificat -SSLStaplingResponderTimeout secondes 10 svETemps d'attente maximum pour les requêtes vers les serveurs +SSLStaplingResponderTimeout secondes 10 svETemps d'attente maximum pour les requêtes vers les serveurs OCSP -SSLStaplingResponseMaxAge secondes -1 svEAge maximum autorisé des réponses OCSP incluses dans la +SSLStaplingResponseMaxAge secondes -1 svEAge maximum autorisé des réponses OCSP incluses dans la négociation TLS -SSLStaplingResponseTimeSkew secondes 300 svEDurée de vie maximale autorisée des réponses OCSP incluses dans la +SSLStaplingResponseTimeSkew secondes 300 svEDurée de vie maximale autorisée des réponses OCSP incluses dans la négociation TLS -SSLStaplingReturnResponderErrors on|off on svETransmet au client les erreurs survenues lors des requêtes +SSLStaplingReturnResponderErrors on|off on svETransmet au client les erreurs survenues lors des requêtes OCSP -SSLStaplingStandardCacheTimeout secondes 3600 svEDurée de vie des réponses OCSP dans le cache -SSLStrictSNIVHostCheck on|off off svEContrôle de l'accès des clients non-SNI à un serveur virtuel à +SSLStaplingStandardCacheTimeout secondes 3600 svEDurée de vie des réponses OCSP dans le cache +SSLStrictSNIVHostCheck on|off off svEContrôle de l'accès des clients non-SNI à un serveur virtuel à base de nom. -SSLUserName nom-varsdhENom de la variable servant à déterminer le nom de +SSLUserName nom-varsdhENom de la variable servant à déterminer le nom de l'utilisateur -SSLUseStapling on|off off svEActive l'ajout des réponses OCSP à la négociation TLS -SSLVerifyClient niveau none svdhENiveau de vérification du certificat client -SSLVerifyDepth nombre 1 svdhEProfondeur maximale des certificats de CA pour la +SSLUseStapling on|off off svEActive l'ajout des réponses OCSP à la négociation TLS +SSLVerifyClient niveau none svdhENiveau de vérification du certificat client +SSLVerifyDepth nombre 1 svdhEProfondeur maximale des certificats de CA pour la vérification des certificats clients -SSLVHostSNIPolicy strict|secure|authonly|insecure secure sEDéfinir la politique de compatibilité pour l'accès des clients SNI +SSLVHostSNIPolicy strict|secure|authonly|insecure secure sEDéfinir la politique de compatibilité pour l'accès des clients SNI aux serveurs virtuels. -StartServers nombresMNombre de processus enfants du serveur créés au +StartServers nombresMNombre de processus enfants du serveur créés au démarrage -StartThreads nombresMNombre de threads créés au démarrage -StrictHostCheck ON|OFF OFF svCDétermine si le nom d'hôte contenu dans une requête doit être +StartThreads nombresMNombre de threads créés au démarrage +StrictHostCheck ON|OFF OFF svCDétermine si le nom d'hôte contenu dans une requête doit être explicitement spécifié au niveau du serveur virtuel qui a pris en compte cette dernière. -Substitute s/modèle/substitution/[infq]dhEModèle de substition dans le contenu de la +Substitute s/modèle/substitution/[infq]dhEModèle de substition dans le contenu de la réponse -SubstituteInheritBefore on|off on dhEModifie l'ordre de fusion des modèles hérités -SubstituteMaxLineLength octets(b|B|k|K|m|M|g|G) 1m dhEDéfinit la longueur de ligne maximale -Suexec On|OffsBActive ou désactive la fonctionnalité suEXEC -SuexecUserGroup Utilisateur GroupesvEL'utilisateur et le groupe sous lesquels les programmes CGI +SubstituteInheritBefore on|off on dhEModifie l'ordre de fusion des modèles hérités +SubstituteMaxLineLength octets(b|B|k|K|m|M|g|G) 1m dhEDéfinit la longueur de ligne maximale +Suexec On|OffsBActive ou désactive la fonctionnalité suEXEC +SuexecUserGroup Utilisateur GroupesvEL'utilisateur et le groupe sous lesquels les programmes CGI doivent s'exécuter -ThreadLimit nombresMLe nombre de threads maximum que l'on peut définir par +ThreadLimit nombresMLe nombre de threads maximum que l'on peut définir par processus enfant -ThreadsPerChild nombresMNombre de threads créés par chaque processus +ThreadsPerChild nombresMNombre de threads créés par chaque processus enfant -ThreadStackSize taillesMLa taille en octets de la pile qu'utilisent les threads qui +ThreadStackSize taillesMLa taille en octets de la pile qu'utilisent les threads qui traitent les connexions clients -TimeOut time-interval[s] 60 svCTemps pendant lequel le serveur va attendre certains +TimeOut time-interval[s] 60 svCTemps pendant lequel le serveur va attendre certains évènements avant de considérer qu'une requête a échoué -TraceEnable [on|off|extended] on svCDétermine le comportement des requêtes +TraceEnable [on|off|extended] on svCDétermine le comportement des requêtes TRACE -TransferLog fichier|pipesvBSpécifie l'emplacement d'un fichier journal -TypesConfig chemin-fichier conf/mime.types sBLe chemin du fichier mime.types -UNCList hostname [hostname...]sCDéfinit quels sont les noms d'hôte UNC auxquels le serveur peut accéder +TransferLog fichier|pipesvBSpécifie l'emplacement d'un fichier journal +TypesConfig chemin-fichier conf/mime.types sBLe chemin du fichier mime.types +UNCList hostname [hostname...]sCDéfinit quels sont les noms d'hôte UNC auxquels le serveur peut accéder -UnDefine nom-variablesvCInvalide la définition d'une variable -UndefMacro nomsvdBSupprime une macro -UnsetEnv var-env [var-env] -...svdhBSupprime des variables de l'environnement -Use nom [valeur1 ... valeurN] -svdBUtilisation d'une macro -UseCanonicalName On|Off|DNS Off svdCDéfinit la manière dont le serveur détermine son propre nom +UnDefine nom-variablesvCInvalide la définition d'une variable +UndefMacro nomsvdBSupprime une macro +UnsetEnv var-env [var-env] +...svdhBSupprime des variables de l'environnement +Use nom [valeur1 ... valeurN] +svdBUtilisation d'une macro +UseCanonicalName On|Off|DNS Off svdCDéfinit la manière dont le serveur détermine son propre nom et son port -UseCanonicalPhysicalPort On|Off Off svdCDéfinit la manière dont le serveur +UseCanonicalPhysicalPort On|Off Off svdCDéfinit la manière dont le serveur détermine son propre port -User utilisateur unix #-1 sBL'utilisateur sous lequel le serveur va traiter les +User utilisateur unix #-1 sBL'utilisateur sous lequel le serveur va traiter les requêtes -UserDir nom-répertoire [nom-répertoire] ... -svBChemin des répertoires propres à un +UserDir nom-répertoire [nom-répertoire] ... +svBChemin des répertoires propres à un utilisateur -VHostCGIMode On|Off|Secure On vDétermine si le serveur virtuel peut exécuter des +VHostCGIMode On|Off|Secure On vDétermine si le serveur virtuel peut exécuter des sous-processus, et définit les privilèges disponibles pour ces dernier. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vAssigne des privilèges au choix aux sous-processus créés +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vAssigne des privilèges au choix aux sous-processus créés par un serveur virtuel. -VHostGroup identifiant-groupe-unixvDéfinit l'identifiant du groupe sous lequel s'exécute un +VHostGroup identifiant-groupe-unixvDéfinit l'identifiant du groupe sous lequel s'exécute un serveur virtuel. -VHostPrivs [+-]?nom-privilège [[+-]?nom-privilège] ...vAssigne des privilèges à un serveur virtuel. -VHostSecure On|Off On vDétermine si le serveur s'exécute avec une sécurité avancée +VHostPrivs [+-]?nom-privilège [[+-]?nom-privilège] ...vAssigne des privilèges à un serveur virtuel. +VHostSecure On|Off On vDétermine si le serveur s'exécute avec une sécurité avancée pour les serveurs virtuels. -VHostUser identifiant-utilisateur-unixvDéfinit l'identifiant utilisateur sous lequel s'exécute un +VHostUser identifiant-utilisateur-unixvDéfinit l'identifiant utilisateur sous lequel s'exécute un serveur virtuel. -VirtualDocumentRoot répertoire-interpolé|none none svEPermet une configuration dynamique de la racine des +VirtualDocumentRoot répertoire-interpolé|none none svEPermet une configuration dynamique de la racine des documents d'un serveur virtuel donné -VirtualDocumentRootIP répertoire-interpolé|none none svEConfiguration dynamique de la racine des documents pour un +VirtualDocumentRootIP répertoire-interpolé|none none svEConfiguration dynamique de la racine des documents pour un serveur virtuel donné -<VirtualHost +<VirtualHost adresse IP[:port] [adresse IP[:port]] ...> ... - </VirtualHost>sCContient des directives qui ne s'appliquent qu'à un nom + </VirtualHost>sCContient des directives qui ne s'appliquent qu'à un nom d'hôte spécifique ou à une adresse IP -VirtualScriptAlias répertoire-interpolé|none none svEConfiguration dynamique du répertoire des scripts CGI pour +VirtualScriptAlias répertoire-interpolé|none none svEConfiguration dynamique du répertoire des scripts CGI pour un serveur virtuel donné -VirtualScriptAliasIP répertoire-interpolé|none none svEConfiguration dynamique du répertoire des scripts CGI pour +VirtualScriptAliasIP répertoire-interpolé|none none svEConfiguration dynamique du répertoire des scripts CGI pour un serveur virtuel donné -Warning messagesvdhCMessage d'avertissement personnalisable en provenance de +Warning messagesvdhCMessage d'avertissement personnalisable en provenance de l'interprétation du fichier de configuration -WatchdogInterval time-interval[s] 1 sBIntervalle Watchdog en secondes -XBitHack on|off|full off svdhBInterprète les directives SSI dans les fichiers dont le bit +WatchdogInterval time-interval[s] 1 sBIntervalle Watchdog en secondes +XBitHack on|off|full off svdhBInterprète les directives SSI dans les fichiers dont le bit d'exécution est positionné -xml2EncAlias jeu-de-caractères alias [alias ...]sBDéfinit des alias pour les valeurs d'encodage -xml2EncDefault nomsvdhBDéfinit un encodage par défaut à utiliser lorsqu'aucune +xml2EncAlias jeu-de-caractères alias [alias ...]sBDéfinit des alias pour les valeurs d'encodage +xml2EncDefault nomsvdhBDéfinit un encodage par défaut à utiliser lorsqu'aucune information ne peut être automatiquement détectée -xml2StartParse élément [élément ...]svdhBIndique à l'interpréteur à partir de quelle balise il doit +xml2StartParse élément [élément ...]svdhBIndique à l'interpréteur à partir de quelle balise il doit commencer son traitement.

diff --git a/docs/manual/mod/quickreference.html.ja.utf8 b/docs/manual/mod/quickreference.html.ja.utf8 index d79ab01c50d..2022a766912 100644 --- a/docs/manual/mod/quickreference.html.ja.utf8 +++ b/docs/manual/mod/quickreference.html.ja.utf8 @@ -376,20 +376,20 @@ CGI program CryptoIV value none svdhEIV (Initialization Vector) to be used by the crypto filter CryptoKey value none svdhEKey to be used by the crypto filter CryptoSize integer 131072 svdhEMaximum size in bytes to buffer by the crypto filter -CTAuditStorage directorysEExisting directory where data for off-line audit will be stored -CTLogClient executablesELocation of certificate-transparency log client tool -CTLogConfigDB filenamesELog configuration database supporting dynamic updates -CTMaxSCTAge num-secondssEMaximum age of SCT obtained from a log, before it will be +CTAuditStorage directorysDExisting directory where data for off-line audit will be stored +CTLogClient executablesDLocation of certificate-transparency log client tool +CTLogConfigDB filenamesDLog configuration database supporting dynamic updates +CTMaxSCTAge num-secondssDMaximum age of SCT obtained from a log, before it will be refreshed -CTProxyAwareness oblivious|aware|requiresvELevel of CT awareness and enforcement for a proxy +CTProxyAwareness oblivious|aware|requiresvDLevel of CT awareness and enforcement for a proxy -CTSCTStorage directorysEExisting directory where SCTs are managed -CTServerHelloSCTLimit limitsELimit on number of SCTs that can be returned in +CTSCTStorage directorysDExisting directory where SCTs are managed +CTServerHelloSCTLimit limitsDLimit on number of SCTs that can be returned in ServerHello CTStaticLogConfig log-id|- public-key-file|- 1|0|- min-timestamp|- max-timestamp|- -log-URL|-sEStatic configuration of information about a log -CTStaticSCTs certificate-pem-file sct-directorysEStatic configuration of one or more SCTs for a server certificate +log-URL|-sDStatic configuration of information about a log +CTStaticSCTs certificate-pem-file sct-directorysDStatic configuration of one or more SCTs for a server certificate CustomLog file|pipe format|nickname @@ -454,7 +454,7 @@ X-OC-Mtime request header DirectorySlash On|Off On svdhBパス末尾ã®ã‚¹ãƒ©ãƒƒã‚·ãƒ¥ã§ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã™ã‚‹ã‹ã©ã†ã‹ã®ã‚ªãƒ³ã‚ªãƒ•ã‚’トグルã•ã›ã‚‹ DocumentRoot directory-path /usr/local/apache/h +svCウェブã‹ã‚‰è¦‹ãˆã‚‹ãƒ¡ã‚¤ãƒ³ã®ãƒ‰ã‚­ãƒ¥ãƒ¡ãƒ³ãƒˆãƒ„リーã«ãªã‚‹ ディレクトリ -DTracePrivileges On|Off Off sXDetermines whether the privileges required by dtrace are enabled. +DTracePrivileges On|Off Off sDDetermines whether the privileges required by dtrace are enabled. DumpIOInput On|Off Off sEエラーログã«ã™ã¹ã¦ã®å…¥åŠ›ãƒ‡ãƒ¼ã‚¿ã‚’ダンプ DumpIOOutput On|Off Off sEエラーログã«ã™ã¹ã¦ã®å‡ºåŠ›ãƒ‡ãƒ¼ã‚¿ã‚’ダンプ <Else> ... </Else>svdhCContains directives that apply only if the condition of a @@ -585,10 +585,10 @@ if file exists at startup presence or absence of a specific section directive <IfVersion [[!]operator] version> ... </IfVersion>svdhEãƒãƒ¼ã‚¸ãƒ§ãƒ³ä¾å­˜ã®è¨­å®šã‚’入れる -ImapBase map|referer|URL http://servername/ svdhBDefault base for imagemap files -ImapDefault error|nocontent|map|referer|URL nocontent svdhBDefault action when an imagemap is called with coordinates +ImapBase map|referer|URL http://servername/ svdhDDefault base for imagemap files +ImapDefault error|nocontent|map|referer|URL nocontent svdhDDefault action when an imagemap is called with coordinates that are not explicitly mapped -ImapMenu none|formatted|semiformatted|unformatted formatted svdhBAction if no coordinates are given when calling +ImapMenu none|formatted|semiformatted|unformatted formatted svdhDAction if no coordinates are given when calling an imagemap Include file-path|directory-pathsvdCサーãƒè¨­å®šãƒ•ã‚¡ã‚¤ãƒ«ä¸­ã‹ã‚‰ä»–ã®è¨­å®šãƒ•ã‚¡ã‚¤ãƒ«ã‚’å–り込む IncludeOptional file-path|directory-path|wildcardsvdCIncludes other configuration files from within @@ -757,408 +757,417 @@ simultaneously MDDriveMode always|auto|manual auto sXformer name of MDRenewMode. MDExternalAccountBinding key-id hmac-64 | none | file none sXSet the external account binding keyid and hmac values to use at CA MDHttpProxy urlsXDefine a proxy for outgoing connections. -MDInitialDelay duration 0s sXHow long to delay the first certificate check. -MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts -MDMember hostnamesXAdditional hostname for the managed domain. -MDMembers auto|manual auto sXControl if the alias domain names are automatically added. -MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains -MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. -MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. -MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. -<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. -MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. -MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. -MDProfile namesXUse a specific ACME profile from the CA -MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. -MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. -MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). -MDRenewWindow duration 33% sXControl when a certificate will be renewed. -MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. -MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. -MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered -MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. -MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. -MDStapling on|off off sXEnable stapling for all or a particular MDomain. -MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. -MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. -MDStoreDir path md sXPath on the local file system to store the Managed Domains data. -MDStoreLocks on|off|duration off sXConfigure locking of store for updates -MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. -MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections -MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. +MDHttpProxyCACertificateFile path-to-pem-file none sXSets the root (CA) certificates to use for TLS connections to the http-proxy. +MDInitialDelay duration 0s sXHow long to delay the first certificate check. +MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts +MDMember hostnamesXAdditional hostname for the managed domain. +MDMembers auto|manual auto sXControl if the alias domain names are automatically added. +MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains +MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. +MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. +MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. +<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. +MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. +MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. +MDProfile namesXUse a specific ACME profile from the CA +MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. +MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. +MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). +MDRenewWindow duration 33% sXControl when a certificate will be renewed. +MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. +MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. +MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered +MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. +MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. +MDStapling on|off off sXEnable stapling for all or a particular MDomain. +MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. +MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. +MDStoreDir path md sXPath on the local file system to store the Managed Domains data. +MDStoreLocks on|off|duration off sXConfigure locking of store for updates +MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. +MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections +MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. -MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers -MetaDir directory .web svdhEName of the directory to find CERN-style meta information +MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers +MetaDir directory .web svdhDName of the directory to find CERN-style meta information files -MetaFiles on|off off svdhEActivates CERN meta-file processing -MetaSuffix suffix .meta svdhEFile name suffix for the file containing CERN-style +MetaFiles on|off off svdhDActivates CERN meta-file processing +MetaSuffix suffix .meta svdhDFile name suffix for the file containing CERN-style meta information -MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection -MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents +MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection +MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents using the specified magic file -MimeOptions option [option] ...svdhBConfigures mod_mime behavior -MinSpareServers number 5 sMアイドルãªå­ã‚µãƒ¼ãƒãƒ—ロセスã®æœ€å°å€‹æ•° -MinSpareThreads numbersMリクエストã«å¿œç­”ã™ã‚‹ã“ã¨ã®ã§ãã‚‹ +MimeOptions option [option] ...svdhBConfigures mod_mime behavior +MinSpareServers number 5 sMアイドルãªå­ã‚µãƒ¼ãƒãƒ—ロセスã®æœ€å°å€‹æ•° +MinSpareThreads numbersMリクエストã«å¿œç­”ã™ã‚‹ã“ã¨ã®ã§ãã‚‹ アイドルスレッド数ã®æœ€å°æ•° -MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time -ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate -ModMimeUsePathInfo On|Off Off dpath_info コンãƒãƒ¼ãƒãƒ³ãƒˆã‚’ファイルåã®ä¸€éƒ¨ã¨ã—ã¦æ‰±ã†ã‚ˆã†ã« +MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time +ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate +ModMimeUsePathInfo On|Off Off dpath_info コンãƒãƒ¼ãƒãƒ³ãƒˆã‚’ファイルåã®ä¸€éƒ¨ã¨ã—ã¦æ‰±ã†ã‚ˆã†ã« mod_mime ã«é€šçŸ¥ã™ã‚‹ -MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers -[Handlers|Filters] NegotiatedOnly svdhMultiViews ã§ã®ãƒžãƒƒãƒãƒ³ã‚°ã®æ¤œç´¢ã«å«ã¾ã›ã‚‹ +MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers +[Handlers|Filters] NegotiatedOnly svdhMultiViews ã§ã®ãƒžãƒƒãƒãƒ³ã‚°ã®æ¤œç´¢ã«å«ã¾ã›ã‚‹ ファイルã®ã‚¿ã‚¤ãƒ—を指定ã™ã‚‹ -Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all +Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all or specified mutexes -NameVirtualHost addr[:port]sCåå‰ãƒ™ãƒ¼ã‚¹ã®ãƒãƒ¼ãƒãƒ£ãƒ«ãƒ›ã‚¹ãƒˆã®ãŸã‚ã® IP アドレスを指定 -NoProxy host [host] ...svE直接接続ã™ã‚‹ ホストã€ãƒ‰ãƒ¡ã‚¤ãƒ³ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ -NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates -NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request -Options - [+|-]option [[+|-]option] ... All svdhCディレクトリã«å¯¾ã—ã¦ä½¿ç”¨å¯èƒ½ãªæ©Ÿèƒ½ã‚’設定ã™ã‚‹ - Order ordering Deny,Allow dhEデフォルトã®ã‚¢ã‚¯ã‚»ã‚¹å¯èƒ½ãªçŠ¶æ…‹ã¨ã€Allow 㨠+NameVirtualHost addr[:port]sCåå‰ãƒ™ãƒ¼ã‚¹ã®ãƒãƒ¼ãƒãƒ£ãƒ«ãƒ›ã‚¹ãƒˆã®ãŸã‚ã® IP アドレスを指定 +NoProxy host [host] ...svE直接接続ã™ã‚‹ ホストã€ãƒ‰ãƒ¡ã‚¤ãƒ³ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ +NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates +NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request +Options + [+|-]option [[+|-]option] ... All svdhCディレクトリã«å¯¾ã—ã¦ä½¿ç”¨å¯èƒ½ãªæ©Ÿèƒ½ã‚’設定ã™ã‚‹ + Order ordering Deny,Allow dhEデフォルトã®ã‚¢ã‚¯ã‚»ã‚¹å¯èƒ½ãªçŠ¶æ…‹ã¨ã€Allow 㨠Deny ãŒè©•ä¾¡ã•ã‚Œã‚‹é †ç•ªã‚’制御ã™ã‚‹ -OutputSed sed-commanddhXSed command for filtering response content -PassEnv env-variable [env-variable] -...svdhBシェルã‹ã‚‰ã®ç’°å¢ƒå¤‰æ•°ã‚’渡㙠-PidFile filename logs/httpd.pid sMデーモンã®ãƒ—ロセス ID +OutputSed sed-commanddhXSed command for filtering response content +PassEnv env-variable [env-variable] +...svdhBシェルã‹ã‚‰ã®ç’°å¢ƒå¤‰æ•°ã‚’渡㙠+PidFile filename logs/httpd.pid sMデーモンã®ãƒ—ロセス ID をサーãƒãŒè¨˜éŒ²ã™ã‚‹ãŸã‚ã®ãƒ•ã‚¡ã‚¤ãƒ« -PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. -PolicyConditionalURL urlsvdEURL describing the conditional request policy. -PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. -PolicyFilter on|offsvdEEnable or disable policies for the given URL space. -PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. -PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. -PolicyLength ignore|log|enforcesvdEEnable the content length policy. -PolicyLengthURL urlsvdEURL describing the content length policy. -PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. -PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. -PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. -PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. -PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. -PolicyTypeURL urlsvdEURL describing the content type policy. -PolicyValidation ignore|log|enforcesvdEEnable the validation policy. -PolicyValidationURL urlsvdEURL describing the content type policy. -PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. -PolicyVaryURL urlsvdEURL describing the content type policy. -PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. -PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. -PollersPerChild number 0 sMNumber of poll threads per child process -PrivilegesMode FAST|SECURE|SELECTIVE FAST svdXTrade off processing speed and efficiency vs security against +PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. +PolicyConditionalURL urlsvdEURL describing the conditional request policy. +PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. +PolicyFilter on|offsvdEEnable or disable policies for the given URL space. +PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. +PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. +PolicyLength ignore|log|enforcesvdEEnable the content length policy. +PolicyLengthURL urlsvdEURL describing the content length policy. +PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. +PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. +PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. +PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. +PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. +PolicyTypeURL urlsvdEURL describing the content type policy. +PolicyValidation ignore|log|enforcesvdEEnable the validation policy. +PolicyValidationURL urlsvdEURL describing the content type policy. +PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. +PolicyVaryURL urlsvdEURL describing the content type policy. +PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. +PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. +PollersPerChild number 0 sMNumber of poll threads per child process +PrivilegesMode FAST|SECURE|SELECTIVE FAST svdDTrade off processing speed and efficiency vs security against malicious privileges-aware code. -Protocol protocolsvCProtocol for a listening socket -ProtocolEcho On|Off Off svXエコーサーãƒã®æœ‰åŠ¹ç„¡åŠ¹ã‚’設定ã—ã¾ã™ã€‚ -Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host -ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation -<Proxy wildcard-url> ...</Proxy>svEプロキシã•ã‚Œã‚‹ãƒªã‚½ãƒ¼ã‚¹ã«é©ç”¨ã•ã‚Œã‚‹ã‚³ãƒ³ãƒ†ãƒŠ -Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server -ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers -ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the +Protocol protocolsvCProtocol for a listening socket +ProtocolEcho On|Off Off svXエコーサーãƒã®æœ‰åŠ¹ç„¡åŠ¹ã‚’設定ã—ã¾ã™ã€‚ +Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host +ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation +<Proxy wildcard-url> ...</Proxy>svEプロキシã•ã‚Œã‚‹ãƒªã‚½ãƒ¼ã‚¹ã«é©ç”¨ã•ã‚Œã‚‹ã‚³ãƒ³ãƒ†ãƒŠ +Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server +ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers +ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the MPM for asynchronous processing -ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections -ProxyBadHeader IsError|Ignore|StartBody IsError svE応答ã«ãŠã‹ã—ãªãƒ˜ãƒƒãƒ€ãŒã‚ã‚‹å ´åˆã®æ‰±ã„方を決ã‚ã‚‹ -ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its +ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections +ProxyBadHeader IsError|Ignore|StartBody IsError svE応答ã«ãŠã‹ã—ãªãƒ˜ãƒƒãƒ€ãŒã‚ã‚‹å ´åˆã®æ‰±ã„方を決ã‚ã‚‹ +ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its announcements -ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy -ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to -ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement -ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend +ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy +ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to +ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement +ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend beacons -ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement -ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements -ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend +ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement +ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements +ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend is taken out of rotation -ProxyBlock *|word|host|domain -[word|host|domain] ...svEプロキシ接続をç¦æ­¢ã™ã‚‹èªžå¥ã€ãƒ›ã‚¹ãƒˆåã€ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’指定ã™ã‚‹ -ProxyDomain DomainsvEプロキシã•ã‚ŒãŸãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®ãƒ‰ãƒ¡ã‚¤ãƒ³å -ProxyErrorOverride On|Off Off svdEプロキシã•ã‚ŒãŸã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®ã‚¨ãƒ©ãƒ¼ãƒšãƒ¼ã‚¸ã‚’上書ãã™ã‚‹ -ProxyExpressDBMFile pathnamesvEPathname to DBM file. -ProxyExpressDBMType type default svEDBM type of file. -ProxyExpressEnable on|off off svEEnable the module functionality. -ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application -ProxyFCGISetEnvIf conditional-expression +ProxyBlock *|word|host|domain +[word|host|domain] ...svEプロキシ接続をç¦æ­¢ã™ã‚‹èªžå¥ã€ãƒ›ã‚¹ãƒˆåã€ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’指定ã™ã‚‹ +ProxyDomain DomainsvEプロキシã•ã‚ŒãŸãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®ãƒ‰ãƒ¡ã‚¤ãƒ³å +ProxyErrorOverride On|Off Off svdEプロキシã•ã‚ŒãŸã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®ã‚¨ãƒ©ãƒ¼ãƒšãƒ¼ã‚¸ã‚’上書ãã™ã‚‹ +ProxyExpressDBMFile pathnamesvEPathname to DBM file. +ProxyExpressDBMType type default svEDBM type of file. +ProxyExpressEnable on|off off svEEnable the module functionality. +ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application +ProxyFCGISetEnvIf conditional-expression [!]environment-variable-name - [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up -ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings -ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server -ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing -ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response -ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters -ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers -ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and + [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up +ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings +ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server +ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing +ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response +ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters +ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers +ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and stylesheets. -ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. -ProxyHTMLDocType HTML|XHTML [Legacy]
OR +ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. +ProxyHTMLDocType HTML|XHTML [Legacy]
OR
ProxyHTMLDocType fpi [SGML|XML]
OR
ProxyHTMLDocType html5
OR -
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. -ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. -ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. -ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, +
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. +ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. +ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. +ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, and scripting events. -ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. -ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of +ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. +ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of ProxyHTMLURLMap rules. -ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. -ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML +ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. +ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML <head> sections. -ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. -ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links -ProxyIOBufferSize bytes 8192 svE内部データスループットãƒãƒƒãƒ•ã‚¡ã®ã‚µã‚¤ã‚ºã‚’決定ã™ã‚‹ -<ProxyMatch regex> ...</ProxyMatch>svEæ­£è¦è¡¨ç¾ã§ã®ãƒžãƒƒãƒã«ã‚ˆã‚‹ãƒ—ロキシリソース用ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–コンテナ -ProxyMaxForwards number 10 svEリクエストãŒãƒ•ã‚©ãƒ¯ãƒ¼ãƒ‰ã•ã‚Œã‚‹ãƒ—ロキシã®æœ€å¤§æ•° -ProxyPass [path] !|url [key=value key=value ...]]svdEリモートサーãƒã‚’ローカルサーãƒã® URL 空間ã«ãƒžãƒƒãƒ—ã™ã‚‹ -ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server -svdEEnable Environment Variable interpolation in Reverse Proxy configurations -svdEMaps remote servers into the local server URL-space using regular expressions -ProxyPassReverse [path] urlsvdEリãƒãƒ¼ã‚¹ãƒ—ロキシã•ã‚ŒãŸã‚µãƒ¼ãƒã‹ã‚‰é€ã‚‰ã‚ŒãŸ HTTP 応答ヘッダ㮠+ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. +ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links +ProxyIOBufferSize bytes 8192 svE内部データスループットãƒãƒƒãƒ•ã‚¡ã®ã‚µã‚¤ã‚ºã‚’決定ã™ã‚‹ +<ProxyMatch regex> ...</ProxyMatch>svEæ­£è¦è¡¨ç¾ã§ã®ãƒžãƒƒãƒã«ã‚ˆã‚‹ãƒ—ロキシリソース用ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–コンテナ +ProxyMaxForwards number 10 svEリクエストãŒãƒ•ã‚©ãƒ¯ãƒ¼ãƒ‰ã•ã‚Œã‚‹ãƒ—ロキシã®æœ€å¤§æ•° +ProxyPass [path] !|url [key=value key=value ...]]svdEリモートサーãƒã‚’ローカルサーãƒã® URL 空間ã«ãƒžãƒƒãƒ—ã™ã‚‹ +ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server +svdEEnable Environment Variable interpolation in Reverse Proxy configurations +svdEMaps remote servers into the local server URL-space using regular expressions +ProxyPassReverse [path] urlsvdEリãƒãƒ¼ã‚¹ãƒ—ロキシã•ã‚ŒãŸã‚µãƒ¼ãƒã‹ã‚‰é€ã‚‰ã‚ŒãŸ HTTP 応答ヘッダ㮠URL を調整ã™ã‚‹ -ProxyPassReverseCookieDomain internal-domain public-domainsvdEリãƒãƒ¼ã‚¹ãƒ—ロキシサーãƒã‹ã‚‰ã® Set-Cookie ヘッダ㮠Domain 文字列を +ProxyPassReverseCookieDomain internal-domain public-domainsvdEリãƒãƒ¼ã‚¹ãƒ—ロキシサーãƒã‹ã‚‰ã® Set-Cookie ヘッダ㮠Domain 文字列を 調整ã™ã‚‹ -ProxyPassReverseCookiePath internal-path public-pathsvdEReverse プロキシサーãƒã‹ã‚‰ã® Set-Cookie ヘッダ㮠Path 文字列を +ProxyPassReverseCookiePath internal-path public-pathsvdEReverse プロキシサーãƒã‹ã‚‰ã® Set-Cookie ヘッダ㮠Path 文字列を 調整ã™ã‚‹ -ProxyPreserveHost On|Off Off svdEプロキシリクエストã«ã€å—ã‘付ã‘㟠Host HTTP ヘッダを使ㆠ-ProxyReceiveBufferSize bytes 0 svEプロキシã•ã‚Œã‚‹ HTTP 㨠FTP 接続ã®ãŸã‚ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒãƒƒãƒ•ã‚¡ã‚µã‚¤ã‚º -ProxyRemote match remote-serversvE特定ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’扱ã†æ™‚ã«ä½¿ã‚れるリモートプロキシを指定ã™ã‚‹ -ProxyRemoteMatch regex remote-serversvEæ­£è¦è¡¨ç¾ã§ã®ãƒžãƒƒãƒã«ã‚ˆã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’扱ã†ãƒªãƒ¢ãƒ¼ãƒˆãƒ—ロキシã®æŒ‡å®š -ProxyRequests On|Off Off svEフォワード (標準ã®) プロキシリクエストを有効ã«ã™ã‚‹ -ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the +ProxyPreserveHost On|Off Off svdEプロキシリクエストã«ã€å—ã‘付ã‘㟠Host HTTP ヘッダを使ㆠ+ProxyReceiveBufferSize bytes 0 svEプロキシã•ã‚Œã‚‹ HTTP 㨠FTP 接続ã®ãŸã‚ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒãƒƒãƒ•ã‚¡ã‚µã‚¤ã‚º +ProxyRemote match remote-serversvE特定ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’扱ã†æ™‚ã«ä½¿ã‚れるリモートプロキシを指定ã™ã‚‹ +ProxyRemoteMatch regex remote-serversvEæ­£è¦è¡¨ç¾ã§ã®ãƒžãƒƒãƒã«ã‚ˆã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’扱ã†ãƒªãƒ¢ãƒ¼ãƒˆãƒ—ロキシã®æŒ‡å®š +ProxyRequests On|Off Off svEフォワード (標準ã®) プロキシリクエストを有効ã«ã™ã‚‹ +ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the backend -ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response +ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response header -svdESet various Proxy balancer or member parameters -ProxySourceAddress addresssvESet local IP address for outgoing proxy connections -svEShow Proxy LoadBalancer status in mod_status -ProxyTimeout seconds 300 svEプロキシã•ã‚ŒãŸãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ã‚¤ãƒ ã‚¢ã‚¦ãƒˆ -ProxyVia On|Off|Full|Block Off svEプロキシã•ã‚ŒãŸãƒªã‚¯ã‚¨ã‚¹ãƒˆã® Via HTTP 応答ヘッダ +svdESet various Proxy balancer or member parameters +ProxySourceAddress addresssvESet local IP address for outgoing proxy connections +svEShow Proxy LoadBalancer status in mod_status +ProxyTimeout seconds 300 svEプロキシã•ã‚ŒãŸãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ã‚¤ãƒ ã‚¢ã‚¦ãƒˆ +ProxyVia On|Off|Full|Block Off svEプロキシã•ã‚ŒãŸãƒªã‚¯ã‚¨ã‚¹ãƒˆã® Via HTTP 応答ヘッダ ã«ã‚ˆã‚Šæä¾›ã•ã‚Œã‚‹æƒ…å ± -ProxyWebsocketAsync ON|OFFsvEInstructs this module to try to create an asynchronous tunnel -ProxyWebsocketAsyncDelay num[ms] 0 svESets the amount of time the tunnel waits synchronously for data -ProxyWebsocketFallbackToProxyHttp On|Off On svEInstructs this module to let mod_proxy_http handle the request -ProxyWebsocketIdleTimeout num[ms] 0 svESets the maximum amount of time to wait for data on the websockets tunnel -QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is +ProxyWebsocketAsync ON|OFFsvDInstructs this module to try to create an asynchronous tunnel +ProxyWebsocketAsyncDelay num[ms] 0 svDSets the amount of time the tunnel waits synchronously for data +ProxyWebsocketFallbackToProxyHttp On|Off On svDInstructs this module to let mod_proxy_http handle the request +ProxyWebsocketIdleTimeout num[ms] 0 svDSets the maximum amount of time to wait for data on the websockets tunnel +QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is fully qualified -ReadBufferSize bytes 8192 svdCSize of the buffers used to read data -ReadmeName filenamesvdhBインデックス一覧ã®æœ€å¾Œã«æŒ¿å…¥ã•ã‚Œã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã®åå‰ -ReceiveBufferSize bytes 0 sMTCP å—ä¿¡ãƒãƒƒãƒ•ã‚¡ã‚µã‚¤ã‚º -Redirect [status] URL-path -URLsvdhBクライアントãŒé•ã† URL ã‚’å–å¾—ã™ã‚‹ã‚ˆã†ã«å¤–部ã¸ã®ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã‚’ +ReadBufferSize bytes 8192 svdCSize of the buffers used to read data +ReadmeName filenamesvdhBインデックス一覧ã®æœ€å¾Œã«æŒ¿å…¥ã•ã‚Œã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã®åå‰ +ReceiveBufferSize bytes 0 sMTCP å—ä¿¡ãƒãƒƒãƒ•ã‚¡ã‚µã‚¤ã‚º +Redirect [status] URL-path +URLsvdhBクライアントãŒé•ã† URL ã‚’å–å¾—ã™ã‚‹ã‚ˆã†ã«å¤–部ã¸ã®ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã‚’ é€ã‚‹ -RedirectMatch [status] regex -URLsvdhBç¾åœ¨ã® URL ã¸ã®æ­£è¦è¡¨ç¾ã®ãƒžãƒƒãƒã«ã‚ˆã‚Š +RedirectMatch [status] regex +URLsvdhBç¾åœ¨ã® URL ã¸ã®æ­£è¦è¡¨ç¾ã®ãƒžãƒƒãƒã«ã‚ˆã‚Š 外部ã¸ã®ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã‚’é€ã‚‹ -RedirectPermanent URL-path URLsvdhBクライアントãŒé•ã† URL ã‚’å–å¾—ã™ã‚‹ã‚ˆã†ã«å¤–部ã¸ã®æ°¸ä¹…的㪠+RedirectPermanent URL-path URLsvdhBクライアントãŒé•ã† URL ã‚’å–å¾—ã™ã‚‹ã‚ˆã†ã«å¤–部ã¸ã®æ°¸ä¹…的㪠リダイレクトをé€ã‚‹ -RedirectRelative On|Off Off svdBAllows relative redirect targets. -RedirectTemp URL-path URLsvdhBクライアントãŒé•ã† URL ã‚’å–å¾—ã™ã‚‹ã‚ˆã†ã«å¤–部ã¸ã®ä¸€æ™‚的㪠+RedirectRelative On|Off Off svdBAllows relative redirect targets. +RedirectTemp URL-path URLsvdhBクライアントãŒé•ã† URL ã‚’å–å¾—ã™ã‚‹ã‚ˆã†ã«å¤–部ã¸ã®ä¸€æ™‚的㪠リダイレクトをé€ã‚‹ -RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) -RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) -ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers -RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes -RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods -RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses -RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses -RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling -RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks -RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoveCharset extension [extension] -...vdhファイルã®æ‹¡å¼µå­ã«é–¢é€£ä»˜ã‘られãŸã™ã¹ã¦ã®æ–‡å­—セット +RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) +RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) +ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers +RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes +RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods +RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses +RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses +RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling +RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks +RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoveCharset extension [extension] +...vdhファイルã®æ‹¡å¼µå­ã«é–¢é€£ä»˜ã‘られãŸã™ã¹ã¦ã®æ–‡å­—セット を解除ã™ã‚‹ -RemoveEncoding extension [extension] -...vdhファイルã®æ‹¡å¼µå­ã«é–¢é€£ä»˜ã‘られãŸã™ã¹ã¦ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒˆã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚° +RemoveEncoding extension [extension] +...vdhファイルã®æ‹¡å¼µå­ã«é–¢é€£ä»˜ã‘られãŸã™ã¹ã¦ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒˆã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚° を解除ã™ã‚‹ -RemoveHandler extension [extension] -...vdhファイルã®æ‹¡å¼µå­ã«é–¢é€£ä»˜ã‘られãŸã™ã¹ã¦ã®ãƒãƒ³ãƒ‰ãƒ©ã‚’ +RemoveHandler extension [extension] +...vdhファイルã®æ‹¡å¼µå­ã«é–¢é€£ä»˜ã‘られãŸã™ã¹ã¦ã®ãƒãƒ³ãƒ‰ãƒ©ã‚’ 解除ã™ã‚‹ -RemoveInputFilter extension [extension] -...vdhファイル拡張å­ã«é–¢é€£ä»˜ã‘られãŸå…¥åŠ›ãƒ•ã‚£ãƒ«ã‚¿ã‚’解除ã™ã‚‹ -RemoveLanguage extension [extension] -...vdhファイル拡張å­ã«é–¢é€£ä»˜ã‘られãŸè¨€èªžã‚’解除ã™ã‚‹ -RemoveOutputFilter extension [extension] -...vdhファイル拡張å­ã«é–¢é€£ä»˜ã‘られãŸå‡ºåŠ›ãƒ•ã‚£ãƒ«ã‚¿ã‚’解除ã™ã‚‹ -RemoveType extension [extension] -...vdhファイルã®æ‹¡å¼µå­ã¨é–¢é€£ä»˜ã‘られãŸã‚³ãƒ³ãƒ†ãƒ³ãƒˆã‚¿ã‚¤ãƒ—ã‚’ +RemoveInputFilter extension [extension] +...vdhファイル拡張å­ã«é–¢é€£ä»˜ã‘られãŸå…¥åŠ›ãƒ•ã‚£ãƒ«ã‚¿ã‚’解除ã™ã‚‹ +RemoveLanguage extension [extension] +...vdhファイル拡張å­ã«é–¢é€£ä»˜ã‘られãŸè¨€èªžã‚’解除ã™ã‚‹ +RemoveOutputFilter extension [extension] +...vdhファイル拡張å­ã«é–¢é€£ä»˜ã‘られãŸå‡ºåŠ›ãƒ•ã‚£ãƒ«ã‚¿ã‚’解除ã™ã‚‹ +RemoveType extension [extension] +...vdhファイルã®æ‹¡å¼µå­ã¨é–¢é€£ä»˜ã‘られãŸã‚³ãƒ³ãƒ†ãƒ³ãƒˆã‚¿ã‚¤ãƒ—ã‚’ 解除ã™ã‚‹ -RequestHeader set|append|add|unset header -[value] [early|env=[!]variable]svdhEHTTP リクエストヘッダã®è¨­å®š -RequestReadTimeout +RequestHeader set|append|add|unset header +[value] [early|env=[!]variable]svdhEHTTP リクエストヘッダã®è¨­å®š +RequestReadTimeout [handshake=timeout[-maxtimeout][,MinRate=rate] [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate] - handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving + handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving the request headers and/or body from client. -Require [not] entity-name - [entity-name] ...dhBTests whether an authenticated user is authorized by +Require [not] entity-name + [entity-name] ...dhBTests whether an authenticated user is authorized by an authorization provider. -<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none +<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none must fail and at least one must succeed for the enclosing directive to succeed. -<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one +<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one must succeed for the enclosing directive to succeed. -<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none +<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none must succeed for the enclosing directive to not fail. -RewriteBase URL-pathdhESets the base URL for per-directory rewrites - RewriteCond - TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place +RewriteBase URL-pathdhESets the base URL for per-directory rewrites + RewriteCond + TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place -RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine -RewriteMap MapName MapType:MapSource +RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine +RewriteMap MapName MapType:MapSource [MapTypeOptions] -svEDefines a mapping function for key-lookup -RewriteOptions OptionssvdhESets some special options for the rewrite engine -RewriteRule - [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine -RLimitCPU seconds|max [seconds|max]svdhCApache ã®å­ãƒ—ロセスã‹ã‚‰èµ·å‹•ã•ã‚ŒãŸãƒ—ロセス㮠CPU 消費é‡ã‚’ +svEDefines a mapping function for key-lookup +RewriteOptions OptionssvdhESets some special options for the rewrite engine +RewriteRule + [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine +RLimitCPU seconds|max [seconds|max]svdhCApache ã®å­ãƒ—ロセスã‹ã‚‰èµ·å‹•ã•ã‚ŒãŸãƒ—ロセス㮠CPU 消費é‡ã‚’ 制é™ã™ã‚‹ -RLimitMEM bytes|max [bytes|max]svdhCApache ã®å­ãƒ—ロセスã‹ã‚‰èµ·å‹•ã•ã‚ŒãŸãƒ—ロセスã®ãƒ¡ãƒ¢ãƒªæ¶ˆè²»é‡ã‚’ +RLimitMEM bytes|max [bytes|max]svdhCApache ã®å­ãƒ—ロセスã‹ã‚‰èµ·å‹•ã•ã‚ŒãŸãƒ—ロセスã®ãƒ¡ãƒ¢ãƒªæ¶ˆè²»é‡ã‚’ 制é™ã™ã‚‹ -RLimitNPROC number|max [number|max]svdhCApache ã®å­ãƒ—ロセスã‹ã‚‰èµ·å‹•ã•ã‚ŒãŸãƒ—ロセスãŒèµ·å‹•ã™ã‚‹ãƒ—ロセス㮠+RLimitNPROC number|max [number|max]svdhCApache ã®å­ãƒ—ロセスã‹ã‚‰èµ·å‹•ã•ã‚ŒãŸãƒ—ロセスãŒèµ·å‹•ã™ã‚‹ãƒ—ロセス㮠数を制é™ã™ã‚‹ -Satisfy Any|All All dhEホストレベルã®ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã¨ãƒ¦ãƒ¼ã‚¶èªè¨¼ã¨ã®ç›¸äº’作用を指定 -ScoreBoardFile file-path logs/apache_status sMå­ãƒ—ロセスã¨é€£æºã™ã‚‹ãŸã‚ã®ãƒ‡ãƒ¼ã‚¿ã‚’ä¿å­˜ã™ã‚‹ +Satisfy Any|All All dhEホストレベルã®ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã¨ãƒ¦ãƒ¼ã‚¶èªè¨¼ã¨ã®ç›¸äº’作用を指定 +ScoreBoardFile file-path logs/apache_status sMå­ãƒ—ロセスã¨é€£æºã™ã‚‹ãŸã‚ã®ãƒ‡ãƒ¼ã‚¿ã‚’ä¿å­˜ã™ã‚‹ ファイルã®ä½ç½® -Script method cgi-scriptsvdB特定ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ¡ã‚½ãƒƒãƒ‰ã«å¯¾ã—㦠CGI スクリプトを +Script method cgi-scriptsvdB特定ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ¡ã‚½ãƒƒãƒ‰ã«å¯¾ã—㦠CGI スクリプトを 実行ã™ã‚‹ã‚ˆã†ã«è¨­å®š -ScriptAlias URL-path -file-path|directory-pathsvdBURL をファイルシステムã®ä½ç½®ã¸ãƒžãƒƒãƒ—ã—ã€ãƒžãƒƒãƒ—先を +ScriptAlias URL-path +file-path|directory-pathsvdBURL をファイルシステムã®ä½ç½®ã¸ãƒžãƒƒãƒ—ã—ã€ãƒžãƒƒãƒ—先を CGI スクリプトã«æŒ‡å®š -ScriptAliasMatch regex -file-path|directory-pathsvBURL ã‚’æ­£è¦è¡¨ç¾ã‚’使ã£ã¦ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ ã®ä½ç½®ã¸ãƒžãƒƒãƒ—ã—ã€ãƒžãƒƒãƒ—先を +ScriptAliasMatch regex +file-path|directory-pathsvBURL ã‚’æ­£è¦è¡¨ç¾ã‚’使ã£ã¦ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ ã®ä½ç½®ã¸ãƒžãƒƒãƒ—ã—ã€ãƒžãƒƒãƒ—先を CGI スクリプトã«æŒ‡å®š -ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCCGI スクリプトã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ—リタã®ä½ç½®ã‚’調ã¹ã‚‹ãŸã‚ã®æ‰‹æ³• -ScriptLog file-pathsvBCGI スクリプトã®ã‚¨ãƒ©ãƒ¼ãƒ­ã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®å ´æ‰€ -ScriptLogBuffer bytes 1024 svBスクリプトログã«è¨˜éŒ²ã•ã‚Œã‚‹ PUT ã‚„ POST リクエストã®å†…容ã®ä¸Šé™ -ScriptLogLength bytes 10385760 svBCGI スクリプトã®ãƒ­ã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®å¤§ãã•ã®ä¸Šé™ -ScriptSock file-path logs/cgisock sBCGI デーモンã¨ã®é€šä¿¡ã«ä½¿ã‚れるソケットã®ãƒ•ã‚¡ã‚¤ãƒ«åã®æŽ¥é ­è¾ž -SecureListen [IP-address:]portnumber -Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port -SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters +ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCCGI スクリプトã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ—リタã®ä½ç½®ã‚’調ã¹ã‚‹ãŸã‚ã®æ‰‹æ³• +ScriptLog file-pathsvBCGI スクリプトã®ã‚¨ãƒ©ãƒ¼ãƒ­ã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®å ´æ‰€ +ScriptLogBuffer bytes 1024 svBスクリプトログã«è¨˜éŒ²ã•ã‚Œã‚‹ PUT ã‚„ POST リクエストã®å†…容ã®ä¸Šé™ +ScriptLogLength bytes 10385760 svBCGI スクリプトã®ãƒ­ã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®å¤§ãã•ã®ä¸Šé™ +ScriptSock file-path logs/cgisock sBCGI デーモンã¨ã®é€šä¿¡ã«ä½¿ã‚れるソケットã®ãƒ•ã‚¡ã‚¤ãƒ«åã®æŽ¥é ­è¾ž +SecureListen [IP-address:]portnumber +Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port +SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters of a request or the last 63, assuming the request itself is greater than 63 chars. -SendBufferSize bytes 0 sMTCP ãƒãƒƒãƒ•ã‚¡ã‚µã‚¤ã‚º -ServerAdmin email-address|URLsvCサーãƒãŒã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã«é€ã‚‹ã‚¨ãƒ©ãƒ¼ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã«å«ã‚ã‚‹é›»å­ãƒ¡ãƒ¼ãƒ«ã® +SendBufferSize bytes 0 sMTCP ãƒãƒƒãƒ•ã‚¡ã‚µã‚¤ã‚º +ServerAdmin email-address|URLsvCサーãƒãŒã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã«é€ã‚‹ã‚¨ãƒ©ãƒ¼ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã«å«ã‚ã‚‹é›»å­ãƒ¡ãƒ¼ãƒ«ã® アドレス -ServerAlias hostname [hostname] ...vCリクエストをåå‰ãƒ™ãƒ¼ã‚¹ã®ãƒãƒ¼ãƒãƒ£ãƒ«ãƒ›ã‚¹ãƒˆã«ãƒžãƒƒãƒã•ã›ã¦ã„ã‚‹ã¨ãã« +ServerAlias hostname [hostname] ...vCリクエストをåå‰ãƒ™ãƒ¼ã‚¹ã®ãƒãƒ¼ãƒãƒ£ãƒ«ãƒ›ã‚¹ãƒˆã«ãƒžãƒƒãƒã•ã›ã¦ã„ã‚‹ã¨ã㫠使用ã•ã‚Œã‚‹ãƒ›ã‚¹ãƒˆã®åˆ¥å -ServerLimit numbersM設定å¯èƒ½ãªã‚µãƒ¼ãƒãƒ—ロセス数ã®ä¸Šé™ -ServerName [scheme://]fully-qualified-domain-name[:port]svCサーãƒãŒè‡ªåˆ†è‡ªèº«ã‚’示ã™ã¨ãã«ä½¿ã†ãƒ›ã‚¹ãƒˆåã¨ãƒãƒ¼ãƒˆ -ServerPath URL-pathvCéžäº’æ›ã®ãƒ–ラウザãŒåå‰ãƒ™ãƒ¼ã‚¹ã®ãƒãƒ¼ãƒãƒ£ãƒ«ãƒ›ã‚¹ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸã¨ãã® +ServerLimit numbersM設定å¯èƒ½ãªã‚µãƒ¼ãƒãƒ—ロセス数ã®ä¸Šé™ +ServerName [scheme://]fully-qualified-domain-name[:port]svCサーãƒãŒè‡ªåˆ†è‡ªèº«ã‚’示ã™ã¨ãã«ä½¿ã†ãƒ›ã‚¹ãƒˆåã¨ãƒãƒ¼ãƒˆ +ServerPath URL-pathvCéžäº’æ›ã®ãƒ–ラウザãŒåå‰ãƒ™ãƒ¼ã‚¹ã®ãƒãƒ¼ãƒãƒ£ãƒ«ãƒ›ã‚¹ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸã¨ãã® ãŸã‚ã®äº’æ›ç”¨ URL パスå -ServerRoot directory-path /usr/local/apache sCインストールã•ã‚ŒãŸã‚µãƒ¼ãƒã®ãƒ™ãƒ¼ã‚¹ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒª -ServerSignature On|Off|EMail Off svdhCサーãƒãŒç”Ÿæˆã™ã‚‹ãƒ‰ã‚­ãƒ¥ãƒ¡ãƒ³ãƒˆã®ãƒ•ãƒƒã‚¿ã‚’設定 -ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCServer HTTP 応答ヘッダを設定ã™ã‚‹ -Session On|Off Off svdhEEnables a session for the current directory or location -SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client -SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session -SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session -SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers -SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session -SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session -SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session -SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session -SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID -SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID -SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers -SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database -SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database -SessionDBDPerUser On|Off Off svdhEEnable a per user session -SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database -SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database -SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the +ServerRoot directory-path /usr/local/apache sCインストールã•ã‚ŒãŸã‚µãƒ¼ãƒã®ãƒ™ãƒ¼ã‚¹ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒª +ServerSignature On|Off|EMail Off svdhCサーãƒãŒç”Ÿæˆã™ã‚‹ãƒ‰ã‚­ãƒ¥ãƒ¡ãƒ³ãƒˆã®ãƒ•ãƒƒã‚¿ã‚’設定 +ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCServer HTTP 応答ヘッダを設定ã™ã‚‹ +Session On|Off Off svdhEEnables a session for the current directory or location +SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client +SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session +SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session +SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers +SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session +SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session +SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session +SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session +SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID +SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID +SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers +SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database +SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database +SessionDBDPerUser On|Off Off svdhEEnable a per user session +SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database +SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database +SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the HTTP_SESSION environment variable -SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored -SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without +SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored +SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without the session being updated -SessionHeader headersvdhEImport session updates from a given HTTP response header -SessionInclude pathsvdhEDefine URL prefixes for which a session is valid -SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session -SetEnv env-variable valuesvdhB環境変数を設定ã™ã‚‹ -SetEnvIf attribute +SessionHeader headersvdhEImport session updates from a given HTTP response header +SessionInclude pathsvdhEDefine URL prefixes for which a session is valid +SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session +SetEnv env-variable valuesvdhB環境変数を設定ã™ã‚‹ +SetEnvIf attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBリクエストã®å±žæ€§ã«åŸºã¥ã„ã¦ç’°å¢ƒå¤‰æ•°ã‚’設定ã™ã‚‹ + [[!]env-variable[=value]] ...svdhBリクエストã®å±žæ€§ã«åŸºã¥ã„ã¦ç’°å¢ƒå¤‰æ•°ã‚’設定ã™ã‚‹ -svdhBSets environment variables based on an ap_expr expression -SetEnvIfNoCase attribute regex +svdhBSets environment variables based on an ap_expr expression +SetEnvIfNoCase attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBリクエストã®å±žæ€§ã«åŸºã¥ã„ã¦å¤§æ–‡å­—å°æ–‡å­—を区別ã›ãšã«ç’°å¢ƒå¤‰æ•°ã‚’設定ã™ã‚‹ -SetHandler handler-name|NonesvdhCマッãƒã™ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ãŒãƒãƒ³ãƒ‰ãƒ©ã§å‡¦ç†ã•ã‚Œã‚‹ã‚ˆã†ã«ã™ã‚‹ -SetInputFilter filter[;filter...]svdhCクライアントã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚„ POST ã®å…¥åŠ›ã‚’処ç†ã™ã‚‹ãƒ•ã‚£ãƒ«ã‚¿ã‚’設定ã™ã‚‹ -SetOutputFilter filter[;filter...]svdhCサーãƒã®å¿œç­”を処ç†ã™ã‚‹ãƒ•ã‚£ãƒ«ã‚¿ã‚’設定ã™ã‚‹ -SSIEndTag tag "-->" svBinclude è¦ç´ ã‚’終了ã•ã›ã‚‹æ–‡å­—列 -SSIErrorMsg message "[an error occurred +svdhBSSI ã®ã‚¨ãƒ©ãƒ¼ãŒã‚ã£ãŸã¨ãã«è¡¨ç¤ºã•ã‚Œã‚‹ã‚¨ãƒ©ãƒ¼ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ -SSIETag on|off off dhBControls whether ETags are generated by the server. -SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the + [[!]env-variable[=value]] ...svdhBリクエストã®å±žæ€§ã«åŸºã¥ã„ã¦å¤§æ–‡å­—å°æ–‡å­—を区別ã›ãšã«ç’°å¢ƒå¤‰æ•°ã‚’設定ã™ã‚‹ +SetHandler handler-name|NonesvdhCマッãƒã™ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ãŒãƒãƒ³ãƒ‰ãƒ©ã§å‡¦ç†ã•ã‚Œã‚‹ã‚ˆã†ã«ã™ã‚‹ +SetInputFilter filter[;filter...]svdhCクライアントã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚„ POST ã®å…¥åŠ›ã‚’処ç†ã™ã‚‹ãƒ•ã‚£ãƒ«ã‚¿ã‚’設定ã™ã‚‹ +SetOutputFilter filter[;filter...]svdhCサーãƒã®å¿œç­”を処ç†ã™ã‚‹ãƒ•ã‚£ãƒ«ã‚¿ã‚’設定ã™ã‚‹ +SSIEndTag tag "-->" svBinclude è¦ç´ ã‚’終了ã•ã›ã‚‹æ–‡å­—列 +SSIErrorMsg message "[an error occurred +svdhBSSI ã®ã‚¨ãƒ©ãƒ¼ãŒã‚ã£ãŸã¨ãã«è¡¨ç¤ºã•ã‚Œã‚‹ã‚¨ãƒ©ãƒ¼ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ +SSIETag on|off off dhBControls whether ETags are generated by the server. +SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the server. -SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. -SSIStartTag tag "<!--#" svBinclude è¦ç´ ã‚’開始ã™ã‚‹æ–‡å­—列 -SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhB日付ã‘ã‚’ç¾ã™æ–‡å­—列ã®æ›¸å¼ã‚’設定ã™ã‚‹ -SSIUndefinedEcho string "(none)" svdhB未定義ã®å¤‰æ•°ãŒ echo ã•ã‚ŒãŸã¨ãã«è¡¨ç¤ºã•ã‚Œã‚‹æ–‡å­—列 -SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. +SSIStartTag tag "<!--#" svBinclude è¦ç´ ã‚’開始ã™ã‚‹æ–‡å­—列 +SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhB日付ã‘ã‚’ç¾ã™æ–‡å­—列ã®æ›¸å¼ã‚’設定ã™ã‚‹ +SSIUndefinedEcho string "(none)" svdhB未定義ã®å¤‰æ•°ãŒ echo ã•ã‚ŒãŸã¨ãã«è¡¨ç¤ºã•ã‚Œã‚‹æ–‡å­—列 +SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Client Auth -SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Client Auth +SSLCACertificateURI urisvEServer CA certificate store for Client Authentication SSLCADNRequestFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for defining acceptable CA names SSLCADNRequestPath directory-pathsvEDirectory of PEM-encoded CA Certificates for defining acceptable CA names -SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking -SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for +SSLCADNRequestURI urisvEcertificate store of CA Certificates for defining +acceptable CA names +SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking +SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Client Auth -SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for +SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Client Auth +SSLCARevocationURI urisvEServer CA certificate revocation list store for Client Authentication SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file -SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL +SSLCertificateURI urisvEServer certificate and key store +SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL handshake -SSLClientHelloVars on|off off svEEnable collection of ClientHello variables -SSLCompression on|off off svEEnable compression on the SSL level -SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator -SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory -SSLEngine on|off off svESSL Engine Operation Switch -SSLFIPS on|off off sESSL FIPS mode Switch -SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order -SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation -SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain -SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification -SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation -SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests -SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates -SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries -SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses -SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation -SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries -SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API -SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLClientHelloVars on|off off svEEnable collection of ClientHello variables +SSLCompression on|off off svEEnable compression on the SSL level +SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator +SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory +SSLEngine on|off off svESSL Engine Operation Switch +SSLFIPS on|off off sESSL FIPS mode Switch +SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order +SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation +SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain +SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification +SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation +SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests +SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates +SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries +SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses +SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation +SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries +SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API +SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLPolicy namesvEApply a SSLPolicy by name -SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions -SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSLPolicy namesvEApply a SSLPolicy by name +SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions +SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Remote Server Auth +SSLProxyCACertificateURI urisvEProxy CA certificate store for Remote Server Auth SSLProxyCARevocationCheck chain|leaf|none none svEEnable CRL-based revocation checking for Remote Server Auth SSLProxyCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth SSLProxyCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificate's CN field +SSLProxyCARevocationURI urisvEProxy CA certificate revocation list store for Remote Server Auth +SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificate's CN field -SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired +SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired -SSLProxyCheckPeerName on|off on svEConfigure host name checking for remote server certificates +SSLProxyCheckPeerName on|off on svEConfigure host name checking for remote server certificates -SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svECipher Suite available for negotiation in SSL +SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateChainFile filenamesvEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate -SSLProxyMachineCertificateFile filenamesvEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directorysvEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateChainFile filenamesvEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate +SSLProxyMachineCertificateFile filenamesvEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysvEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificateURI urisvEProxy certificate and key stores SSLProxyProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL protocol flavors for proxy usage SSLProxyVerify level none svEType of remote server Certificate verification SSLProxyVerifyDepth number 1 svEMaximum depth of CA Certificates in Remote Server @@ -1232,15 +1241,15 @@ Certificate verification User unix-userid #-1 sBThe userid under which the server will answer requests UserDir directory-filename [directory-filename] ...svBユーザ専用ディレクトリã®ä½ç½® -VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run +VHostCGIMode On|Off|Secure On vDDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On vXDetermines whether the server runs with enhanced security +VHostGroup unix-groupidvDSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On vDDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridvXSets the User ID under which a virtual host runs. +VHostUser unix-useridvDSets the User ID under which a virtual host runs. VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root diff --git a/docs/manual/mod/quickreference.html.ko.euc-kr b/docs/manual/mod/quickreference.html.ko.euc-kr index 6930107cf60..babae52578f 100644 --- a/docs/manual/mod/quickreference.html.ko.euc-kr +++ b/docs/manual/mod/quickreference.html.ko.euc-kr @@ -119,7 +119,7 @@ type ´ëÀÀÇÑ´Ù AliasPreservePath OFF|ON OFF svdBMap the full path after the alias in a location. Allow from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts can access an area of the +[host|env=[!]env-variable] ...dhDControls which hosts can access an area of the server AllowCONNECT port[-port] [port[-port]] ... | None 443 563 svEPorts that are allowed to CONNECT through the @@ -371,20 +371,20 @@ switch before dumping core CryptoIV value none svdhEIV (Initialization Vector) to be used by the crypto filter CryptoKey value none svdhEKey to be used by the crypto filter CryptoSize integer 131072 svdhEMaximum size in bytes to buffer by the crypto filter -CTAuditStorage directorysEExisting directory where data for off-line audit will be stored -CTLogClient executablesELocation of certificate-transparency log client tool -CTLogConfigDB filenamesELog configuration database supporting dynamic updates -CTMaxSCTAge num-secondssEMaximum age of SCT obtained from a log, before it will be +CTAuditStorage directorysDExisting directory where data for off-line audit will be stored +CTLogClient executablesDLocation of certificate-transparency log client tool +CTLogConfigDB filenamesDLog configuration database supporting dynamic updates +CTMaxSCTAge num-secondssDMaximum age of SCT obtained from a log, before it will be refreshed -CTProxyAwareness oblivious|aware|requiresvELevel of CT awareness and enforcement for a proxy +CTProxyAwareness oblivious|aware|requiresvDLevel of CT awareness and enforcement for a proxy -CTSCTStorage directorysEExisting directory where SCTs are managed -CTServerHelloSCTLimit limitsELimit on number of SCTs that can be returned in +CTSCTStorage directorysDExisting directory where SCTs are managed +CTServerHelloSCTLimit limitsDLimit on number of SCTs that can be returned in ServerHello CTStaticLogConfig log-id|- public-key-file|- 1|0|- min-timestamp|- max-timestamp|- -log-URL|-sEStatic configuration of information about a log -CTStaticSCTs certificate-pem-file sct-directorysEStatic configuration of one or more SCTs for a server certificate +log-URL|-sDStatic configuration of information about a log +CTStaticSCTs certificate-pem-file sct-directorysDStatic configuration of one or more SCTs for a server certificate CustomLog file|pipe format|nickname @@ -433,7 +433,7 @@ which no other media type configuration could be found. DeflateMemLevel value 9 svEzlibÀÌ ¾ÐÃàÇÒ¶§ »ç¿ëÇÏ´Â ¸Þ¸ð¸®·® DeflateWindowSize value 15 svEZlib ¾ÐÃà window size Deny from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts are denied access to the +[host|env=[!]env-variable] ...dhDControls which hosts are denied access to the server <Directory directory-path> ... </Directory>svCEnclose a group of directives that apply only to the @@ -451,7 +451,7 @@ the contents of file-system directories matching a regular expression. DirectorySlash On|Off On svdhB¸¶Áö¸· ½½·¡½¬ ¸®´ÙÀÌ·º¼ÇÀ» Å°°í ²ö´Ù DocumentRoot directory-path "/usr/local/apache/ +svCDirectory that forms the main document tree visible from the web -DTracePrivileges On|Off Off sXDetermines whether the privileges required by dtrace are enabled. +DTracePrivileges On|Off Off sDDetermines whether the privileges required by dtrace are enabled. DumpIOInput On|Off Off sEDump all input data to the error log DumpIOOutput On|Off Off sEDump all output data to the error log <Else> ... </Else>svdhCContains directives that apply only if the condition of a @@ -758,432 +758,441 @@ simultaneously MDDriveMode always|auto|manual auto sXformer name of MDRenewMode. MDExternalAccountBinding key-id hmac-64 | none | file none sXSet the external account binding keyid and hmac values to use at CA MDHttpProxy urlsXDefine a proxy for outgoing connections. -MDInitialDelay duration 0s sXHow long to delay the first certificate check. -MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts -MDMember hostnamesXAdditional hostname for the managed domain. -MDMembers auto|manual auto sXControl if the alias domain names are automatically added. -MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains -MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. -MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. -MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. -<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. -MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. -MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. -MDProfile namesXUse a specific ACME profile from the CA -MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. -MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. -MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). -MDRenewWindow duration 33% sXControl when a certificate will be renewed. -MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. -MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. -MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered -MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. -MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. -MDStapling on|off off sXEnable stapling for all or a particular MDomain. -MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. -MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. -MDStoreDir path md sXPath on the local file system to store the Managed Domains data. -MDStoreLocks on|off|duration off sXConfigure locking of store for updates -MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. -MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections -MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. +MDHttpProxyCACertificateFile path-to-pem-file none sXSets the root (CA) certificates to use for TLS connections to the http-proxy. +MDInitialDelay duration 0s sXHow long to delay the first certificate check. +MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts +MDMember hostnamesXAdditional hostname for the managed domain. +MDMembers auto|manual auto sXControl if the alias domain names are automatically added. +MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains +MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. +MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. +MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. +<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. +MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. +MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. +MDProfile namesXUse a specific ACME profile from the CA +MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. +MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. +MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). +MDRenewWindow duration 33% sXControl when a certificate will be renewed. +MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. +MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. +MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered +MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. +MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. +MDStapling on|off off sXEnable stapling for all or a particular MDomain. +MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. +MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. +MDStoreDir path md sXPath on the local file system to store the Managed Domains data. +MDStoreLocks on|off|duration off sXConfigure locking of store for updates +MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. +MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections +MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. -MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers -MetaDir directory .web svdhECERN ¸ÞŸÁ¤º¸¸¦ ãÀ» µð·ºÅ丮 À̸§ -MetaFiles on|off off svdhECERN ¸ÞŸÆÄÀÏÀ» ó¸®ÇÑ´Ù -MetaSuffix suffix .meta svdhECERN ¸ÞŸÁ¤º¸¸¦ ÀúÀåÇÏ´Â ÆÄÀÏÀÇ Á¢¹Ì»ç -MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection -MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents +MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers +MetaDir directory .web svdhECERN ¸ÞŸÁ¤º¸¸¦ ãÀ» µð·ºÅ丮 À̸§ +MetaFiles on|off off svdhECERN ¸ÞŸÆÄÀÏÀ» ó¸®ÇÑ´Ù +MetaSuffix suffix .meta svdhECERN ¸ÞŸÁ¤º¸¸¦ ÀúÀåÇÏ´Â ÆÄÀÏÀÇ Á¢¹Ì»ç +MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection +MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents using the specified magic file -MimeOptions option [option] ...svdhBConfigures mod_mime behavior -MinSpareServers number 5 sMMinimum number of idle child server processes -MinSpareThreads numbersMMinimum number of idle threads available to handle request +MimeOptions option [option] ...svdhBConfigures mod_mime behavior +MinSpareServers number 5 sMMinimum number of idle child server processes +MinSpareThreads numbersMMinimum number of idle threads available to handle request spikes -MMapFile file-path [file-path] ...sX½ÃÀ۽à ¿©·¯ ÆÄÀÏÀ» ¸Þ¸ð¸®¿¡ ´ëÀÀÇÑ´Ù -ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate -ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info +MMapFile file-path [file-path] ...sX½ÃÀ۽à ¿©·¯ ÆÄÀÏÀ» ¸Þ¸ð¸®¿¡ ´ëÀÀÇÑ´Ù +ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate +ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info components as part of the filename -MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers -[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for +MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers +[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for a matching file with MultiViews -Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all +Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all or specified mutexes -NameVirtualHost addr[:port]sCDEPRECATED: Designates an IP address for name-virtual +NameVirtualHost addr[:port]sCDEPRECATED: Designates an IP address for name-virtual hosting -NoProxy host [host] ...svEHosts, domains, or networks that will be connected to +NoProxy host [host] ...svEHosts, domains, or networks that will be connected to directly -NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates -NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request -Options - [+|-]option [[+|-]option] ... FollowSymlinks svdhCConfigures what features are available in a particular +NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates +NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request +Options + [+|-]option [[+|-]option] ... FollowSymlinks svdhCConfigures what features are available in a particular directory - Order ordering Deny,Allow dhEControls the default access state and the order in which + Order ordering Deny,Allow dhDControls the default access state and the order in which Allow and Deny are evaluated. -OutputSed sed-commanddhXSed command for filtering response content -PassEnv env-variable [env-variable] -...svdhB½©¿¡¼­ ȯ°æº¯¼ö¸¦ °¡Á®¿Â´Ù -PidFile filename httpd.pid sMFile where the server records the process ID +OutputSed sed-commanddhXSed command for filtering response content +PassEnv env-variable [env-variable] +...svdhB½©¿¡¼­ ȯ°æº¯¼ö¸¦ °¡Á®¿Â´Ù +PidFile filename httpd.pid sMFile where the server records the process ID of the daemon -PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. -PolicyConditionalURL urlsvdEURL describing the conditional request policy. -PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. -PolicyFilter on|offsvdEEnable or disable policies for the given URL space. -PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. -PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. -PolicyLength ignore|log|enforcesvdEEnable the content length policy. -PolicyLengthURL urlsvdEURL describing the content length policy. -PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. -PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. -PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. -PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. -PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. -PolicyTypeURL urlsvdEURL describing the content type policy. -PolicyValidation ignore|log|enforcesvdEEnable the validation policy. -PolicyValidationURL urlsvdEURL describing the content type policy. -PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. -PolicyVaryURL urlsvdEURL describing the content type policy. -PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. -PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. -PollersPerChild number 0 sMNumber of poll threads per child process -PrivilegesMode FAST|SECURE|SELECTIVE FAST svdXTrade off processing speed and efficiency vs security against +PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. +PolicyConditionalURL urlsvdEURL describing the conditional request policy. +PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. +PolicyFilter on|offsvdEEnable or disable policies for the given URL space. +PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. +PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. +PolicyLength ignore|log|enforcesvdEEnable the content length policy. +PolicyLengthURL urlsvdEURL describing the content length policy. +PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. +PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. +PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. +PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. +PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. +PolicyTypeURL urlsvdEURL describing the content type policy. +PolicyValidation ignore|log|enforcesvdEEnable the validation policy. +PolicyValidationURL urlsvdEURL describing the content type policy. +PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. +PolicyVaryURL urlsvdEURL describing the content type policy. +PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. +PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. +PollersPerChild number 0 sMNumber of poll threads per child process +PrivilegesMode FAST|SECURE|SELECTIVE FAST svdDTrade off processing speed and efficiency vs security against malicious privileges-aware code. -Protocol protocolsvCProtocol for a listening socket -ProtocolEcho On|OffsvXecho ¼­¹ö¸¦ Å°°í ²ö´Ù -Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host -ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation -<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources -Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server -ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers -ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the +Protocol protocolsvCProtocol for a listening socket +ProtocolEcho On|OffsvXecho ¼­¹ö¸¦ Å°°í ²ö´Ù +Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host +ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation +<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources +Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server +ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers +ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the MPM for asynchronous processing -ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections -ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a +ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections +ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a response -ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its +ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its announcements -ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy -ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to -ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement -ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend +ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy +ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to +ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement +ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend beacons -ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement -ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements -ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend +ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement +ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements +ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend is taken out of rotation -ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts -ProxyDomain DomainsvEDefault domain name for proxied requests -ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content -ProxyExpressDBMFile pathnamesvEPathname to DBM file. -ProxyExpressDBMType type default svEDBM type of file. -ProxyExpressEnable on|off off svEEnable the module functionality. -ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application -ProxyFCGISetEnvIf conditional-expression +ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts +ProxyDomain DomainsvEDefault domain name for proxied requests +ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content +ProxyExpressDBMFile pathnamesvEPathname to DBM file. +ProxyExpressDBMType type default svEDBM type of file. +ProxyExpressEnable on|off off svEEnable the module functionality. +ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application +ProxyFCGISetEnvIf conditional-expression [!]environment-variable-name - [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up -ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings -ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server -ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing -ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response -ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters -ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers -ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and + [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up +ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings +ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server +ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing +ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response +ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters +ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers +ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and stylesheets. -ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. -ProxyHTMLDocType HTML|XHTML [Legacy]
OR +ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. +ProxyHTMLDocType HTML|XHTML [Legacy]
OR
ProxyHTMLDocType fpi [SGML|XML]
OR
ProxyHTMLDocType html5
OR -
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. -ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. -ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. -ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, +
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. +ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. +ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. +ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, and scripting events. -ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. -ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of +ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. +ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of ProxyHTMLURLMap rules. -ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. -ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML +ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. +ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML <head> sections. -ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. -ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links -ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer -<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched +ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. +ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links +ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer +<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched proxied resources -ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded +ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded through -ProxyPass [path] !|url [key=value - [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space -ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server -ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations -ProxyPassMatch [regex] !|url [key=value - [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions -ProxyPassReverse [path] url -[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse +ProxyPass [path] !|url [key=value + [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space +ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server +ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations +ProxyPassMatch [regex] !|url [key=value + [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions +ProxyPassReverse [path] url +[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse proxied server -ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- +ProxyPassReverseCookieDomain internal-domain +public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- proxied server -ProxyPassReverseCookiePath internal-path -public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- +ProxyPassReverseCookiePath internal-path +public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- proxied server -ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy +ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy request -ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP +ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP connections -ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests -ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular +ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests +ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular expressions -ProxyRequests On|Off Off svEEnables forward (standard) proxy requests -ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the +ProxyRequests On|Off Off svEEnables forward (standard) proxy requests +ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the backend -ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response +ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response header -ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters -ProxySourceAddress addresssvESet local IP address for outgoing proxy connections -ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status -ProxyTimeout time-interval[s]svENetwork timeout for proxied requests -ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response +ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters +ProxySourceAddress addresssvESet local IP address for outgoing proxy connections +ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status +ProxyTimeout time-interval[s]svENetwork timeout for proxied requests +ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response header for proxied requests -ProxyWebsocketAsync ON|OFFsvEInstructs this module to try to create an asynchronous tunnel -ProxyWebsocketAsyncDelay num[ms] 0 svESets the amount of time the tunnel waits synchronously for data -ProxyWebsocketFallbackToProxyHttp On|Off On svEInstructs this module to let mod_proxy_http handle the request -ProxyWebsocketIdleTimeout num[ms] 0 svESets the maximum amount of time to wait for data on the websockets tunnel -QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is +ProxyWebsocketAsync ON|OFFsvDInstructs this module to try to create an asynchronous tunnel +ProxyWebsocketAsyncDelay num[ms] 0 svDSets the amount of time the tunnel waits synchronously for data +ProxyWebsocketFallbackToProxyHttp On|Off On svDInstructs this module to let mod_proxy_http handle the request +ProxyWebsocketIdleTimeout num[ms] 0 svDSets the maximum amount of time to wait for data on the websockets tunnel +QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is fully qualified -ReadBufferSize bytes 8192 svdCSize of the buffers used to read data -ReadmeName filenamesvdhBÆÄÀϸñ·Ï ¸¶Áö¸·¿¡ »ðÀÔÇÒ ÆÄÀÏÀÇ À̸§ -ReceiveBufferSize bytes 0 sMTCP receive buffer size -Redirect [status] URL-path -URLsvdhBŬ¶óÀ̾ðÆ®°¡ ´Ù¸¥ URL¿¡ Á¢¼ÓÇϵµ·Ï ¿äûÇÏ´Â ¿ÜºÎ +ReadBufferSize bytes 8192 svdCSize of the buffers used to read data +ReadmeName filenamesvdhBÆÄÀϸñ·Ï ¸¶Áö¸·¿¡ »ðÀÔÇÒ ÆÄÀÏÀÇ À̸§ +ReceiveBufferSize bytes 0 sMTCP receive buffer size +Redirect [status] URL-path +URLsvdhBŬ¶óÀ̾ðÆ®°¡ ´Ù¸¥ URL¿¡ Á¢¼ÓÇϵµ·Ï ¿äûÇÏ´Â ¿ÜºÎ ¸®´ÙÀÌ·º¼ÇÀ» º¸³½´Ù -RedirectMatch [status] regex -URLsvdhBÇöÀç URLÀÌ Á¤±ÔÇ¥Çö½Ä¿¡ ÇØ´çÇÏ¸é ¿ÜºÎ ¸®´ÙÀÌ·º¼ÇÀ» +RedirectMatch [status] regex +URLsvdhBÇöÀç URLÀÌ Á¤±ÔÇ¥Çö½Ä¿¡ ÇØ´çÇÏ¸é ¿ÜºÎ ¸®´ÙÀÌ·º¼ÇÀ» º¸³½´Ù -RedirectPermanent URL-path URLsvdhBŬ¶óÀ̾ðÆ®°¡ ´Ù¸¥ URL¿¡ Á¢¼ÓÇϵµ·Ï ¿äûÇÏ´Â ¿ÜºÎ +RedirectPermanent URL-path URLsvdhBŬ¶óÀ̾ðÆ®°¡ ´Ù¸¥ URL¿¡ Á¢¼ÓÇϵµ·Ï ¿äûÇÏ´Â ¿ÜºÎ ¿µ±¸ ¸®´ÙÀÌ·º¼ÇÀ» º¸³½´Ù -RedirectRelative On|Off Off svdBAllows relative redirect targets. -RedirectTemp URL-path URLsvdhBŬ¶óÀ̾ðÆ®°¡ ´Ù¸¥ URL¿¡ Á¢¼ÓÇϵµ·Ï ¿äûÇÏ´Â ¿ÜºÎ +RedirectRelative On|Off Off svdBAllows relative redirect targets. +RedirectTemp URL-path URLsvdhBŬ¶óÀ̾ðÆ®°¡ ´Ù¸¥ URL¿¡ Á¢¼ÓÇϵµ·Ï ¿äûÇÏ´Â ¿ÜºÎ Àӽà ¸®´ÙÀÌ·º¼ÇÀ» º¸³½´Ù -RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) -RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) -ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers -RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes -RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods -RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses -RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses -RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling -RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks -RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoveCharset extension [extension] -...vdhBRemoves any character set associations for a set of file +RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) +RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) +ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers +RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes +RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods +RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses +RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses +RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling +RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks +RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoveCharset extension [extension] +...vdhBRemoves any character set associations for a set of file extensions -RemoveEncoding extension [extension] -...vdhBRemoves any content encoding associations for a set of file +RemoveEncoding extension [extension] +...vdhBRemoves any content encoding associations for a set of file extensions -RemoveHandler extension [extension] -...vdhBRemoves any handler associations for a set of file +RemoveHandler extension [extension] +...vdhBRemoves any handler associations for a set of file extensions -RemoveInputFilter extension [extension] -...vdhBRemoves any input filter associations for a set of file +RemoveInputFilter extension [extension] +...vdhBRemoves any input filter associations for a set of file extensions -RemoveLanguage extension [extension] -...vdhBRemoves any language associations for a set of file +RemoveLanguage extension [extension] +...vdhBRemoves any language associations for a set of file extensions -RemoveOutputFilter extension [extension] -...vdhBRemoves any output filter associations for a set of file +RemoveOutputFilter extension [extension] +...vdhBRemoves any output filter associations for a set of file extensions -RemoveType extension [extension] -...vdhBRemoves any content type associations for a set of file +RemoveType extension [extension] +...vdhBRemoves any content type associations for a set of file extensions -RequestHeader set|append|add|unset header -[value] [early|env=[!]variable]svdhEHTTP ¿äû Çì´õ¸¦ ±¸¼ºÇÑ´Ù -RequestReadTimeout +RequestHeader set|append|add|unset header +[value] [early|env=[!]variable]svdhEHTTP ¿äû Çì´õ¸¦ ±¸¼ºÇÑ´Ù +RequestReadTimeout [handshake=timeout[-maxtimeout][,MinRate=rate] [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate] - handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving + handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving the request headers and/or body from client. -Require [not] entity-name - [entity-name] ...dhBTests whether an authenticated user is authorized by +Require [not] entity-name + [entity-name] ...dhBTests whether an authenticated user is authorized by an authorization provider. -<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none +<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none must fail and at least one must succeed for the enclosing directive to succeed. -<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one +<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one must succeed for the enclosing directive to succeed. -<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none +<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none must succeed for the enclosing directive to not fail. -RewriteBase URL-pathdhESets the base URL for per-directory rewrites - RewriteCond - TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place +RewriteBase URL-pathdhESets the base URL for per-directory rewrites + RewriteCond + TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place -RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine -RewriteMap MapName MapType:MapSource +RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine +RewriteMap MapName MapType:MapSource [MapTypeOptions] -svEDefines a mapping function for key-lookup -RewriteOptions OptionssvdhESets some special options for the rewrite engine -RewriteRule - [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine -RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched +svEDefines a mapping function for key-lookup +RewriteOptions OptionssvdhESets some special options for the rewrite engine +RewriteRule + [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine +RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched by Apache httpd children -RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched +RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched by Apache httpd children -RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by +RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by processes launched by Apache httpd children -Satisfy Any|All All dhEInteraction between host-level access control and +Satisfy Any|All All dhDInteraction between host-level access control and user authentication -ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for +ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for the child processes -Script method cgi-scriptsvdBƯÁ¤ ¿äû¸Þ¼­µå¿¡ ´ëÇØ CGI ½ºÅ©¸³Æ®¸¦ +Script method cgi-scriptsvdBƯÁ¤ ¿äû¸Þ¼­µå¿¡ ´ëÇØ CGI ½ºÅ©¸³Æ®¸¦ »ç¿ëÇÑ´Ù. -ScriptAlias URL-path -file-path|directory-pathsvdBURLÀ» ƯÁ¤ ÆÄÀϽýºÅÛ Àå¼Ò·Î ´ëÀÀÇÏ°í ´ë»óÀÌ CGI +ScriptAlias URL-path +file-path|directory-pathsvdBURLÀ» ƯÁ¤ ÆÄÀϽýºÅÛ Àå¼Ò·Î ´ëÀÀÇÏ°í ´ë»óÀÌ CGI ½ºÅ©¸³Æ®¶ó°í ¾Ë¸°´Ù -ScriptAliasMatch regex -file-path|directory-pathsvBÁ¤±ÔÇ¥Çö½ÄÀ» »ç¿ëÇÏ¿© URLÀ» ƯÁ¤ ÆÄÀϽýºÅÛ Àå¼Ò·Î +ScriptAliasMatch regex +file-path|directory-pathsvBÁ¤±ÔÇ¥Çö½ÄÀ» »ç¿ëÇÏ¿© URLÀ» ƯÁ¤ ÆÄÀϽýºÅÛ Àå¼Ò·Î ´ëÀÀÇÏ°í ´ë»óÀÌ CGI ½ºÅ©¸³Æ®¶ó°í ¾Ë¸°´Ù -ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI +ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI scripts -ScriptLog file-pathsvBCGI ½ºÅ©¸³Æ® ¿À·ù·Î±×ÆÄÀÏÀÇ À§Ä¡ -ScriptLogBuffer bytes 1024 svB½ºÅ©¸³Æ® ·Î±×¿¡ ±â·ÏÇÒ PUT ȤÀº POST ¿äûÀÇ ÃÖ´ë·® -ScriptLogLength bytes 10385760 svBCGI ½ºÅ©¸³Æ® ·Î±×ÆÄÀÏÀÇ Å©±â Á¦ÇÑ -ScriptSock file-path logs/cgisock sBcgi µ¥¸ó°ú Åë½ÅÀ» À§ÇØ »ç¿ëÇÒ ¼ÒÄÏÀÇ À̸§ -SecureListen [IP-address:]portnumber -Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port -SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters +ScriptLog file-pathsvBCGI ½ºÅ©¸³Æ® ¿À·ù·Î±×ÆÄÀÏÀÇ À§Ä¡ +ScriptLogBuffer bytes 1024 svB½ºÅ©¸³Æ® ·Î±×¿¡ ±â·ÏÇÒ PUT ȤÀº POST ¿äûÀÇ ÃÖ´ë·® +ScriptLogLength bytes 10385760 svBCGI ½ºÅ©¸³Æ® ·Î±×ÆÄÀÏÀÇ Å©±â Á¦ÇÑ +ScriptSock file-path logs/cgisock sBcgi µ¥¸ó°ú Åë½ÅÀ» À§ÇØ »ç¿ëÇÒ ¼ÒÄÏÀÇ À̸§ +SecureListen [IP-address:]portnumber +Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port +SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters of a request or the last 63, assuming the request itself is greater than 63 chars. -SendBufferSize bytes 0 sMTCP buffer size -ServerAdmin email-address|URLsvCEmail address that the server includes in error +SendBufferSize bytes 0 sMTCP buffer size +ServerAdmin email-address|URLsvCEmail address that the server includes in error messages sent to the client -ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests +ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests to name-virtual hosts -ServerLimit numbersMUpper limit on configurable number of processes -ServerName [scheme://]domain-name|ip-address[:port]svCHostname and port that the server uses to identify +ServerLimit numbersMUpper limit on configurable number of processes +ServerName [scheme://]domain-name|ip-address[:port]svCHostname and port that the server uses to identify itself -ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that +ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that is accessed by an incompatible browser -ServerRoot directory-path /usr/local/apache sCBase directory for the server installation -ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents -ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response +ServerRoot directory-path /usr/local/apache sCBase directory for the server installation +ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents +ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response header -Session On|Off Off svdhEEnables a session for the current directory or location -SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client -SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session -SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session -SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers -SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session -SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session -SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session -SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session -SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID -SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID -SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers -SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database -SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database -SessionDBDPerUser On|Off Off svdhEEnable a per user session -SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database -SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database -SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the +Session On|Off Off svdhEEnables a session for the current directory or location +SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client +SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session +SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session +SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers +SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session +SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session +SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session +SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session +SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID +SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID +SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers +SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database +SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database +SessionDBDPerUser On|Off Off svdhEEnable a per user session +SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database +SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database +SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the HTTP_SESSION environment variable -SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored -SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without +SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored +SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without the session being updated -SessionHeader headersvdhEImport session updates from a given HTTP response header -SessionInclude pathsvdhEDefine URL prefixes for which a session is valid -SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session -SetEnv env-variable valuesvdhBȯ°æº¯¼ö¸¦ ¼³Á¤ÇÑ´Ù -SetEnvIf attribute +SessionHeader headersvdhEImport session updates from a given HTTP response header +SessionInclude pathsvdhEDefine URL prefixes for which a session is valid +SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session +SetEnv env-variable valuesvdhBȯ°æº¯¼ö¸¦ ¼³Á¤ÇÑ´Ù +SetEnvIf attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhB¿äûÀÇ ¼ºÁú¿¡ µû¶ó ȯ°æº¯¼ö¸¦ ¼³Á¤ÇÑ´Ù -svdhBSets environment variables based on an ap_expr expression -SetEnvIfNoCase attribute regex + [[!]env-variable[=value]] ...svdhB¿äûÀÇ ¼ºÁú¿¡ µû¶ó ȯ°æº¯¼ö¸¦ ¼³Á¤ÇÑ´Ù +svdhBSets environment variables based on an ap_expr expression +SetEnvIfNoCase attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhB´ë¼Ò¹®ÀÚ¸¦ ±¸º°ÇÏÁö¾Ê°í ¿äûÀÇ ¼ºÁú¿¡ µû¶ó ȯ°æº¯¼ö¸¦ + [[!]env-variable[=value]] ...svdhB´ë¼Ò¹®ÀÚ¸¦ ±¸º°ÇÏÁö¾Ê°í ¿äûÀÇ ¼ºÁú¿¡ µû¶ó ȯ°æº¯¼ö¸¦ ¼³Á¤ÇÑ´Ù -SetHandler handler-name|none|expressionsvdhCForces all matching files to be processed by a +SetHandler handler-name|none|expressionsvdhCForces all matching files to be processed by a handler -SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST +SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST input -SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the +SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the server -SSIEndTag tag "-->" svBString that ends an include element -SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI +SSIEndTag tag "-->" svBString that ends an include element +SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI error -SSIETag on|off off dhBControls whether ETags are generated by the server. -SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the +SSIETag on|off off dhBControls whether ETags are generated by the server. +SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the server. -SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. -SSIStartTag tag "<!--#" svBString that starts an include element -SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are +SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. +SSIStartTag tag "<!--#" svBString that starts an include element +SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are displayed -SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed -SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed +SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Client Auth -SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Client Auth +SSLCACertificateURI urisvEServer CA certificate store for Client Authentication SSLCADNRequestFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for defining acceptable CA names SSLCADNRequestPath directory-pathsvEDirectory of PEM-encoded CA Certificates for defining acceptable CA names -SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking -SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for +SSLCADNRequestURI urisvEcertificate store of CA Certificates for defining +acceptable CA names +SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking +SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Client Auth -SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for +SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Client Auth +SSLCARevocationURI urisvEServer CA certificate revocation list store for Client Authentication SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file -SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL +SSLCertificateURI urisvEServer certificate and key store +SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL handshake -SSLClientHelloVars on|off off svEEnable collection of ClientHello variables -SSLCompression on|off off svEEnable compression on the SSL level -SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator -SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory -SSLEngine on|off off svESSL Engine Operation Switch -SSLFIPS on|off off sESSL FIPS mode Switch -SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order -SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation -SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain -SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification -SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation -SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests -SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates -SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries -SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses -SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation -SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries -SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API -SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLClientHelloVars on|off off svEEnable collection of ClientHello variables +SSLCompression on|off off svEEnable compression on the SSL level +SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator +SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory +SSLEngine on|off off svESSL Engine Operation Switch +SSLFIPS on|off off sESSL FIPS mode Switch +SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order +SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation +SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain +SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification +SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation +SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests +SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates +SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries +SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses +SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation +SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries +SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API +SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLPolicy namesvEApply a SSLPolicy by name -SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions -SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSLPolicy namesvEApply a SSLPolicy by name +SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions +SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Remote Server Auth +SSLProxyCACertificateURI urisvEProxy CA certificate store for Remote Server Auth SSLProxyCARevocationCheck chain|leaf|none none svEEnable CRL-based revocation checking for Remote Server Auth SSLProxyCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth SSLProxyCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificate's CN field +SSLProxyCARevocationURI urisvEProxy CA certificate revocation list store for Remote Server Auth +SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificate's CN field -SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired +SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired -SSLProxyCheckPeerName on|off on svEConfigure host name checking for remote server certificates +SSLProxyCheckPeerName on|off on svEConfigure host name checking for remote server certificates -SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svECipher Suite available for negotiation in SSL +SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateChainFile filenamesvEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate -SSLProxyMachineCertificateFile filenamesvEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directorysvEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateChainFile filenamesvEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate +SSLProxyMachineCertificateFile filenamesvEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysvEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificateURI urisvEProxy certificate and key stores SSLProxyProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL protocol flavors for proxy usage SSLProxyVerify level none svEType of remote server Certificate verification SSLProxyVerifyDepth number 1 svEMaximum depth of CA Certificates in Remote Server @@ -1256,15 +1265,15 @@ port User unix-userid #-1 sBThe userid under which the server will answer requests UserDir directory-filename public_html svB»ç¿ëÀÚº° µð·ºÅ丮 À§Ä¡ -VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run +VHostCGIMode On|Off|Secure On vDDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On vXDetermines whether the server runs with enhanced security +VHostGroup unix-groupidvDSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vDAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On vDDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridvXSets the User ID under which a virtual host runs. +VHostUser unix-useridvDSets the User ID under which a virtual host runs. VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root diff --git a/docs/manual/mod/quickreference.html.tr.utf8 b/docs/manual/mod/quickreference.html.tr.utf8 index 3386a8d3f04..f3bbfb60987 100644 --- a/docs/manual/mod/quickreference.html.tr.utf8 +++ b/docs/manual/mod/quickreference.html.tr.utf8 @@ -127,7 +127,7 @@ type eÅŸler. AliasPreservePath OFF|ON OFF skdTMap the full path after the alias in a location. Allow from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts can access an area of the +[host|env=[!]env-variable] ...dhKControls which hosts can access an area of the server AllowCONNECT port[-port] [port[-port]] ... | None 443 563 skEPorts that are allowed to CONNECT through the @@ -394,20 +394,20 @@ module CryptoIV value none skdhEIV (Initialization Vector) to be used by the crypto filter CryptoKey value none skdhEKey to be used by the crypto filter CryptoSize integer 131072 skdhEMaximum size in bytes to buffer by the crypto filter -CTAuditStorage directorysEExisting directory where data for off-line audit will be stored -CTLogClient executablesELocation of certificate-transparency log client tool -CTLogConfigDB filenamesELog configuration database supporting dynamic updates -CTMaxSCTAge num-secondssEMaximum age of SCT obtained from a log, before it will be +CTAuditStorage directorysKExisting directory where data for off-line audit will be stored +CTLogClient executablesKLocation of certificate-transparency log client tool +CTLogConfigDB filenamesKLog configuration database supporting dynamic updates +CTMaxSCTAge num-secondssKMaximum age of SCT obtained from a log, before it will be refreshed -CTProxyAwareness oblivious|aware|requireskELevel of CT awareness and enforcement for a proxy +CTProxyAwareness oblivious|aware|requireskKLevel of CT awareness and enforcement for a proxy -CTSCTStorage directorysEExisting directory where SCTs are managed -CTServerHelloSCTLimit limitsELimit on number of SCTs that can be returned in +CTSCTStorage directorysKExisting directory where SCTs are managed +CTServerHelloSCTLimit limitsKLimit on number of SCTs that can be returned in ServerHello CTStaticLogConfig log-id|- public-key-file|- 1|0|- min-timestamp|- max-timestamp|- -log-URL|-sEStatic configuration of information about a log -CTStaticSCTs certificate-pem-file sct-directorysEStatic configuration of one or more SCTs for a server certificate +log-URL|-sKStatic configuration of information about a log +CTStaticSCTs certificate-pem-file sct-directorysKStatic configuration of one or more SCTs for a server certificate CustomLog dosya|borulu-süreç biçem|takma-ad @@ -458,7 +458,7 @@ türünü belirlerdi. DeflateMemLevel value 9 skEHow much memory should be used by zlib for compression DeflateWindowSize value 15 skEZlib compression window size Deny from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts are denied access to the +[host|env=[!]env-variable] ...dhKControls which hosts are denied access to the server <Directory dizin-yolu> ... </Directory>skÇSadece ismi belirtilen dosya sistemi dizininde ve bunun @@ -476,7 +476,7 @@ server ... </DirectoryMatch>skÇBir düzenli ifade ile eÅŸleÅŸen dosya sistemi dizinlerinin içeriklerine uygulanacak bir yönerge grubunu sarmalar. DirectorySlash On|Off On skdhTBölü çizgisi ile biten yönlendirmeleri açar/kapar. DocumentRoot dizin-yolu /usr/local/apache/h +skÇÄ°stemciye görünür olan ana belge aÄŸacının kök dizinini belirler. -DTracePrivileges On|Off Off sDDetermines whether the privileges required by dtrace are enabled. +DTracePrivileges On|Off Off sKDetermines whether the privileges required by dtrace are enabled. DumpIOInput On|Off Off sEDump all input data to the error log DumpIOOutput On|Off Off sEDump all output data to the error log <Else> ... </Else>skdhÇÖnceki bir <If> veya <ElseIf> bölümünün koÅŸulu, çalışma anında bir istek tarafından yerine getirilmediÄŸi takdirde uygulanacak yönergeleri içerir @@ -607,10 +607,10 @@ yönergeleri sarmalar. presence or absence of a specific section directive <IfVersion [[!]operator] version> ... </IfVersion>skdhEcontains version dependent configuration -ImapBase map|referer|URL http://servername/ skdhTDefault base for imagemap files -ImapDefault error|nocontent|map|referer|URL nocontent skdhTDefault action when an imagemap is called with coordinates +ImapBase map|referer|URL http://servername/ skdhKDefault base for imagemap files +ImapDefault error|nocontent|map|referer|URL nocontent skdhKDefault action when an imagemap is called with coordinates that are not explicitly mapped -ImapMenu none|formatted|semiformatted|unformatted formatted skdhTAction if no coordinates are given when calling +ImapMenu none|formatted|semiformatted|unformatted formatted skdhKAction if no coordinates are given when calling an imagemap Include dosya-yolu|dizin-yolu|jokerskdÇSunucu yapılandırma dosyalarının baÅŸka dosyaları içermesini saÄŸlar. @@ -791,438 +791,447 @@ processing MDDriveMode always|auto|manual auto sDformer name of MDRenewMode. MDExternalAccountBinding key-id hmac-64 | none | file none sDSet the external account binding keyid and hmac values to use at CA MDHttpProxy urlsDDefine a proxy for outgoing connections. -MDInitialDelay duration 0s sDHow long to delay the first certificate check. -MDMatchNames all|servernames all sDDetermines how DNS names are matched to vhosts -MDMember hostnamesDAdditional hostname for the managed domain. -MDMembers auto|manual auto sDControl if the alias domain names are automatically added. -MDMessageCmd path-to-cmd optional-argssDHandle events for Manage Domains -MDMustStaple on|off off sDControl if new certificates carry the OCSP Must Staple flag. -MDNotifyCmd path [ args ]sDRun a program when a Managed Domain is ready. -MDomain dns-name [ other-dns-name... ] [auto|manual]sDDefine list of domain names that belong to one group. -<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sDContainer for directives applied to the same managed domains. -MDPortMap map1 [ map2 ] http:80 https:443 sDMap external to internal ports for domain ownership verification. -MDPrivateKeys type [ params... ] RSA 2048 sDSet type and size of the private keys generated. -MDProfile namesDUse a specific ACME profile from the CA -MDProfileMandatory on|off off sDControl if an MDProfile is mandatory. -MDRenewMode always|auto|manual auto sDControls if certificates shall be renewed. -MDRenewViaARI on|off on sDusage of the ACME ARI extension (rfc9773). -MDRenewWindow duration 33% sDControl when a certificate will be renewed. -MDRequireHttps off|temporary|permanent off sDRedirects http: traffic to https: for Managed Domains. -MDRetryDelay duration 30s sDTime length for first retry, doubled on every consecutive error. -MDRetryFailover number 13 sDThe number of errors before a failover to another CA is triggered -MDServerStatus on|off off sDControl if Managed Domain information is added to server-status. -MDStapleOthers on|off on sDEnable stapling for certificates not managed by mod_md. -MDStapling on|off off sDEnable stapling for all or a particular MDomain. -MDStaplingKeepResponse duration 7d sDControls when old responses should be removed. -MDStaplingRenewWindow duration 33% sDControl when the stapling responses will be renewed. -MDStoreDir path md sDPath on the local file system to store the Managed Domains data. -MDStoreLocks on|off|duration off sDConfigure locking of store for updates -MDWarnWindow duration 10% sDDefine the time window when you want to be warned about an expiring certificate. -MemcacheConnTTL num[units] 15s skEKeepalive time for idle connections -MergeSlashes ON|OFF ON skÇControls whether the server merges consecutive slashes in URLs. +MDHttpProxyCACertificateFile path-to-pem-file none sDSets the root (CA) certificates to use for TLS connections to the http-proxy. +MDInitialDelay duration 0s sDHow long to delay the first certificate check. +MDMatchNames all|servernames all sDDetermines how DNS names are matched to vhosts +MDMember hostnamesDAdditional hostname for the managed domain. +MDMembers auto|manual auto sDControl if the alias domain names are automatically added. +MDMessageCmd path-to-cmd optional-argssDHandle events for Manage Domains +MDMustStaple on|off off sDControl if new certificates carry the OCSP Must Staple flag. +MDNotifyCmd path [ args ]sDRun a program when a Managed Domain is ready. +MDomain dns-name [ other-dns-name... ] [auto|manual]sDDefine list of domain names that belong to one group. +<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sDContainer for directives applied to the same managed domains. +MDPortMap map1 [ map2 ] http:80 https:443 sDMap external to internal ports for domain ownership verification. +MDPrivateKeys type [ params... ] RSA 2048 sDSet type and size of the private keys generated. +MDProfile namesDUse a specific ACME profile from the CA +MDProfileMandatory on|off off sDControl if an MDProfile is mandatory. +MDRenewMode always|auto|manual auto sDControls if certificates shall be renewed. +MDRenewViaARI on|off on sDusage of the ACME ARI extension (rfc9773). +MDRenewWindow duration 33% sDControl when a certificate will be renewed. +MDRequireHttps off|temporary|permanent off sDRedirects http: traffic to https: for Managed Domains. +MDRetryDelay duration 30s sDTime length for first retry, doubled on every consecutive error. +MDRetryFailover number 13 sDThe number of errors before a failover to another CA is triggered +MDServerStatus on|off off sDControl if Managed Domain information is added to server-status. +MDStapleOthers on|off on sDEnable stapling for certificates not managed by mod_md. +MDStapling on|off off sDEnable stapling for all or a particular MDomain. +MDStaplingKeepResponse duration 7d sDControls when old responses should be removed. +MDStaplingRenewWindow duration 33% sDControl when the stapling responses will be renewed. +MDStoreDir path md sDPath on the local file system to store the Managed Domains data. +MDStoreLocks on|off|duration off sDConfigure locking of store for updates +MDWarnWindow duration 10% sDDefine the time window when you want to be warned about an expiring certificate. +MemcacheConnTTL num[units] 15s skEKeepalive time for idle connections +MergeSlashes ON|OFF ON skÇControls whether the server merges consecutive slashes in URLs. -MergeTrailers [on|off] off skÇDetermines whether trailers are merged into headers -MetaDir directory .web skdhEName of the directory to find CERN-style meta information +MergeTrailers [on|off] off skÇDetermines whether trailers are merged into headers +MetaDir directory .web skdhKName of the directory to find CERN-style meta information files -MetaFiles on|off off skdhEActivates CERN meta-file processing -MetaSuffix suffix .meta skdhEFile name suffix for the file containing CERN-style +MetaFiles on|off off skdhKActivates CERN meta-file processing +MetaSuffix suffix .meta skdhKFile name suffix for the file containing CERN-style meta information -MimeMagicDecompression On|Off Off skEEnable decompression of compressed files for MIME type detection -MimeMagicFile file-pathskEEnable MIME-type determination based on file contents +MimeMagicDecompression On|Off Off skEEnable decompression of compressed files for MIME type detection +MimeMagicFile file-pathskEEnable MIME-type determination based on file contents using the specified magic file -MimeOptions option [option] ...skdhTConfigures mod_mime behavior -MinSpareServers sayı 5 sMBoÅŸtaki çocuk süreçlerin asgari sayısı -MinSpareThreads sayısMÄ°steklerin ani artışında devreye girecek boÅŸtaki evrelerin asgari +MimeOptions option [option] ...skdhTConfigures mod_mime behavior +MinSpareServers sayı 5 sMBoÅŸtaki çocuk süreçlerin asgari sayısı +MinSpareThreads sayısMÄ°steklerin ani artışında devreye girecek boÅŸtaki evrelerin asgari sayısını belirler. -MMapFile file-path [file-path] ...sDMap a list of files into memory at startup time -ModemStandard V.21|V.26bis|V.32|V.34|V.92dDModem standard to simulate -ModMimeUsePathInfo On|Off Off dTTells mod_mime to treat path_info +MMapFile file-path [file-path] ...sDMap a list of files into memory at startup time +ModemStandard V.21|V.26bis|V.32|V.34|V.92dDModem standard to simulate +ModMimeUsePathInfo On|Off Off dTTells mod_mime to treat path_info components as part of the filename -MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers -[Handlers|Filters] NegotiatedOnly skdhTThe types of files that will be included when searching for +MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers +[Handlers|Filters] NegotiatedOnly skdhTThe types of files that will be included when searching for a matching file with MultiViews -Mutex mekanizma [default|muteks-ismi] ... [OmitPID] default sÇMuteks mekanizmasını ve kilit dosyası dizinini tüm muteksler veya belirtilenler için yapılandırır -NameVirtualHost adres[:port]sÇÖNERÄ°LMÄ°YOR: Ä°sme dayalı sanal konaklar için IP adresi belirtir -NoProxy host [host] ...skEHosts, domains, or networks that will be connected to +Mutex mekanizma [default|muteks-ismi] ... [OmitPID] default sÇMuteks mekanizmasını ve kilit dosyası dizinini tüm muteksler veya belirtilenler için yapılandırır +NameVirtualHost adres[:port]sÇÖNERÄ°LMÄ°YOR: Ä°sme dayalı sanal konaklar için IP adresi belirtir +NoProxy host [host] ...skEHosts, domains, or networks that will be connected to directly -NWSSLTrustedCerts filename [filename] ...sTList of additional client certificates -NWSSLUpgradeable [IP-address:]portnumbersTAllows a connection to be upgraded to an SSL connection upon request -Options - [+|-]seçenek [[+|-]seçenek] ... FollowSymlinks skdhÇBelli bir dizinde geçerli olacak özellikleri yapılandırır. +NWSSLTrustedCerts filename [filename] ...sTList of additional client certificates +NWSSLUpgradeable [IP-address:]portnumbersTAllows a connection to be upgraded to an SSL connection upon request +Options + [+|-]seçenek [[+|-]seçenek] ... FollowSymlinks skdhÇBelli bir dizinde geçerli olacak özellikleri yapılandırır. - Order ordering Deny,Allow dhEControls the default access state and the order in which + Order ordering Deny,Allow dhKControls the default access state and the order in which Allow and Deny are evaluated. -OutputSed sed-commanddhDSed command for filtering response content -PassEnv ortam-deÄŸiÅŸkeni [ortam-deÄŸiÅŸkeni] -...skdhTOrtam deÄŸiÅŸkenlerini kabuktan aktarır. -PidFile dosya logs/httpd.pid sMAna sürecin süreç kimliÄŸinin (PID) kaydedileceÄŸi dosyayı belirler. -PolicyConditional ignore|log|enforceskdEEnable the conditional request policy. -PolicyConditionalURL urlskdEURL describing the conditional request policy. -PolicyEnvironment variable log-value ignore-valueskdEOverride policies based on an environment variable. -PolicyFilter on|offskdEEnable or disable policies for the given URL space. -PolicyKeepalive ignore|log|enforceskdEEnable the keepalive policy. -PolicyKeepaliveURL urlskdEURL describing the keepalive policy. -PolicyLength ignore|log|enforceskdEEnable the content length policy. -PolicyLengthURL urlskdEURL describing the content length policy. -PolicyMaxage ignore|log|enforce ageskdEEnable the caching minimum max-age policy. -PolicyMaxageURL urlskdEURL describing the caching minimum freshness lifetime policy. -PolicyNocache ignore|log|enforceskdEEnable the caching no-cache policy. -PolicyNocacheURL urlskdEURL describing the caching no-cache policy. -PolicyType ignore|log|enforce type [ type [ ... ]]skdEEnable the content type policy. -PolicyTypeURL urlskdEURL describing the content type policy. -PolicyValidation ignore|log|enforceskdEEnable the validation policy. -PolicyValidationURL urlskdEURL describing the content type policy. -PolicyVary ignore|log|enforce header [ header [ ... ]]skdEEnable the Vary policy. -PolicyVaryURL urlskdEURL describing the content type policy. -PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1skdEEnable the version policy. -PolicyVersionURL urlskdEURL describing the minimum request HTTP version policy. -PollersPerChild number 0 sMNumber of poll threads per child process -PrivilegesMode FAST|SECURE|SELECTIVE FAST skdDTrade off processing speed and efficiency vs security against +OutputSed sed-commanddhDSed command for filtering response content +PassEnv ortam-deÄŸiÅŸkeni [ortam-deÄŸiÅŸkeni] +...skdhTOrtam deÄŸiÅŸkenlerini kabuktan aktarır. +PidFile dosya logs/httpd.pid sMAna sürecin süreç kimliÄŸinin (PID) kaydedileceÄŸi dosyayı belirler. +PolicyConditional ignore|log|enforceskdEEnable the conditional request policy. +PolicyConditionalURL urlskdEURL describing the conditional request policy. +PolicyEnvironment variable log-value ignore-valueskdEOverride policies based on an environment variable. +PolicyFilter on|offskdEEnable or disable policies for the given URL space. +PolicyKeepalive ignore|log|enforceskdEEnable the keepalive policy. +PolicyKeepaliveURL urlskdEURL describing the keepalive policy. +PolicyLength ignore|log|enforceskdEEnable the content length policy. +PolicyLengthURL urlskdEURL describing the content length policy. +PolicyMaxage ignore|log|enforce ageskdEEnable the caching minimum max-age policy. +PolicyMaxageURL urlskdEURL describing the caching minimum freshness lifetime policy. +PolicyNocache ignore|log|enforceskdEEnable the caching no-cache policy. +PolicyNocacheURL urlskdEURL describing the caching no-cache policy. +PolicyType ignore|log|enforce type [ type [ ... ]]skdEEnable the content type policy. +PolicyTypeURL urlskdEURL describing the content type policy. +PolicyValidation ignore|log|enforceskdEEnable the validation policy. +PolicyValidationURL urlskdEURL describing the content type policy. +PolicyVary ignore|log|enforce header [ header [ ... ]]skdEEnable the Vary policy. +PolicyVaryURL urlskdEURL describing the content type policy. +PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1skdEEnable the version policy. +PolicyVersionURL urlskdEURL describing the minimum request HTTP version policy. +PollersPerChild number 0 sMNumber of poll threads per child process +PrivilegesMode FAST|SECURE|SELECTIVE FAST skdKTrade off processing speed and efficiency vs security against malicious privileges-aware code. -Protocol protokolskÇDinlenen bir soket için protokol -ProtocolEcho On|Off Off skDTurn the echo server on or off -Protocols protocol ... http/1.1 skÇProtocols available for a server/virtual host -ProtocolsHonorOrder On|Off On skÇDetermines if order of Protocols determines precedence during negotiation -<Proxy wildcard-url> ...</Proxy>skEContainer for directives applied to proxied resources -Proxy100Continue Off|On On skdEForward 100-continue expectation to the origin server -ProxyAddHeaders Off|On On skdEAdd proxy information in X-Forwarded-* headers -ProxyAsyncDelay time[s]skdETime to poll synchronously before handing a connection to the +Protocol protokolskÇDinlenen bir soket için protokol +ProtocolEcho On|Off Off skDTurn the echo server on or off +Protocols protocol ... http/1.1 skÇProtocols available for a server/virtual host +ProtocolsHonorOrder On|Off On skÇDetermines if order of Protocols determines precedence during negotiation +<Proxy wildcard-url> ...</Proxy>skEContainer for directives applied to proxied resources +Proxy100Continue Off|On On skdEForward 100-continue expectation to the origin server +ProxyAddHeaders Off|On On skdEAdd proxy information in X-Forwarded-* headers +ProxyAsyncDelay time[s]skdETime to poll synchronously before handing a connection to the MPM for asynchronous processing -ProxyAsyncIdleTimeout time[s]skdEInactivity timeout for asynchronous proxy connections -ProxyBadHeader IsError|Ignore|StartBody IsError skEDetermines how to handle bad header lines in a +ProxyAsyncIdleTimeout time[s]skdEInactivity timeout for asynchronous proxy connections +ProxyBadHeader IsError|Ignore|StartBody IsError skEDetermines how to handle bad header lines in a response -ProxyBeaconAddress address:portskEAddress of the reverse proxy to which a backend sends its +ProxyBeaconAddress address:portskEAddress of the reverse proxy to which a backend sends its announcements -ProxyBeaconAdvertise urlskEThe routable URL a backend announces to the reverse proxy -ProxyBeaconBalancer nameskEName of the balancer that announced backends are added to -ProxyBeaconInterval interval 5 skEHow often a backend publishes its announcement -ProxyBeaconListen [address][:port]skEAddress on which the reverse proxy receives backend +ProxyBeaconAdvertise urlskEThe routable URL a backend announces to the reverse proxy +ProxyBeaconBalancer nameskEName of the balancer that announced backends are added to +ProxyBeaconInterval interval 5 skEHow often a backend publishes its announcement +ProxyBeaconListen [address][:port]skEAddress on which the reverse proxy receives backend beacons -ProxyBeaconMaxSkew intervalskEMaximum allowed age of a signed announcement -ProxyBeaconSecret secretskEPre-shared secret used to authenticate announcements -ProxyBeaconTimeout interval 0 skEHow long the proxy waits, without an announcement, before a backend +ProxyBeaconMaxSkew intervalskEMaximum allowed age of a signed announcement +ProxyBeaconSecret secretskEPre-shared secret used to authenticate announcements +ProxyBeaconTimeout interval 0 skEHow long the proxy waits, without an announcement, before a backend is taken out of rotation -ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...skEDisallow proxy requests to certain hosts -ProxyDomain DomainskEDefault domain name for proxied requests -ProxyErrorOverride Off|On [code ...] Off skdEOverride error pages for proxied content -ProxyExpressDBMFile pathnameskEPathname to DBM file. -ProxyExpressDBMType type default skEDBM type of file. -ProxyExpressEnable on|off off skEEnable the module functionality. -ProxyFCGIBackendType FPM|GENERIC FPM skdhESpecify the type of backend FastCGI application -ProxyFCGISetEnvIf conditional-expression +ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...skEDisallow proxy requests to certain hosts +ProxyDomain DomainskEDefault domain name for proxied requests +ProxyErrorOverride Off|On [code ...] Off skdEOverride error pages for proxied content +ProxyExpressDBMFile pathnameskEPathname to DBM file. +ProxyExpressDBMType type default skEDBM type of file. +ProxyExpressEnable on|off off skEEnable the module functionality. +ProxyFCGIBackendType FPM|GENERIC FPM skdhESpecify the type of backend FastCGI application +ProxyFCGISetEnvIf conditional-expression [!]environment-variable-name - [value-expression]skdhEAllow variables sent to FastCGI servers to be fixed up -ProxyFtpDirCharset character_set ISO-8859-1 skdEDefine the character set for proxied FTP listings -ProxyFtpEscapeWildcards on|off on skdEWhether wildcards in requested filenames are escaped when sent to the FTP server -ProxyFtpListOnWildcard on|off on skdEWhether wildcards in requested filenames trigger a file listing -ProxyHCExpr name {ap_expr expression}skECreates a named condition expression to use to determine health of the backend based on its response -ProxyHCTemplate name parameter=setting [...]skECreates a named template for setting various health check parameters -ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers -ProxyHTMLBufSize bytes 8192 skdTSets the buffer size increment for buffering inline scripts and + [value-expression]skdhEAllow variables sent to FastCGI servers to be fixed up +ProxyFtpDirCharset character_set ISO-8859-1 skdEDefine the character set for proxied FTP listings +ProxyFtpEscapeWildcards on|off on skdEWhether wildcards in requested filenames are escaped when sent to the FTP server +ProxyFtpListOnWildcard on|off on skdEWhether wildcards in requested filenames trigger a file listing +ProxyHCExpr name {ap_expr expression}skECreates a named condition expression to use to determine health of the backend based on its response +ProxyHCTemplate name parameter=setting [...]skECreates a named template for setting various health check parameters +ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers +ProxyHTMLBufSize bytes 8192 skdTSets the buffer size increment for buffering inline scripts and stylesheets. -ProxyHTMLCharsetOut Charset | * UTF-8 skdTSpecify a charset for mod_proxy_html output. -ProxyHTMLDocType HTML|XHTML [Legacy]
OR +ProxyHTMLCharsetOut Charset | * UTF-8 skdTSpecify a charset for mod_proxy_html output. +ProxyHTMLDocType HTML|XHTML [Legacy]
OR
ProxyHTMLDocType fpi [SGML|XML]
OR
ProxyHTMLDocType html5
OR -
ProxyHTMLDocType auto auto (2.5/trunk ver +skdTSets an HTML or XHTML document type declaration. -ProxyHTMLEnable On|Off Off skdTTurns the proxy_html filter on or off. -ProxyHTMLEvents attribute [attribute ...]skdTSpecify attributes to treat as scripting events. -ProxyHTMLExtended On|Off Off skdTDetermines whether to fix links in inline scripts, stylesheets, +
ProxyHTMLDocType auto auto (2.5/trunk ver +skdTSets an HTML or XHTML document type declaration. +ProxyHTMLEnable On|Off Off skdTTurns the proxy_html filter on or off. +ProxyHTMLEvents attribute [attribute ...]skdTSpecify attributes to treat as scripting events. +ProxyHTMLExtended On|Off Off skdTDetermines whether to fix links in inline scripts, stylesheets, and scripting events. -ProxyHTMLFixups [lowercase] [dospath] [reset] none skdTFixes for simple HTML errors. -ProxyHTMLInterp On|Off Off skdTEnables per-request interpolation of +ProxyHTMLFixups [lowercase] [dospath] [reset] none skdTFixes for simple HTML errors. +ProxyHTMLInterp On|Off Off skdTEnables per-request interpolation of ProxyHTMLURLMap rules. -ProxyHTMLLinks element attribute [attribute2 ...]skdTSpecify HTML elements that have URL attributes to be rewritten. -ProxyHTMLMeta On|Off Off skdTTurns on or off extra pre-parsing of metadata in HTML +ProxyHTMLLinks element attribute [attribute2 ...]skdTSpecify HTML elements that have URL attributes to be rewritten. +ProxyHTMLMeta On|Off Off skdTTurns on or off extra pre-parsing of metadata in HTML <head> sections. -ProxyHTMLStripComments On|Off Off skdTDetermines whether to strip HTML comments. -ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]skdTDefines a rule to rewrite HTML links -ProxyIOBufferSize bytes 8192 skEDetermine size of internal data throughput buffer -<ProxyMatch regex> ...</ProxyMatch>skEContainer for directives applied to regular-expression-matched +ProxyHTMLStripComments On|Off Off skdTDetermines whether to strip HTML comments. +ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]skdTDefines a rule to rewrite HTML links +ProxyIOBufferSize bytes 8192 skEDetermine size of internal data throughput buffer +<ProxyMatch regex> ...</ProxyMatch>skEContainer for directives applied to regular-expression-matched proxied resources -ProxyMaxForwards number -1 skEMaximum number of proxies that a request can be forwarded +ProxyMaxForwards number -1 skEMaximum number of proxies that a request can be forwarded through -ProxyPass [path] !|url [key=value - [key=value ...]] [nocanon] [interpolate] [noquery]skdEMaps remote servers into the local server URL-space -ProxyPassInherit On|Off On skEInherit ProxyPass directives defined from the main server -ProxyPassInterpolateEnv On|Off Off skdEEnable Environment Variable interpolation in Reverse Proxy configurations -ProxyPassMatch [regex] !|url [key=value - [key=value ...]]skdEMaps remote servers into the local server URL-space using regular expressions -ProxyPassReverse [path] url -[interpolate]skdEAdjusts the URL in HTTP response headers sent from a reverse +ProxyPass [path] !|url [key=value + [key=value ...]] [nocanon] [interpolate] [noquery]skdEMaps remote servers into the local server URL-space +ProxyPassInherit On|Off On skEInherit ProxyPass directives defined from the main server +ProxyPassInterpolateEnv On|Off Off skdEEnable Environment Variable interpolation in Reverse Proxy configurations +ProxyPassMatch [regex] !|url [key=value + [key=value ...]]skdEMaps remote servers into the local server URL-space using regular expressions +ProxyPassReverse [path] url +[interpolate]skdEAdjusts the URL in HTTP response headers sent from a reverse proxied server -ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate]skdEAdjusts the Domain string in Set-Cookie headers from a reverse- +ProxyPassReverseCookieDomain internal-domain +public-domain [interpolate]skdEAdjusts the Domain string in Set-Cookie headers from a reverse- proxied server -ProxyPassReverseCookiePath internal-path -public-path [interpolate]skdEAdjusts the Path string in Set-Cookie headers from a reverse- +ProxyPassReverseCookiePath internal-path +public-path [interpolate]skdEAdjusts the Path string in Set-Cookie headers from a reverse- proxied server -ProxyPreserveHost On|Off Off skdEUse incoming Host HTTP request header for proxy +ProxyPreserveHost On|Off Off skdEUse incoming Host HTTP request header for proxy request -ProxyReceiveBufferSize bytes 0 skENetwork buffer size for proxied HTTP and FTP +ProxyReceiveBufferSize bytes 0 skENetwork buffer size for proxied HTTP and FTP connections -ProxyRemote match remote-server [username:password]skERemote proxy used to handle certain requests -ProxyRemoteMatch regex remote-server [username:password]skERemote proxy used to handle requests matched by regular +ProxyRemote match remote-server [username:password]skERemote proxy used to handle certain requests +ProxyRemoteMatch regex remote-server [username:password]skERemote proxy used to handle requests matched by regular expressions -ProxyRequests On|Off Off skEEnables forward (standard) proxy requests -ProxySCGIInternalRedirect On|Off|Headername On skdEEnable or disable internal redirect responses from the +ProxyRequests On|Off Off skEEnables forward (standard) proxy requests +ProxySCGIInternalRedirect On|Off|Headername On skdEEnable or disable internal redirect responses from the backend -ProxySCGISendfile On|Off|Headername Off skdEEnable evaluation of X-Sendfile pseudo response +ProxySCGISendfile On|Off|Headername Off skdEEnable evaluation of X-Sendfile pseudo response header -ProxySet url key=value [key=value ...]skdESet various Proxy balancer or member parameters -ProxySourceAddress addressskESet local IP address for outgoing proxy connections -ProxyStatus Off|On|Full Off skEShow Proxy LoadBalancer status in mod_status -ProxyTimeout time-interval[s]skENetwork timeout for proxied requests -ProxyVia On|Off|Full|Block Off skEInformation provided in the Via HTTP response +ProxySet url key=value [key=value ...]skdESet various Proxy balancer or member parameters +ProxySourceAddress addressskESet local IP address for outgoing proxy connections +ProxyStatus Off|On|Full Off skEShow Proxy LoadBalancer status in mod_status +ProxyTimeout time-interval[s]skENetwork timeout for proxied requests +ProxyVia On|Off|Full|Block Off skEInformation provided in the Via HTTP response header for proxied requests -ProxyWebsocketAsync ON|OFFskEInstructs this module to try to create an asynchronous tunnel -ProxyWebsocketAsyncDelay num[ms] 0 skESets the amount of time the tunnel waits synchronously for data -ProxyWebsocketFallbackToProxyHttp On|Off On skEInstructs this module to let mod_proxy_http handle the request -ProxyWebsocketIdleTimeout num[ms] 0 skESets the maximum amount of time to wait for data on the websockets tunnel -QualifyRedirectURL On|Off Off skdÇControls whether the REDIRECT_URL environment variable is +ProxyWebsocketAsync ON|OFFskKInstructs this module to try to create an asynchronous tunnel +ProxyWebsocketAsyncDelay num[ms] 0 skKSets the amount of time the tunnel waits synchronously for data +ProxyWebsocketFallbackToProxyHttp On|Off On skKInstructs this module to let mod_proxy_http handle the request +ProxyWebsocketIdleTimeout num[ms] 0 skKSets the maximum amount of time to wait for data on the websockets tunnel +QualifyRedirectURL On|Off Off skdÇControls whether the REDIRECT_URL environment variable is fully qualified -ReadBufferSize bytes 8192 skdÇSize of the buffers used to read data -ReadmeName dosya-ismiskdhTDizin listesinin sonuna yerleÅŸtirilecek dosyanın ismini +ReadBufferSize bytes 8192 skdÇSize of the buffers used to read data +ReadmeName dosya-ismiskdhTDizin listesinin sonuna yerleÅŸtirilecek dosyanın ismini belirler. -ReceiveBufferSize bayt-sayısı 0 sMTCP alım tamponu boyu -Redirect [durum] URL-yolu -URLskdhTÄ°stemciyi, bir yönlendirme isteÄŸi döndürerek farklı bir URL'ye +ReceiveBufferSize bayt-sayısı 0 sMTCP alım tamponu boyu +Redirect [durum] URL-yolu +URLskdhTÄ°stemciyi, bir yönlendirme isteÄŸi döndürerek farklı bir URL'ye yönlendirir. -RedirectMatch [durum] düzenli-ifade -URLskdhTGeçerli URL ile eÅŸleÅŸen bir düzenli ifadeye dayanarak bir harici +RedirectMatch [durum] düzenli-ifade +URLskdhTGeçerli URL ile eÅŸleÅŸen bir düzenli ifadeye dayanarak bir harici yönlendirme gönderir. -RedirectPermanent URL-yolu URLskdhTÄ°stemciyi, kalıcı bir yönlendirme isteÄŸi döndürerek farklı bir +RedirectPermanent URL-yolu URLskdhTÄ°stemciyi, kalıcı bir yönlendirme isteÄŸi döndürerek farklı bir URL'ye yönlendirir. -RedirectRelative On|Off Off skdTAllows relative redirect targets. -RedirectTemp URL-yolu URLskdhTÄ°stemciyi, geçici bir yönlendirme isteÄŸi döndürerek farklı bir +RedirectRelative On|Off Off skdTAllows relative redirect targets. +RedirectTemp URL-yolu URLskdhTÄ°stemciyi, geçici bir yönlendirme isteÄŸi döndürerek farklı bir URL'ye yönlendirir. -RedisConnPoolTTL num[units] 15s skETTL used for the connection pool with the Redis server(s) -RedisTimeout num[units] 5s skER/W timeout used for the connection with the Redis server(s) -ReflectorHeader inputheader [outputheader]skdhTReflect an input header to the output headers -RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sÇAllow to configure global/default options for regexes -RegisterHttpMethod method [method [...]]sÇRegister non-standard HTTP methods -RemoteIPHeader header-fieldskTDeclare the header field which should be parsed for useragent IP addresses -RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...skTDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPInternalProxyList filenameskTDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPProxiesHeader HeaderFieldNameskTDeclare the header field which will record all intermediate IP addresses -RemoteIPProxyProtocol On|OffskTEnable or disable PROXY protocol handling -RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]skTDisable processing of PROXY header for certain hosts or networks -RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...skTRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoteIPTrustedProxyList filenameskTRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoveCharset extension [extension] -...kdhTRemoves any character set associations for a set of file +RedisConnPoolTTL num[units] 15s skETTL used for the connection pool with the Redis server(s) +RedisTimeout num[units] 5s skER/W timeout used for the connection with the Redis server(s) +ReflectorHeader inputheader [outputheader]skdhTReflect an input header to the output headers +RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sÇAllow to configure global/default options for regexes +RegisterHttpMethod method [method [...]]sÇRegister non-standard HTTP methods +RemoteIPHeader header-fieldskTDeclare the header field which should be parsed for useragent IP addresses +RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...skTDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPInternalProxyList filenameskTDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPProxiesHeader HeaderFieldNameskTDeclare the header field which will record all intermediate IP addresses +RemoteIPProxyProtocol On|OffskTEnable or disable PROXY protocol handling +RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]skTDisable processing of PROXY header for certain hosts or networks +RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...skTRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoteIPTrustedProxyList filenameskTRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoveCharset extension [extension] +...kdhTRemoves any character set associations for a set of file extensions -RemoveEncoding extension [extension] -...kdhTRemoves any content encoding associations for a set of file +RemoveEncoding extension [extension] +...kdhTRemoves any content encoding associations for a set of file extensions -RemoveHandler extension [extension] -...kdhTRemoves any handler associations for a set of file +RemoveHandler extension [extension] +...kdhTRemoves any handler associations for a set of file extensions -RemoveInputFilter extension [extension] -...kdhTRemoves any input filter associations for a set of file +RemoveInputFilter extension [extension] +...kdhTRemoves any input filter associations for a set of file extensions -RemoveLanguage extension [extension] -...kdhTRemoves any language associations for a set of file +RemoveLanguage extension [extension] +...kdhTRemoves any language associations for a set of file extensions -RemoveOutputFilter extension [extension] -...kdhTRemoves any output filter associations for a set of file +RemoveOutputFilter extension [extension] +...kdhTRemoves any output filter associations for a set of file extensions -RemoveType extension [extension] -...kdhTRemoves any content type associations for a set of file +RemoveType extension [extension] +...kdhTRemoves any content type associations for a set of file extensions -RequestHeader add|append|edit|edit*|merge|set|setifempty|unset +RequestHeader add|append|edit|edit*|merge|set|setifempty|unset header [[expr=]value [replacement] [early|env=[!]varname|expr=expression]] -skdhEConfigure HTTP request headers -RequestReadTimeout +skdhEConfigure HTTP request headers +RequestReadTimeout [handshake=timeout[-maxtimeout][,MinRate=rate] [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate] - handshake=0 header= +skESet timeout values for completing the TLS handshake, receiving + handshake=0 header= +skESet timeout values for completing the TLS handshake, receiving the request headers and/or body from client. -Require [not] entity-name - [entity-name] ...dhTTests whether an authenticated user is authorized by +Require [not] entity-name + [entity-name] ...dhTTests whether an authenticated user is authorized by an authorization provider. -<RequireAll> ... </RequireAll>dhTEnclose a group of authorization directives of which none +<RequireAll> ... </RequireAll>dhTEnclose a group of authorization directives of which none must fail and at least one must succeed for the enclosing directive to succeed. -<RequireAny> ... </RequireAny>dhTEnclose a group of authorization directives of which one +<RequireAny> ... </RequireAny>dhTEnclose a group of authorization directives of which one must succeed for the enclosing directive to succeed. -<RequireNone> ... </RequireNone>dhTEnclose a group of authorization directives of which none +<RequireNone> ... </RequireNone>dhTEnclose a group of authorization directives of which none must succeed for the enclosing directive to not fail. -RewriteBase URL-pathdhESets the base URL for per-directory rewrites - RewriteCond - TestString [!]CondPattern [flags]skdhEDefines a condition under which rewriting will take place +RewriteBase URL-pathdhESets the base URL for per-directory rewrites + RewriteCond + TestString [!]CondPattern [flags]skdhEDefines a condition under which rewriting will take place -RewriteEngine on|off off skdhEEnables or disables runtime rewriting engine -RewriteMap MapName MapType:MapSource +RewriteEngine on|off off skdhEEnables or disables runtime rewriting engine +RewriteMap MapName MapType:MapSource [MapTypeOptions] -skEDefines a mapping function for key-lookup -RewriteOptions OptionsskdhESets some special options for the rewrite engine -RewriteRule - [!]Pattern Substitution [flags]skdhEDefines rules for the rewriting engine -RLimitCPU saniye|max [saniye|max]skdhÇApache httpd alt süreçleri tarafından çalıştırılan süreçlerin +skEDefines a mapping function for key-lookup +RewriteOptions OptionsskdhESets some special options for the rewrite engine +RewriteRule + [!]Pattern Substitution [flags]skdhEDefines rules for the rewriting engine +RLimitCPU saniye|max [saniye|max]skdhÇApache httpd alt süreçleri tarafından çalıştırılan süreçlerin iÅŸlemci tüketimine sınırlama getirir. -RLimitMEM bayt-sayısı|max [bayt-sayısı|max] -skdhÇApache httpd alt süreçleri tarafından çalıştırılan süreçlerin +RLimitMEM bayt-sayısı|max [bayt-sayısı|max] +skdhÇApache httpd alt süreçleri tarafından çalıştırılan süreçlerin bellek tüketimine sınırlama getirir. -RLimitNPROC sayı|max [sayı|max]skdhÇApache httpd alt süreçleri tarafından çalıştırılabilecek süreç +RLimitNPROC sayı|max [sayı|max]skdhÇApache httpd alt süreçleri tarafından çalıştırılabilecek süreç sayısına sınırlama getirir. -Satisfy Any|All All dhEInteraction between host-level access control and +Satisfy Any|All All dhKInteraction between host-level access control and user authentication -ScoreBoardFile dosya-yolu logs/apache_status sMÇocuk süreçler için eÅŸgüdüm verisini saklamakta kullanılan +ScoreBoardFile dosya-yolu logs/apache_status sMÇocuk süreçler için eÅŸgüdüm verisini saklamakta kullanılan dosyanın yerini belirler. -Script method cgi-scriptskdTActivates a CGI script for a particular request +Script method cgi-scriptskdTActivates a CGI script for a particular request method. -ScriptAlias URL-yolu -dosya-yolu|dizin-yoluskdTBir URL'yi dosya sistemindeki bir yere eÅŸler ve hedefi bir CGI betiÄŸi olarak çalıştırır. -ScriptAliasMatch düzenli-ifade -dosya-yolu|dizin-yoluskTBir URL'yi dosya sistemindeki bir yere düzenli ifade kullanarak +ScriptAlias URL-yolu +dosya-yolu|dizin-yoluskdTBir URL'yi dosya sistemindeki bir yere eÅŸler ve hedefi bir CGI betiÄŸi olarak çalıştırır. +ScriptAliasMatch düzenli-ifade +dosya-yolu|dizin-yoluskTBir URL'yi dosya sistemindeki bir yere düzenli ifade kullanarak eÅŸler ve hedefi bir CGI betiÄŸi olarak çalıştırır. -ScriptInterpreterSource Registry|Registry-Strict|Script Script skdhÇCGI betikleri için yorumlayıcı belirleme tekniÄŸi -ScriptLog file-pathskTLocation of the CGI script error logfile -ScriptLogBuffer bytes 1024 skTMaximum amount of PUT or POST requests that will be recorded +ScriptInterpreterSource Registry|Registry-Strict|Script Script skdhÇCGI betikleri için yorumlayıcı belirleme tekniÄŸi +ScriptLog file-pathskTLocation of the CGI script error logfile +ScriptLogBuffer bytes 1024 skTMaximum amount of PUT or POST requests that will be recorded in the scriptlog -ScriptLogLength bytes 10385760 skTSize limit of the CGI script logfile -ScriptSock file-path cgisock sTThe filename prefix of the socket to use for communication with +ScriptLogLength bytes 10385760 skTSize limit of the CGI script logfile +ScriptSock file-path cgisock sTThe filename prefix of the socket to use for communication with the cgi daemon -SecureListen [IP-address:]portnumber -Certificate-Name [MUTUAL]sTEnables SSL encryption for the specified port -SeeRequestTail On|Off Off sÇÄ°steÄŸin 63 karakterden büyük olduÄŸu varsayımıyla, mod_status'un +SecureListen [IP-address:]portnumber +Certificate-Name [MUTUAL]sTEnables SSL encryption for the specified port +SeeRequestTail On|Off Off sÇÄ°steÄŸin 63 karakterden büyük olduÄŸu varsayımıyla, mod_status'un ilk 63 karakteri mi yoksa son 63 karakteri mi göstereceÄŸini belirler. -SendBufferSize bayt-sayısı 0 sMTCP tamponu boyu -ServerAdmin eposta-adresi|URLskÇSunucunun hata iletilerinde istemciye göstereceÄŸi eposta adresi +SendBufferSize bayt-sayısı 0 sMTCP tamponu boyu +ServerAdmin eposta-adresi|URLskÇSunucunun hata iletilerinde istemciye göstereceÄŸi eposta adresi -ServerAlias konakadı [konakadı] ...kÇÄ°stekleri isme dayalı sanal konaklarla eÅŸleÅŸtirilirken +ServerAlias konakadı [konakadı] ...kÇÄ°stekleri isme dayalı sanal konaklarla eÅŸleÅŸtirilirken kullanılacak konak adları için baÅŸka isimler belirtebilmeyi saÄŸlar. -ServerLimit sayısMAyarlanabilir süreç sayısının üst sınırını belirler. -ServerName [ÅŸema://]tam-nitelenmiÅŸ-alan-adı[:port] -skÇSunucunun özdeÅŸleÅŸeceÄŸi konak ismi ve port. -ServerPath URL-yolukÇUyumsuz bir tarayıcı tarafından eriÅŸilmesi için bir isme dayalı sanal konak için meÅŸru URL yolu -ServerRoot dizin-yolu /usr/local/apache sÇSunucu yapılandırması için kök dizin -ServerSignature On|Off|EMail Off skdhÇSunucu tarafından üretilen belgelerin dipnotunu ayarlar. +ServerLimit sayısMAyarlanabilir süreç sayısının üst sınırını belirler. +ServerName [ÅŸema://]tam-nitelenmiÅŸ-alan-adı[:port] +skÇSunucunun özdeÅŸleÅŸeceÄŸi konak ismi ve port. +ServerPath URL-yolukÇUyumsuz bir tarayıcı tarafından eriÅŸilmesi için bir isme dayalı sanal konak için meÅŸru URL yolu +ServerRoot dizin-yolu /usr/local/apache sÇSunucu yapılandırması için kök dizin +ServerSignature On|Off|EMail Off skdhÇSunucu tarafından üretilen belgelerin dipnotunu ayarlar. -ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sÇServer HTTP yanıt baÅŸlığını yapılandırır. +ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sÇServer HTTP yanıt baÅŸlığını yapılandırır. -Session On|Off Off skdhEEnables a session for the current directory or location -SessionCookieMaxAge On|Off On skdhEControl whether session cookies have Max-Age transmitted to the client -SessionCookieName name attributesskdhEName and attributes for the RFC2109 cookie storing the session -SessionCookieName2 name attributesskdhEName and attributes for the RFC2965 cookie storing the session -SessionCookieRemove On|Off Off skdhEControl for whether session cookies should be removed from incoming HTTP headers -SessionCryptoCipher name aes256 skdhDThe crypto cipher to be used to encrypt the session -SessionCryptoDriver name [param[=value]]sDThe crypto driver to be used to encrypt the session -SessionCryptoPassphrase secret [ secret ... ] skdhDThe key used to encrypt the session -SessionCryptoPassphraseFile filenameskdDFile containing keys used to encrypt the session -SessionDBDCookieName name attributesskdhEName and attributes for the RFC2109 cookie storing the session ID -SessionDBDCookieName2 name attributesskdhEName and attributes for the RFC2965 cookie storing the session ID -SessionDBDCookieRemove On|Off On skdhEControl for whether session ID cookies should be removed from incoming HTTP headers -SessionDBDDeleteLabel label deletesession skdhEThe SQL query to use to remove sessions from the database -SessionDBDInsertLabel label insertsession skdhEThe SQL query to use to insert sessions into the database -SessionDBDPerUser On|Off Off skdhEEnable a per user session -SessionDBDSelectLabel label selectsession skdhEThe SQL query to use to select sessions from the database -SessionDBDUpdateLabel label updatesession skdhEThe SQL query to use to update existing sessions in the database -SessionEnv On|Off Off skdhEControl whether the contents of the session are written to the +Session On|Off Off skdhEEnables a session for the current directory or location +SessionCookieMaxAge On|Off On skdhEControl whether session cookies have Max-Age transmitted to the client +SessionCookieName name attributesskdhEName and attributes for the RFC2109 cookie storing the session +SessionCookieName2 name attributesskdhEName and attributes for the RFC2965 cookie storing the session +SessionCookieRemove On|Off Off skdhEControl for whether session cookies should be removed from incoming HTTP headers +SessionCryptoCipher name aes256 skdhDThe crypto cipher to be used to encrypt the session +SessionCryptoDriver name [param[=value]]sDThe crypto driver to be used to encrypt the session +SessionCryptoPassphrase secret [ secret ... ] skdhDThe key used to encrypt the session +SessionCryptoPassphraseFile filenameskdDFile containing keys used to encrypt the session +SessionDBDCookieName name attributesskdhEName and attributes for the RFC2109 cookie storing the session ID +SessionDBDCookieName2 name attributesskdhEName and attributes for the RFC2965 cookie storing the session ID +SessionDBDCookieRemove On|Off On skdhEControl for whether session ID cookies should be removed from incoming HTTP headers +SessionDBDDeleteLabel label deletesession skdhEThe SQL query to use to remove sessions from the database +SessionDBDInsertLabel label insertsession skdhEThe SQL query to use to insert sessions into the database +SessionDBDPerUser On|Off Off skdhEEnable a per user session +SessionDBDSelectLabel label selectsession skdhEThe SQL query to use to select sessions from the database +SessionDBDUpdateLabel label updatesession skdhEThe SQL query to use to update existing sessions in the database +SessionEnv On|Off Off skdhEControl whether the contents of the session are written to the HTTP_SESSION environment variable -SessionExclude pathskdhEDefine URL prefixes for which a session is ignored -SessionExpiryUpdateInterval interval 0 (always update) skdhEDefine the number of seconds a session's expiry may change without +SessionExclude pathskdhEDefine URL prefixes for which a session is ignored +SessionExpiryUpdateInterval interval 0 (always update) skdhEDefine the number of seconds a session's expiry may change without the session being updated -SessionHeader headerskdhEImport session updates from a given HTTP response header -SessionInclude pathskdhEDefine URL prefixes for which a session is valid -SessionMaxAge maxage 0 skdhEDefine a maximum age in seconds for a session -SetEnv ortam-deÄŸiÅŸkeni deÄŸerskdhTOrtam deÄŸiÅŸkenlerini tanımlar. -SetEnvIf öznitelik +SessionHeader headerskdhEImport session updates from a given HTTP response header +SessionInclude pathskdhEDefine URL prefixes for which a session is valid +SessionMaxAge maxage 0 skdhEDefine a maximum age in seconds for a session +SetEnv ortam-deÄŸiÅŸkeni deÄŸerskdhTOrtam deÄŸiÅŸkenlerini tanımlar. +SetEnvIf öznitelik düzifd [!]ort-deÄŸiÅŸkeni[=deÄŸer] - [[!]ort-deÄŸiÅŸkeni[=deÄŸer]] ...skdhTOrtam deÄŸiÅŸkenlerini isteÄŸin özniteliklerine göre atar. + [[!]ort-deÄŸiÅŸkeni[=deÄŸer]] ...skdhTOrtam deÄŸiÅŸkenlerini isteÄŸin özniteliklerine göre atar. -SetEnvIfExpr ifade +SetEnvIfExpr ifade [!]ort-deÄŸiÅŸkeni[=deÄŸer] - [[!]ort-deÄŸiÅŸkeni[=deÄŸer]] ...skdhTBir ap_expr ifadesine dayanarak ortam deÄŸiÅŸkenlerine deÄŸer atar -SetEnvIfNoCase öznitelik + [[!]ort-deÄŸiÅŸkeni[=deÄŸer]] ...skdhTBir ap_expr ifadesine dayanarak ortam deÄŸiÅŸkenlerine deÄŸer atar +SetEnvIfNoCase öznitelik düzifd [!]ort-deÄŸiÅŸkeni[=deÄŸer] - [[!]ort-deÄŸiÅŸkeni[=deÄŸer]] ...skdhTOrtam deÄŸiÅŸkenlerini isteÄŸin özniteliklerinde harf büyüklüÄŸüne + [[!]ort-deÄŸiÅŸkeni[=deÄŸer]] ...skdhTOrtam deÄŸiÅŸkenlerini isteÄŸin özniteliklerinde harf büyüklüÄŸüne baÄŸlı olmaksızın yapılmış tanımlara göre atar. -SetHandler eylemci-ismi|NoneskdhÇEÅŸleÅŸen tüm dosyaların belli bir eylemci tarafından iÅŸlenmesine +SetHandler eylemci-ismi|NoneskdhÇEÅŸleÅŸen tüm dosyaların belli bir eylemci tarafından iÅŸlenmesine sebep olur. -SetInputFilter süzgeç[;süzgeç...]skdhÇPOST girdilerini ve istemci isteklerini iÅŸleyecek süzgeçleri +SetInputFilter süzgeç[;süzgeç...]skdhÇPOST girdilerini ve istemci isteklerini iÅŸleyecek süzgeçleri belirler. -SetOutputFilter süzgeç[;süzgeç...]skdhÇSunucunun yanıtlarını iÅŸleyecek süzgeçleri belirler. -SSIEndTag tag "-->" skTString that ends an include element -SSIErrorMsg message "[an error occurred +skdhTError message displayed when there is an SSI +SetOutputFilter süzgeç[;süzgeç...]skdhÇSunucunun yanıtlarını iÅŸleyecek süzgeçleri belirler. +SSIEndTag tag "-->" skTString that ends an include element +SSIErrorMsg message "[an error occurred +skdhTError message displayed when there is an SSI error -SSIETag on|off off dhTControls whether ETags are generated by the server. -SSILastModified on|off off dhTControls whether Last-Modified headers are generated by the +SSIETag on|off off dhTControls whether ETags are generated by the server. +SSILastModified on|off off dhTControls whether Last-Modified headers are generated by the server. -SSILegacyExprParser on|off off dhTEnable compatibility mode for conditional expressions. -SSIStartTag tag "<!--#" skTString that starts an include element -SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +skdhTConfigures the format in which date strings are +SSILegacyExprParser on|off off dhTEnable compatibility mode for conditional expressions. +SSIStartTag tag "<!--#" skTString that starts an include element +SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +skdhTConfigures the format in which date strings are displayed -SSIUndefinedEcho string "(none)" skdhTString displayed when an unset variable is echoed -SSLCACertificateFile file-pathskEFile of concatenated PEM-encoded CA Certificates +SSIUndefinedEcho string "(none)" skdhTString displayed when an unset variable is echoed +SSLCACertificateFile file-pathskEFile of concatenated PEM-encoded CA Certificates for Client Auth -SSLCACertificatePath directory-pathskEDirectory of PEM-encoded CA Certificates for +SSLCACertificatePath directory-pathskEDirectory of PEM-encoded CA Certificates for Client Auth +SSLCACertificateURI uriskEServer CA certificate store for Client Authentication SSLCADNRequestFile file-pathskEFile of concatenated PEM-encoded CA Certificates for defining acceptable CA names SSLCADNRequestPath directory-pathskEDirectory of PEM-encoded CA Certificates for defining acceptable CA names -SSLCARevocationCheck chain|leaf|none [flags ...] none skEEnable CRL-based revocation checking -SSLCARevocationFile file-pathskEFile of concatenated PEM-encoded CA CRLs for +SSLCADNRequestURI uriskEcertificate store of CA Certificates for defining +acceptable CA names +SSLCARevocationCheck chain|leaf|none [flags ...] none skEEnable CRL-based revocation checking +SSLCARevocationFile file-pathskEFile of concatenated PEM-encoded CA CRLs for Client Auth -SSLCARevocationPath directory-pathskEDirectory of PEM-encoded CA CRLs for +SSLCARevocationPath directory-pathskEDirectory of PEM-encoded CA CRLs for Client Auth +SSLCARevocationURI uriskEServer CA certificate revocation list store for Client Authentication SSLCertificateChainFile file-pathskEFile of PEM-encoded Server CA Certificates SSLCertificateFile file-path|certidskEServer PEM-encoded X.509 certificate data file or token identifier SSLCertificateKeyFile file-path|keyidskEServer PEM-encoded private key file -SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +skdhECipher Suite available for negotiation in SSL +SSLCertificateURI uriskEServer certificate and key store +SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +skdhECipher Suite available for negotiation in SSL handshake -SSLClientHelloVars on|off off skEEnable collection of ClientHello variables -SSLCompression on|off off skEEnable compression on the SSL level -SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator -SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory -SSLEngine on|off off skESSL Engine Operation Switch -SSLFIPS on|off off sESSL FIPS mode Switch -SSLHonorCipherOrder on|off off skEOption to prefer the server's cipher preference order -SSLOCSPDefaultResponder uriskESet the default responder URI for OCSP validation -SSLOCSPEnable on|leaf|off [flags] off skEEnable OCSP validation of the client certificate chain -SSLOCSPNoverify on|off off skEskip the OCSP responder certificates verification -SSLOCSPOverrideResponder on|off off skEForce use of the default responder URI for OCSP validation -SSLOCSPProxyURL urlskEProxy URL to use for OCSP requests -SSLOCSPResponderCertificateFile fileskESet of trusted PEM encoded OCSP responder certificates -SSLOCSPResponderTimeout seconds 10 skETimeout for OCSP queries -SSLOCSPResponseMaxAge seconds -1 skEMaximum allowable age for OCSP responses -SSLOCSPResponseTimeSkew seconds 300 skEMaximum allowable time skew for OCSP response validation -SSLOCSPUseRequestNonce on|off on skEUse a nonce within OCSP queries -SSLOpenSSLConfCmd command-name command-valueskEConfigure OpenSSL parameters through its SSL_CONF API -SSLOptions [+|-]option ...skdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLClientHelloVars on|off off skEEnable collection of ClientHello variables +SSLCompression on|off off skEEnable compression on the SSL level +SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator +SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory +SSLEngine on|off off skESSL Engine Operation Switch +SSLFIPS on|off off sESSL FIPS mode Switch +SSLHonorCipherOrder on|off off skEOption to prefer the server's cipher preference order +SSLOCSPDefaultResponder uriskESet the default responder URI for OCSP validation +SSLOCSPEnable on|leaf|off [flags] off skEEnable OCSP validation of the client certificate chain +SSLOCSPNoverify on|off off skEskip the OCSP responder certificates verification +SSLOCSPOverrideResponder on|off off skEForce use of the default responder URI for OCSP validation +SSLOCSPProxyURL urlskEProxy URL to use for OCSP requests +SSLOCSPResponderCertificateFile fileskESet of trusted PEM encoded OCSP responder certificates +SSLOCSPResponderTimeout seconds 10 skETimeout for OCSP queries +SSLOCSPResponseMaxAge seconds -1 skEMaximum allowable age for OCSP responses +SSLOCSPResponseTimeSkew seconds 300 skEMaximum allowable time skew for OCSP response validation +SSLOCSPUseRequestNonce on|off on skEUse a nonce within OCSP queries +SSLOpenSSLConfCmd command-name command-valueskEConfigure OpenSSL parameters through its SSL_CONF API +SSLOptions [+|-]option ...skdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLPolicy nameskEApply a SSLPolicy by name -SSLProtocol [+|-]protocol ... all -SSLv3 skEConfigure usable SSL/TLS protocol versions -SSLProxyCACertificateFile file-pathskEFile of concatenated PEM-encoded CA Certificates +SSLPolicy nameskEApply a SSLPolicy by name +SSLProtocol [+|-]protocol ... all -SSLv3 skEConfigure usable SSL/TLS protocol versions +SSLProxyCACertificateFile file-pathskEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathskEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathskEDirectory of PEM-encoded CA Certificates for Remote Server Auth +SSLProxyCACertificateURI uriskEProxy CA certificate store for Remote Server Auth SSLProxyCARevocationCheck chain|leaf|none none skEEnable CRL-based revocation checking for Remote Server Auth SSLProxyCARevocationFile file-pathskEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth SSLProxyCARevocationPath directory-pathskEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCheckPeerCN on|off on skEWhether to check the remote server certificate's CN field +SSLProxyCARevocationURI uriskEProxy CA certificate revocation list store for Remote Server Auth +SSLProxyCheckPeerCN on|off on skEWhether to check the remote server certificate's CN field -SSLProxyCheckPeerExpire on|off on skEWhether to check if remote server certificate is expired +SSLProxyCheckPeerExpire on|off on skEWhether to check if remote server certificate is expired -SSLProxyCheckPeerName on|off on skEConfigure host name checking for remote server certificates +SSLProxyCheckPeerName on|off on skEConfigure host name checking for remote server certificates -SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +skECipher Suite available for negotiation in SSL +SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +skECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off skESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateChainFile filenameskEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate -SSLProxyMachineCertificateFile filenameskEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directoryskEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyEngine on|off off skESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateChainFile filenameskEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate +SSLProxyMachineCertificateFile filenameskEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directoryskEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificateURI uriskEProxy certificate and key stores SSLProxyProtocol [+|-]protocol ... all -SSLv3 skEConfigure usable SSL protocol flavors for proxy usage SSLProxyVerify level none skEType of remote server Certificate verification SSLProxyVerifyDepth number 1 skEMaximum depth of CA Certificates in Remote Server @@ -1302,15 +1311,15 @@ gerçekleÅŸmesi için sunucunun geçmesini bekleyeceÄŸi sü User unix-kullanıcısı #-1 sTÄ°steklere yanıt verecek sunucunun ait olacağı kullanıcıyı belirler. UserDir dizin [dizin] ...skTKullanıcıya özel dizinlerin yeri -VHostCGIMode On|Off|Secure On kDDetermines whether the virtualhost can run +VHostCGIMode On|Off|Secure On kKDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...kDAssign arbitrary privileges to subprocesses created +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...kKAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidkDSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...kDAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On kDDetermines whether the server runs with enhanced security +VHostGroup unix-groupidkKSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...kKAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On kKDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridkDSets the User ID under which a virtual host runs. +VHostUser unix-useridkKSets the User ID under which a virtual host runs. VirtualDocumentRoot hesaplanan-dizin|none none skEBir sanal konağın belge kök dizinini devingen olarak yapılandırır. VirtualDocumentRootIP hesaplanan-dizin|none none skEBir sanal konağın belge kök dizinini devingen olarak yapılandırır. diff --git a/docs/manual/mod/quickreference.html.zh-cn.utf8 b/docs/manual/mod/quickreference.html.zh-cn.utf8 index fb904577c2a..6d12b27beb2 100644 --- a/docs/manual/mod/quickreference.html.zh-cn.utf8 +++ b/docs/manual/mod/quickreference.html.zh-cn.utf8 @@ -118,7 +118,7 @@ type expressions AliasPreservePath OFF|ON OFF svdBMap the full path after the alias in a location. Allow from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts can access an area of the +[host|env=[!]env-variable] ...dhControls which hosts can access an area of the server AllowCONNECT port[-port] [port[-port]] ... | None 443 563 svEPorts that are allowed to CONNECT through the @@ -384,20 +384,20 @@ switch before dumping core CryptoIV value none svdhEIV (Initialization Vector) to be used by the crypto filter CryptoKey value none svdhEKey to be used by the crypto filter CryptoSize integer 131072 svdhEMaximum size in bytes to buffer by the crypto filter -CTAuditStorage directorysEExisting directory where data for off-line audit will be stored -CTLogClient executablesELocation of certificate-transparency log client tool -CTLogConfigDB filenamesELog configuration database supporting dynamic updates -CTMaxSCTAge num-secondssEMaximum age of SCT obtained from a log, before it will be +CTAuditStorage directorysExisting directory where data for off-line audit will be stored +CTLogClient executablesLocation of certificate-transparency log client tool +CTLogConfigDB filenamesLog configuration database supporting dynamic updates +CTMaxSCTAge num-secondssMaximum age of SCT obtained from a log, before it will be refreshed -CTProxyAwareness oblivious|aware|requiresvELevel of CT awareness and enforcement for a proxy +CTProxyAwareness oblivious|aware|requiresvLevel of CT awareness and enforcement for a proxy -CTSCTStorage directorysEExisting directory where SCTs are managed -CTServerHelloSCTLimit limitsELimit on number of SCTs that can be returned in +CTSCTStorage directorysExisting directory where SCTs are managed +CTServerHelloSCTLimit limitsLimit on number of SCTs that can be returned in ServerHello CTStaticLogConfig log-id|- public-key-file|- 1|0|- min-timestamp|- max-timestamp|- -log-URL|-sEStatic configuration of information about a log -CTStaticSCTs certificate-pem-file sct-directorysEStatic configuration of one or more SCTs for a server certificate +log-URL|-sStatic configuration of information about a log +CTStaticSCTs certificate-pem-file sct-directorysStatic configuration of one or more SCTs for a server certificate CustomLog file|pipe|provider format|nickname @@ -449,7 +449,7 @@ which no other media type configuration could be found. DeflateMemLevel value 9 svEHow much memory should be used by zlib for compression DeflateWindowSize value 15 svEZlib compression window size Deny from all|host|env=[!]env-variable -[host|env=[!]env-variable] ...dhEControls which hosts are denied access to the +[host|env=[!]env-variable] ...dhControls which hosts are denied access to the server <Directory directory-path> ... </Directory>svCEnclose a group of directives that apply only to the @@ -468,7 +468,7 @@ the contents of file-system directories matching a regular expression. DirectorySlash On|Off|NotFound On svdhBToggle trailing slash redirects on or off DocumentRoot directory-path "/usr/local/apache/ +svCDirectory that forms the main document tree visible from the web -DTracePrivileges On|Off Off sXDetermines whether the privileges required by dtrace are enabled. +DTracePrivileges On|Off Off sDetermines whether the privileges required by dtrace are enabled. DumpIOInput On|Off Off sEDump all input data to the error log DumpIOOutput On|Off Off sEDump all output data to the error log <Else> ... </Else>svdhCContains directives that apply only if the condition of a @@ -604,10 +604,10 @@ presence or absence of a specific module presence or absence of a specific section directive <IfVersion [[!]operator] version> ... </IfVersion>svdhEcontains version dependent configuration -ImapBase map|referer|URL http://servername/ svdhBDefault base for imagemap files -ImapDefault error|nocontent|map|referer|URL nocontent svdhBDefault action when an imagemap is called with coordinates +ImapBase map|referer|URL http://servername/ svdhDefault base for imagemap files +ImapDefault error|nocontent|map|referer|URL nocontent svdhDefault action when an imagemap is called with coordinates that are not explicitly mapped -ImapMenu none|formatted|semiformatted|unformatted formatted svdhBAction if no coordinates are given when calling +ImapMenu none|formatted|semiformatted|unformatted formatted svdhAction if no coordinates are given when calling an imagemap Include file-path|directory-path|wildcardsvdCIncludes other configuration files from within the server configuration files @@ -785,442 +785,451 @@ simultaneously MDDriveMode always|auto|manual auto sXformer name of MDRenewMode. MDExternalAccountBinding key-id hmac-64 | none | file none sXSet the external account binding keyid and hmac values to use at CA MDHttpProxy urlsXDefine a proxy for outgoing connections. -MDInitialDelay duration 0s sXHow long to delay the first certificate check. -MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts -MDMember hostnamesXAdditional hostname for the managed domain. -MDMembers auto|manual auto sXControl if the alias domain names are automatically added. -MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains -MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. -MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. -MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. -<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. -MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. -MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. -MDProfile namesXUse a specific ACME profile from the CA -MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. -MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. -MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). -MDRenewWindow duration 33% sXControl when a certificate will be renewed. -MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. -MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. -MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered -MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. -MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. -MDStapling on|off off sXEnable stapling for all or a particular MDomain. -MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. -MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. -MDStoreDir path md sXPath on the local file system to store the Managed Domains data. -MDStoreLocks on|off|duration off sXConfigure locking of store for updates -MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. -MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections -MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. +MDHttpProxyCACertificateFile path-to-pem-file none sXSets the root (CA) certificates to use for TLS connections to the http-proxy. +MDInitialDelay duration 0s sXHow long to delay the first certificate check. +MDMatchNames all|servernames all sXDetermines how DNS names are matched to vhosts +MDMember hostnamesXAdditional hostname for the managed domain. +MDMembers auto|manual auto sXControl if the alias domain names are automatically added. +MDMessageCmd path-to-cmd optional-argssXHandle events for Manage Domains +MDMustStaple on|off off sXControl if new certificates carry the OCSP Must Staple flag. +MDNotifyCmd path [ args ]sXRun a program when a Managed Domain is ready. +MDomain dns-name [ other-dns-name... ] [auto|manual]sXDefine list of domain names that belong to one group. +<MDomainSet dns-name [ other-dns-name... ]>...</MDomainSet>sXContainer for directives applied to the same managed domains. +MDPortMap map1 [ map2 ] http:80 https:443 sXMap external to internal ports for domain ownership verification. +MDPrivateKeys type [ params... ] RSA 2048 sXSet type and size of the private keys generated. +MDProfile namesXUse a specific ACME profile from the CA +MDProfileMandatory on|off off sXControl if an MDProfile is mandatory. +MDRenewMode always|auto|manual auto sXControls if certificates shall be renewed. +MDRenewViaARI on|off on sXusage of the ACME ARI extension (rfc9773). +MDRenewWindow duration 33% sXControl when a certificate will be renewed. +MDRequireHttps off|temporary|permanent off sXRedirects http: traffic to https: for Managed Domains. +MDRetryDelay duration 30s sXTime length for first retry, doubled on every consecutive error. +MDRetryFailover number 13 sXThe number of errors before a failover to another CA is triggered +MDServerStatus on|off off sXControl if Managed Domain information is added to server-status. +MDStapleOthers on|off on sXEnable stapling for certificates not managed by mod_md. +MDStapling on|off off sXEnable stapling for all or a particular MDomain. +MDStaplingKeepResponse duration 7d sXControls when old responses should be removed. +MDStaplingRenewWindow duration 33% sXControl when the stapling responses will be renewed. +MDStoreDir path md sXPath on the local file system to store the Managed Domains data. +MDStoreLocks on|off|duration off sXConfigure locking of store for updates +MDWarnWindow duration 10% sXDefine the time window when you want to be warned about an expiring certificate. +MemcacheConnTTL num[units] 15s svEKeepalive time for idle connections +MergeSlashes ON|OFF ON svCControls whether the server merges consecutive slashes in URLs. -MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers -MetaDir directory .web svdhEName of the directory to find CERN-style meta information +MergeTrailers [on|off] off svCDetermines whether trailers are merged into headers +MetaDir directory .web svdhName of the directory to find CERN-style meta information files -MetaFiles on|off off svdhEActivates CERN meta-file processing -MetaSuffix suffix .meta svdhEFile name suffix for the file containing CERN-style +MetaFiles on|off off svdhActivates CERN meta-file processing +MetaSuffix suffix .meta svdhFile name suffix for the file containing CERN-style meta information -MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection -MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents +MimeMagicDecompression On|Off Off svEEnable decompression of compressed files for MIME type detection +MimeMagicFile file-pathsvEEnable MIME-type determination based on file contents using the specified magic file -MimeOptions option [option] ...svdhBConfigures mod_mime behavior -MinSpareServers number 5 sMMinimum number of idle child server processes -MinSpareThreads numbersMMinimum number of idle threads available to handle request +MimeOptions option [option] ...svdhBConfigures mod_mime behavior +MinSpareServers number 5 sMMinimum number of idle child server processes +MinSpareThreads numbersMMinimum number of idle threads available to handle request spikes -MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time -ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate -ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info +MMapFile file-path [file-path] ...sXMap a list of files into memory at startup time +ModemStandard V.21|V.26bis|V.32|V.34|V.92dXModem standard to simulate +ModMimeUsePathInfo On|Off Off dBTells mod_mime to treat path_info components as part of the filename -MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers -[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for +MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers +[Handlers|Filters] NegotiatedOnly svdhBThe types of files that will be included when searching for a matching file with MultiViews -Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all +Mutex mechanism [default|mutex-name] ... [OmitPID] default sCConfigures mutex mechanism and lock file directory for all or specified mutexes -NameVirtualHost addr[:port]sCDEPRECATED: Designates an IP address for name-virtual +NameVirtualHost addr[:port]sCDEPRECATED: Designates an IP address for name-virtual hosting -NoProxy host [host] ...svEHosts, domains, or networks that will be connected to +NoProxy host [host] ...svEHosts, domains, or networks that will be connected to directly -NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates -NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request -Options - [+|-]option [[+|-]option] ... FollowSymlinks svdhCConfigures what features are available in a particular +NWSSLTrustedCerts filename [filename] ...sBList of additional client certificates +NWSSLUpgradeable [IP-address:]portnumbersBAllows a connection to be upgraded to an SSL connection upon request +Options + [+|-]option [[+|-]option] ... FollowSymlinks svdhCConfigures what features are available in a particular directory - Order ordering Deny,Allow dhEControls the default access state and the order in which + Order ordering Deny,Allow dhControls the default access state and the order in which Allow and Deny are evaluated. -OutputSed sed-commanddhXSed command for filtering response content -PassEnv env-variable [env-variable] -...svdhBPasses environment variables from the shell -PidFile filename httpd.pid sMFile where the server records the process ID +OutputSed sed-commanddhXSed command for filtering response content +PassEnv env-variable [env-variable] +...svdhBPasses environment variables from the shell +PidFile filename httpd.pid sMFile where the server records the process ID of the daemon -PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. -PolicyConditionalURL urlsvdEURL describing the conditional request policy. -PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. -PolicyFilter on|offsvdEEnable or disable policies for the given URL space. -PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. -PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. -PolicyLength ignore|log|enforcesvdEEnable the content length policy. -PolicyLengthURL urlsvdEURL describing the content length policy. -PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. -PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. -PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. -PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. -PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. -PolicyTypeURL urlsvdEURL describing the content type policy. -PolicyValidation ignore|log|enforcesvdEEnable the validation policy. -PolicyValidationURL urlsvdEURL describing the content type policy. -PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. -PolicyVaryURL urlsvdEURL describing the content type policy. -PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. -PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. -PollersPerChild number 0 sMNumber of poll threads per child process -PrivilegesMode FAST|SECURE|SELECTIVE FAST svdXTrade off processing speed and efficiency vs security against +PolicyConditional ignore|log|enforcesvdEEnable the conditional request policy. +PolicyConditionalURL urlsvdEURL describing the conditional request policy. +PolicyEnvironment variable log-value ignore-valuesvdEOverride policies based on an environment variable. +PolicyFilter on|offsvdEEnable or disable policies for the given URL space. +PolicyKeepalive ignore|log|enforcesvdEEnable the keepalive policy. +PolicyKeepaliveURL urlsvdEURL describing the keepalive policy. +PolicyLength ignore|log|enforcesvdEEnable the content length policy. +PolicyLengthURL urlsvdEURL describing the content length policy. +PolicyMaxage ignore|log|enforce agesvdEEnable the caching minimum max-age policy. +PolicyMaxageURL urlsvdEURL describing the caching minimum freshness lifetime policy. +PolicyNocache ignore|log|enforcesvdEEnable the caching no-cache policy. +PolicyNocacheURL urlsvdEURL describing the caching no-cache policy. +PolicyType ignore|log|enforce type [ type [ ... ]]svdEEnable the content type policy. +PolicyTypeURL urlsvdEURL describing the content type policy. +PolicyValidation ignore|log|enforcesvdEEnable the validation policy. +PolicyValidationURL urlsvdEURL describing the content type policy. +PolicyVary ignore|log|enforce header [ header [ ... ]]svdEEnable the Vary policy. +PolicyVaryURL urlsvdEURL describing the content type policy. +PolicyVersion ignore|log|enforce HTTP/0.9|HTTP/1.0|HTTP/1.1svdEEnable the version policy. +PolicyVersionURL urlsvdEURL describing the minimum request HTTP version policy. +PollersPerChild number 0 sMNumber of poll threads per child process +PrivilegesMode FAST|SECURE|SELECTIVE FAST svdTrade off processing speed and efficiency vs security against malicious privileges-aware code. -Protocol protocolsvCProtocol for a listening socket -ProtocolEcho On|Off Off svXTurn the echo server on or off -Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host -ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation -<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources -Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server -ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers -ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the +Protocol protocolsvCProtocol for a listening socket +ProtocolEcho On|Off Off svXTurn the echo server on or off +Protocols protocol ... http/1.1 svCProtocols available for a server/virtual host +ProtocolsHonorOrder On|Off On svCDetermines if order of Protocols determines precedence during negotiation +<Proxy wildcard-url> ...</Proxy>svEContainer for directives applied to proxied resources +Proxy100Continue Off|On On svdEForward 100-continue expectation to the origin server +ProxyAddHeaders Off|On On svdEAdd proxy information in X-Forwarded-* headers +ProxyAsyncDelay time[s]svdETime to poll synchronously before handing a connection to the MPM for asynchronous processing -ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections -ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a +ProxyAsyncIdleTimeout time[s]svdEInactivity timeout for asynchronous proxy connections +ProxyBadHeader IsError|Ignore|StartBody IsError svEDetermines how to handle bad header lines in a response -ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its +ProxyBeaconAddress address:portsvEAddress of the reverse proxy to which a backend sends its announcements -ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy -ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to -ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement -ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend +ProxyBeaconAdvertise urlsvEThe routable URL a backend announces to the reverse proxy +ProxyBeaconBalancer namesvEName of the balancer that announced backends are added to +ProxyBeaconInterval interval 5 svEHow often a backend publishes its announcement +ProxyBeaconListen [address][:port]svEAddress on which the reverse proxy receives backend beacons -ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement -ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements -ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend +ProxyBeaconMaxSkew intervalsvEMaximum allowed age of a signed announcement +ProxyBeaconSecret secretsvEPre-shared secret used to authenticate announcements +ProxyBeaconTimeout interval 0 svEHow long the proxy waits, without an announcement, before a backend is taken out of rotation -ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts -ProxyDomain DomainsvEDefault domain name for proxied requests -ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content -ProxyExpressDBMFile pathnamesvEPathname to DBM file. -ProxyExpressDBMType type default svEDBM type of file. -ProxyExpressEnable on|off off svEEnable the module functionality. -ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application -ProxyFCGISetEnvIf conditional-expression +ProxyBlock *|hostname|partial-hostname [hostname|partial-hostname]...svEDisallow proxy requests to certain hosts +ProxyDomain DomainsvEDefault domain name for proxied requests +ProxyErrorOverride Off|On [code ...] Off svdEOverride error pages for proxied content +ProxyExpressDBMFile pathnamesvEPathname to DBM file. +ProxyExpressDBMType type default svEDBM type of file. +ProxyExpressEnable on|off off svEEnable the module functionality. +ProxyFCGIBackendType FPM|GENERIC FPM svdhESpecify the type of backend FastCGI application +ProxyFCGISetEnvIf conditional-expression [!]environment-variable-name - [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up -ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings -ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server -ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing -ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response -ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters -ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers -ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and + [value-expression]svdhEAllow variables sent to FastCGI servers to be fixed up +ProxyFtpDirCharset character_set ISO-8859-1 svdEDefine the character set for proxied FTP listings +ProxyFtpEscapeWildcards on|off on svdEWhether wildcards in requested filenames are escaped when sent to the FTP server +ProxyFtpListOnWildcard on|off on svdEWhether wildcards in requested filenames trigger a file listing +ProxyHCExpr name {ap_expr expression}svECreates a named condition expression to use to determine health of the backend based on its response +ProxyHCTemplate name parameter=setting [...]svECreates a named template for setting various health check parameters +ProxyHCTPsize size 16 sESets the total server-wide size of the threadpool used for the health check workers +ProxyHTMLBufSize bytes 8192 svdBSets the buffer size increment for buffering inline scripts and stylesheets. -ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. -ProxyHTMLDocType HTML|XHTML [Legacy]
OR +ProxyHTMLCharsetOut Charset | * UTF-8 svdBSpecify a charset for mod_proxy_html output. +ProxyHTMLDocType HTML|XHTML [Legacy]
OR
ProxyHTMLDocType fpi [SGML|XML]
OR
ProxyHTMLDocType html5
OR -
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. -ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. -ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. -ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, +
ProxyHTMLDocType auto auto (2.5/trunk ver +svdBSets an HTML or XHTML document type declaration. +ProxyHTMLEnable On|Off Off svdBTurns the proxy_html filter on or off. +ProxyHTMLEvents attribute [attribute ...]svdBSpecify attributes to treat as scripting events. +ProxyHTMLExtended On|Off Off svdBDetermines whether to fix links in inline scripts, stylesheets, and scripting events. -ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. -ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of +ProxyHTMLFixups [lowercase] [dospath] [reset] none svdBFixes for simple HTML errors. +ProxyHTMLInterp On|Off Off svdBEnables per-request interpolation of ProxyHTMLURLMap rules. -ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. -ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML +ProxyHTMLLinks element attribute [attribute2 ...]svdBSpecify HTML elements that have URL attributes to be rewritten. +ProxyHTMLMeta On|Off Off svdBTurns on or off extra pre-parsing of metadata in HTML <head> sections. -ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. -ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links -ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer -<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched +ProxyHTMLStripComments On|Off Off svdBDetermines whether to strip HTML comments. +ProxyHTMLURLMap from-pattern to-pattern [flags] [cond]svdBDefines a rule to rewrite HTML links +ProxyIOBufferSize bytes 8192 svEDetermine size of internal data throughput buffer +<ProxyMatch regex> ...</ProxyMatch>svEContainer for directives applied to regular-expression-matched proxied resources -ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded +ProxyMaxForwards number -1 svEMaximum number of proxies that a request can be forwarded through -ProxyPass [path] !|url [key=value - [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space -ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server -ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations -ProxyPassMatch [regex] !|url [key=value - [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions -ProxyPassReverse [path] url -[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse +ProxyPass [path] !|url [key=value + [key=value ...]] [nocanon] [interpolate] [noquery]svdEMaps remote servers into the local server URL-space +ProxyPassInherit On|Off On svEInherit ProxyPass directives defined from the main server +ProxyPassInterpolateEnv On|Off Off svdEEnable Environment Variable interpolation in Reverse Proxy configurations +ProxyPassMatch [regex] !|url [key=value + [key=value ...]]svdEMaps remote servers into the local server URL-space using regular expressions +ProxyPassReverse [path] url +[interpolate]svdEAdjusts the URL in HTTP response headers sent from a reverse proxied server -ProxyPassReverseCookieDomain internal-domain -public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- +ProxyPassReverseCookieDomain internal-domain +public-domain [interpolate]svdEAdjusts the Domain string in Set-Cookie headers from a reverse- proxied server -ProxyPassReverseCookiePath internal-path -public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- +ProxyPassReverseCookiePath internal-path +public-path [interpolate]svdEAdjusts the Path string in Set-Cookie headers from a reverse- proxied server -ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy +ProxyPreserveHost On|Off Off svdEUse incoming Host HTTP request header for proxy request -ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP +ProxyReceiveBufferSize bytes 0 svENetwork buffer size for proxied HTTP and FTP connections -ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests -ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular +ProxyRemote match remote-server [username:password]svERemote proxy used to handle certain requests +ProxyRemoteMatch regex remote-server [username:password]svERemote proxy used to handle requests matched by regular expressions -ProxyRequests On|Off Off svEEnables forward (standard) proxy requests -ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the +ProxyRequests On|Off Off svEEnables forward (standard) proxy requests +ProxySCGIInternalRedirect On|Off|Headername On svdEEnable or disable internal redirect responses from the backend -ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response +ProxySCGISendfile On|Off|Headername Off svdEEnable evaluation of X-Sendfile pseudo response header -ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters -ProxySourceAddress addresssvESet local IP address for outgoing proxy connections -ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status -ProxyTimeout time-interval[s]svENetwork timeout for proxied requests -ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response +ProxySet url key=value [key=value ...]svdESet various Proxy balancer or member parameters +ProxySourceAddress addresssvESet local IP address for outgoing proxy connections +ProxyStatus Off|On|Full Off svEShow Proxy LoadBalancer status in mod_status +ProxyTimeout time-interval[s]svENetwork timeout for proxied requests +ProxyVia On|Off|Full|Block Off svEInformation provided in the Via HTTP response header for proxied requests -ProxyWebsocketAsync ON|OFFsvEInstructs this module to try to create an asynchronous tunnel -ProxyWebsocketAsyncDelay num[ms] 0 svESets the amount of time the tunnel waits synchronously for data -ProxyWebsocketFallbackToProxyHttp On|Off On svEInstructs this module to let mod_proxy_http handle the request -ProxyWebsocketIdleTimeout num[ms] 0 svESets the maximum amount of time to wait for data on the websockets tunnel -QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is +ProxyWebsocketAsync ON|OFFsvInstructs this module to try to create an asynchronous tunnel +ProxyWebsocketAsyncDelay num[ms] 0 svSets the amount of time the tunnel waits synchronously for data +ProxyWebsocketFallbackToProxyHttp On|Off On svInstructs this module to let mod_proxy_http handle the request +ProxyWebsocketIdleTimeout num[ms] 0 svSets the maximum amount of time to wait for data on the websockets tunnel +QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is fully qualified -ReadBufferSize bytes 8192 svdCSize of the buffers used to read data -ReadmeName filenamesvdhBName of the file that will be inserted at the end +ReadBufferSize bytes 8192 svdCSize of the buffers used to read data +ReadmeName filenamesvdhBName of the file that will be inserted at the end of the index listing -ReceiveBufferSize bytes 0 sMTCP receive buffer size -Redirect [status] [URL-path] -URLsvdhBSends an external redirect asking the client to fetch +ReceiveBufferSize bytes 0 sMTCP receive buffer size +Redirect [status] [URL-path] +URLsvdhBSends an external redirect asking the client to fetch a different URL -RedirectMatch [status] regex -URLsvdhBSends an external redirect based on a regular expression match +RedirectMatch [status] regex +URLsvdhBSends an external redirect based on a regular expression match of the current URL -RedirectPermanent URL-path URLsvdhBSends an external permanent redirect asking the client to fetch +RedirectPermanent URL-path URLsvdhBSends an external permanent redirect asking the client to fetch a different URL -RedirectRelative On|Off Off svdBAllows relative redirect targets. -RedirectTemp URL-path URLsvdhBSends an external temporary redirect asking the client to fetch +RedirectRelative On|Off Off svdBAllows relative redirect targets. +RedirectTemp URL-path URLsvdhBSends an external temporary redirect asking the client to fetch a different URL -RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) -RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) -ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers -RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes -RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods -RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses -RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses -RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling -RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks -RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoveCharset extension [extension] -...vdhBRemoves any character set associations for a set of file +RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) +RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) +ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers +RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes +RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods +RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses +RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses +RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling +RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks +RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoveCharset extension [extension] +...vdhBRemoves any character set associations for a set of file extensions -RemoveEncoding extension [extension] -...vdhBRemoves any content encoding associations for a set of file +RemoveEncoding extension [extension] +...vdhBRemoves any content encoding associations for a set of file extensions -RemoveHandler extension [extension] -...vdhBRemoves any handler associations for a set of file +RemoveHandler extension [extension] +...vdhBRemoves any handler associations for a set of file extensions -RemoveInputFilter extension [extension] -...vdhBRemoves any input filter associations for a set of file +RemoveInputFilter extension [extension] +...vdhBRemoves any input filter associations for a set of file extensions -RemoveLanguage extension [extension] -...vdhBRemoves any language associations for a set of file +RemoveLanguage extension [extension] +...vdhBRemoves any language associations for a set of file extensions -RemoveOutputFilter extension [extension] -...vdhBRemoves any output filter associations for a set of file +RemoveOutputFilter extension [extension] +...vdhBRemoves any output filter associations for a set of file extensions -RemoveType extension [extension] -...vdhBRemoves any content type associations for a set of file +RemoveType extension [extension] +...vdhBRemoves any content type associations for a set of file extensions -RequestHeader add|append|edit|edit*|merge|set|setifempty|unset +RequestHeader add|append|edit|edit*|merge|set|setifempty|unset header [[expr=]value [replacement] [early|env=[!]varname|expr=expression]] -svdhEConfigure HTTP request headers -RequestReadTimeout +svdhEConfigure HTTP request headers +RequestReadTimeout [handshake=timeout[-maxtimeout][,MinRate=rate] [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate] - handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving + handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving the request headers and/or body from client. -Require [not] entity-name - [entity-name] ...dhBTests whether an authenticated user is authorized by +Require [not] entity-name + [entity-name] ...dhBTests whether an authenticated user is authorized by an authorization provider. -<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none +<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none must fail and at least one must succeed for the enclosing directive to succeed. -<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one +<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one must succeed for the enclosing directive to succeed. -<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none +<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none must succeed for the enclosing directive to not fail. -RewriteBase URL-pathdhESets the base URL for per-directory rewrites - RewriteCond - TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place +RewriteBase URL-pathdhESets the base URL for per-directory rewrites + RewriteCond + TestString [!]CondPattern [flags]svdhEDefines a condition under which rewriting will take place -RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine -RewriteMap MapName MapType:MapSource +RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine +RewriteMap MapName MapType:MapSource [MapTypeOptions] -svEDefines a mapping function for key-lookup -RewriteOptions OptionssvdhESets some special options for the rewrite engine -RewriteRule - [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine -RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched +svEDefines a mapping function for key-lookup +RewriteOptions OptionssvdhESets some special options for the rewrite engine +RewriteRule + [!]Pattern Substitution [flags]svdhEDefines rules for the rewriting engine +RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched by Apache httpd children -RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched +RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched by Apache httpd children -RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by +RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by processes launched by Apache httpd children -Satisfy Any|All All dhEInteraction between host-level access control and +Satisfy Any|All All dhInteraction between host-level access control and user authentication -ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for +ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for the child processes -Script method cgi-scriptsvdBActivates a CGI script for a particular request +Script method cgi-scriptsvdBActivates a CGI script for a particular request method. -ScriptAlias [URL-path] -file-path|directory-pathsvdBMaps a URL to a filesystem location and designates the +ScriptAlias [URL-path] +file-path|directory-pathsvdBMaps a URL to a filesystem location and designates the target as a CGI script -ScriptAliasMatch regex -file-path|directory-pathsvBMaps a URL to a filesystem location using a regular expression +ScriptAliasMatch regex +file-path|directory-pathsvBMaps a URL to a filesystem location using a regular expression and designates the target as a CGI script -ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI +ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI scripts -ScriptLog file-pathsvBLocation of the CGI script error logfile -ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded +ScriptLog file-pathsvBLocation of the CGI script error logfile +ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded in the scriptlog -ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile -ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with +ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile +ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with the cgi daemon -SecureListen [IP-address:]portnumber -Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port -SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters +SecureListen [IP-address:]portnumber +Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port +SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters of a request or the last 63, assuming the request itself is greater than 63 chars. -SendBufferSize bytes 0 sMTCP buffer size -ServerAdmin email-address|URLsvCEmail address that the server includes in error +SendBufferSize bytes 0 sMTCP buffer size +ServerAdmin email-address|URLsvCEmail address that the server includes in error messages sent to the client -ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests +ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests to name-virtual hosts -ServerLimit numbersMUpper limit on configurable number of processes -ServerName [scheme://]domain-name|ip-address[:port]svCHostname and port that the server uses to identify +ServerLimit numbersMUpper limit on configurable number of processes +ServerName [scheme://]domain-name|ip-address[:port]svCHostname and port that the server uses to identify itself -ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that +ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that is accessed by an incompatible browser -ServerRoot directory-path /usr/local/apache sCBase directory for the server installation -ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents -ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response +ServerRoot directory-path /usr/local/apache sCBase directory for the server installation +ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents +ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response header -Session On|Off Off svdhEEnables a session for the current directory or location -SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client -SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session -SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session -SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers -SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session -SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session -SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session -SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session -SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID -SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID -SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers -SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database -SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database -SessionDBDPerUser On|Off Off svdhEEnable a per user session -SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database -SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database -SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the +Session On|Off Off svdhEEnables a session for the current directory or location +SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client +SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session +SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session +SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers +SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session +SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session +SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session +SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session +SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID +SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID +SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers +SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database +SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database +SessionDBDPerUser On|Off Off svdhEEnable a per user session +SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database +SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database +SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the HTTP_SESSION environment variable -SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored -SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without +SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored +SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without the session being updated -SessionHeader headersvdhEImport session updates from a given HTTP response header -SessionInclude pathsvdhEDefine URL prefixes for which a session is valid -SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session -SetEnv env-variable [value]svdhBSets environment variables -SetEnvIf attribute +SessionHeader headersvdhEImport session updates from a given HTTP response header +SessionInclude pathsvdhEDefine URL prefixes for which a session is valid +SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session +SetEnv env-variable [value]svdhBSets environment variables +SetEnvIf attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request -SetEnvIfExpr expr +SetEnvIfExpr expr [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression -SetEnvIfNoCase attribute regex + [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression +SetEnvIfNoCase attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request without respect to case -SetHandler handler-name|none|expressionsvdhCForces all matching files to be processed by a +SetHandler handler-name|none|expressionsvdhCForces all matching files to be processed by a handler -SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST +SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST input -SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the +SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the server -SSIEndTag tag "-->" svBString that ends an include element -SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI +SSIEndTag tag "-->" svBString that ends an include element +SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI error -SSIETag on|off off dhBControls whether ETags are generated by the server. -SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the +SSIETag on|off off dhBControls whether ETags are generated by the server. +SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the server. -SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. -SSIStartTag tag "<!--#" svBString that starts an include element -SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are +SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. +SSIStartTag tag "<!--#" svBString that starts an include element +SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are displayed -SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed -SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed +SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Client Auth -SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Client Auth +SSLCACertificateURI urisvEServer CA certificate store for Client Authentication SSLCADNRequestFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for defining acceptable CA names SSLCADNRequestPath directory-pathsvEDirectory of PEM-encoded CA Certificates for defining acceptable CA names -SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking -SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for +SSLCADNRequestURI urisvEcertificate store of CA Certificates for defining +acceptable CA names +SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking +SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Client Auth -SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for +SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Client Auth +SSLCARevocationURI urisvEServer CA certificate revocation list store for Client Authentication SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file -SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL +SSLCertificateURI urisvEServer certificate and key store +SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL handshake -SSLClientHelloVars on|off off svEEnable collection of ClientHello variables -SSLCompression on|off off svEEnable compression on the SSL level -SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator -SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory -SSLEngine on|off off svESSL Engine Operation Switch -SSLFIPS on|off off sESSL FIPS mode Switch -SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order -SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation -SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain -SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification -SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation -SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests -SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates -SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries -SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses -SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation -SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries -SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API -SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLClientHelloVars on|off off svEEnable collection of ClientHello variables +SSLCompression on|off off svEEnable compression on the SSL level +SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator +SSLECHKeyDir dirnamesELoad the set of Encrypted Client Hello (ECH) PEM files in the named directory +SSLEngine on|off off svESSL Engine Operation Switch +SSLFIPS on|off off sESSL FIPS mode Switch +SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order +SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation +SSLOCSPEnable on|leaf|off [flags] off svEEnable OCSP validation of the client certificate chain +SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification +SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation +SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests +SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates +SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries +SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses +SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation +SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries +SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API +SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLPolicy namesvEApply a SSLPolicy by name -SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions -SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSLPolicy namesvEApply a SSLPolicy by name +SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions +SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Remote Server Auth +SSLProxyCACertificateURI urisvEProxy CA certificate store for Remote Server Auth SSLProxyCARevocationCheck chain|leaf|none none svEEnable CRL-based revocation checking for Remote Server Auth SSLProxyCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth SSLProxyCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificate's CN field +SSLProxyCARevocationURI urisvEProxy CA certificate revocation list store for Remote Server Auth +SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificate's CN field -SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired +SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired -SSLProxyCheckPeerName on|off on svEConfigure host name checking for remote server certificates +SSLProxyCheckPeerName on|off on svEConfigure host name checking for remote server certificates -SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svECipher Suite available for negotiation in SSL +SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateChainFile filenamesvEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate -SSLProxyMachineCertificateFile filenamesvEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directorysvEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateChainFile filenamesvEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate +SSLProxyMachineCertificateFile filenamesvEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysvEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificateURI urisvEProxy certificate and key stores SSLProxyProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL protocol flavors for proxy usage SSLProxyVerify level none svEType of remote server Certificate verification SSLProxyVerifyDepth number 1 svEMaximum depth of CA Certificates in Remote Server @@ -1294,15 +1303,15 @@ port requests UserDir directory-filename [directory-filename] ... svBLocation of the user-specific directories -VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run +VHostCGIMode On|Off|Secure On vDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On vXDetermines whether the server runs with enhanced security +VHostGroup unix-groupidvSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On vDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridvXSets the User ID under which a virtual host runs. +VHostUser unix-useridvSets the User ID under which a virtual host runs. VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root diff --git a/docs/manual/rewrite/flags.html.en.utf8 b/docs/manual/rewrite/flags.html.en.utf8 index 375ae4e7157..6fb30844590 100644 --- a/docs/manual/rewrite/flags.html.en.utf8 +++ b/docs/manual/rewrite/flags.html.en.utf8 @@ -38,6 +38,7 @@ providing detailed explanations and examples.

top
+
+

Flag Quick Reference

+ +

Flags can be combined: [R=301,L], [P,QSA], +[E=VAR:val,L]. This table groups them by purpose, ordered +by how commonly each is used.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FlagPurposeEffectCommon combos
Flow Control
[L]Last ruleStop processing rules (this pass)[R=301,L] [F] [G]
[END]Full stopStop all rewrite processing (no re-entry in .htaccess)[R=301,END]
[S=N]SkipSkip next N rules (if/else logic)
[N]Next (loop)Restart ruleset from the top (caution: loop risk)
[C]ChainTie rule to the next; if this fails, skip chained rules
Redirection and Proxying
[R=code]RedirectExternal redirect (default 302). Consider Redirect/RedirectMatch for simple cases[R=301,L] [R=302,L]
[P]ProxyReverse proxy to target (requires mod_proxy)[P,QSA]
Access Control
[F]ForbiddenReturn 403 (implies [L])
[G]GoneReturn 410 (implies [L])
URL / Query String
[QSA]Query string appendAppend original query string to substitution[QSA,L] [P,QSA]
[QSD]Query string discardDrop original query string entirely[R=301,QSD,L]
[B]Escape backrefsRe-encode special chars in backreferences[B,PT]
[NE]No escapeDon't escape special chars in output (pass #, ? through)[R=301,NE,L]
Metadata and Handlers
[E]Set env varSet an environment variable[E=VAR:val,L]
[T]MIME typeForce content type
[H]HandlerForce a content handler
[PT]Pass throughPass result to next handler (needed with Alias/ScriptAlias)[PT,L]
Cookie
[CO]Set cookieSet an HTTP cookie on the response[CO=name:val:.domain,R=302,L]
+
top

B (escape backreferences)

@@ -226,6 +357,13 @@ follows:

[CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly:samesite]

+
+

Security Warning

+

Exercise care when constructing the argument from backreferences or other +variable expansion. If any part of the argument is derived from user input, +a malicious request may include delimeters or other unexpected values.

+
+

If a literal ':' character is needed in any of the cookie fields, an alternate syntax is available. To opt-in to the alternate syntax, the cookie "Name" should be preceded with a ';' character, and field separators should be diff --git a/docs/manual/rewrite/intro.html.en.utf8 b/docs/manual/rewrite/intro.html.en.utf8 index bb91a9c3a78..acc48dbcdd6 100644 --- a/docs/manual/rewrite/intro.html.en.utf8 +++ b/docs/manual/rewrite/intro.html.en.utf8 @@ -76,6 +76,14 @@ can give an overwhelming amount of information, it is indispensable in debugging problems with mod_rewrite configuration, since it will tell you exactly how each rule is processed.

+

+ Simplified flowchart of mod_rewrite processing: request arrives, check RewriteEngine On, iterate rules in order, test pattern match and RewriteCond, apply substitution if both pass, stop if L or END flag is set, otherwise continue to next rule
+ Figure: Simplified overview of how + mod_rewrite processes a request. See + Technical Details for the full + processing model including phases, flags, and looping. +

+
top

Regular Expressions

@@ -215,7 +223,7 @@ pattern does not match.

- Flow of RewriteRule and RewriteCond matching
+ Diagram showing how backreferences flow between RewriteRule and RewriteCond: $1-$9 capture groups from the RewriteRule pattern, %1-%9 capture groups from the most recent RewriteCond TestString pattern, both available in the substitution string and in subsequent RewriteCond TestStrings
Figure 1: The back-reference flow through a rule.
In this example, a request for /test/1234 to host admin.example.com would be transformed into /admin.foo?page=test&id=1234&host=admin.example.com, provided that %{DOCUMENT_ROOT}/test is not an existing file.

@@ -263,7 +271,7 @@ content, handle that in your application logic or use a module such as mod_request paired with a custom filter.

- Syntax of the RewriteRule directive
+ Annotated syntax diagram of the RewriteRule directive showing three components: Pattern (regex matched against the URL-path), Substitution (the replacement URL or path), and optional Flags in square brackets
Figure 2: Syntax of the RewriteRule directive.

@@ -344,7 +352,7 @@ expression that must match the variable, and a third optional argument is a list of flags that modify how the match is evaluated.

- Syntax of the RewriteCond directive
+ Annotated syntax diagram of the RewriteCond directive showing two components: TestString (variable or text to test) and CondPattern (regex or comparison to evaluate), with optional flags in square brackets
Figure 3: Syntax of the RewriteCond directive

diff --git a/docs/manual/rewrite/tech.html.en.utf8 b/docs/manual/rewrite/tech.html.en.utf8 index f41417a55bd..e71efcb2b37 100644 --- a/docs/manual/rewrite/tech.html.en.utf8 +++ b/docs/manual/rewrite/tech.html.en.utf8 @@ -101,6 +101,11 @@ and URL matching.

the URL-path (or returns a redirect), Redirect never sees the request.

+

+ Side-by-side comparison of module processing order: in server context, mod_rewrite runs first in the URL-to-filename phase then mod_alias runs second; in per-directory context, mod_alias runs first in the URL-to-filename phase, then mod_rewrite runs later in the Fixup phase
+ Figure: Module processing order reversal between server and per-directory context +

+ 
# In this configuration, the Redirect is never reached for /old
 # because the RewriteRule matches first — even though
 # the Redirect appears earlier in the file.
@@ -226,7 +231,7 @@ RewriteRule "^/horses/ponies$" "/special-handler" [L]
first, and so the control flow is a little bit long-winded. See Figure 2 for more details.

- Flow of RewriteRule and RewriteCond matching
+ Flowchart showing per-rule control flow: for each rule, check pattern against URL, evaluate RewriteCond conditions, apply substitution if both pass, then check flags to decide whether to stop or continue to the next rule
Figure 2:The control flow through the rewriting ruleset

First the URL is matched against the From 97ee15893e27fde2a0940d1c7099eb88cfe1a702 Mon Sep 17 00:00:00 2001 From: Giovanni Bechis Date: Wed, 5 Aug 2026 09:00:00 +0000 Subject: [PATCH 39/50] OpenBSD doesn't support connect() to INADDR_ANY and returns EINVAL (22), fallback to 127.0.0.1 if lp->bind_addr is INADDR_ANY and that connect() fails with EINVAL bz #69857 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936893 13f79535-47bb-0310-9956-ffa450edef68 --- server/mpm_unix.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/server/mpm_unix.c b/server/mpm_unix.c index ed4555ad0b4..416f3f22d67 100644 --- a/server/mpm_unix.c +++ b/server/mpm_unix.c @@ -674,6 +674,34 @@ static apr_status_t dummy_connection(ap_pod_t *pod) } rv = apr_socket_connect(sock, lp->bind_addr); +#ifdef __OpenBSD__ + /* OpenBSD's connect() returns EINVAL when the target address is the + * wildcard address (INADDR_ANY / IN6ADDR_ANY), + * Retry against the loopback address in that case. */ + if (rv != APR_SUCCESS && APR_STATUS_IS_EINVAL(rv)) { + int is_wildcard = 0; + + if (lp->bind_addr->family == APR_INET) { + is_wildcard = (lp->bind_addr->sa.sin.sin_addr.s_addr == INADDR_ANY); + } +#if APR_HAVE_IPV6 + else if (lp->bind_addr->family == APR_INET6) { + is_wildcard = IN6_IS_ADDR_UNSPECIFIED(&lp->bind_addr->sa.sin6.sin6_addr); + } +#endif + + if (is_wildcard) { + apr_sockaddr_t *loopback; + const char *ip = (lp->bind_addr->family == APR_INET6) ? "::1" : "127.0.0.1"; + + rv = apr_sockaddr_info_get(&loopback, ip, lp->bind_addr->family, + lp->bind_addr->port, 0, p); + if (rv == APR_SUCCESS) { + rv = apr_socket_connect(sock, loopback); + } + } + } +#endif /* __OpenBSD__ */ if (rv != APR_SUCCESS) { int log_level = APLOG_WARNING; From e2034851a2d2741af7a8270604db44683148c013 Mon Sep 17 00:00:00 2001 From: Graham Leggett Date: Thu, 6 Aug 2026 11:01:29 +0000 Subject: [PATCH 40/50] mod_ssl: Rename URI directives to follow the pattern SSLStoreURI and SSLTrustURI. Move CRL functionality from a dedicated directive into SSLTrustURI. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936908 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_ssl.xml | 152 ++++++++----------------- modules/ssl/mod_ssl.c | 18 +-- modules/ssl/ssl_engine_config.c | 82 +++++--------- modules/ssl/ssl_engine_init.c | 193 +++++++++++--------------------- modules/ssl/ssl_private.h | 19 ++-- 5 files changed, 156 insertions(+), 308 deletions(-) diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index 37df8d1c7c5..e4008ad9e37 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -1168,9 +1168,9 @@ effect.

-SSLCertificateURI +SSLStoreURI Server certificate and key store -SSLCertificateURI uri +SSLStoreURI uri server config virtual host Available in httpd 2.5.1 and later, when linked with @@ -1224,11 +1224,11 @@ at startup time.

Example # Example using a PEM-encoded file. -SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.crt" +SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.crt" # Example using a PKCS12 file. -SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.p12" +SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.p12" # Example use of a certificate and private key from a PKCS#11 token: -SSLCertificateURI "pkcs11:token=My%20Token%20Name;id=45" +SSLStoreURI "pkcs11:token=My%20Token%20Name;id=45" @@ -1238,12 +1238,12 @@ and readable only by root. The URI is not re-read during normal operation; a server restart is required for changes to take effect.

-Using SSLCertificateFile and SSLCertificateURI +<note type="warning"><title>Using SSLCertificateFile and SSLStoreURI together

-You can use both SSLCertificateFile and SSLCertificateURI together, however +You can use both SSLCertificateFile and SSLStoreURI together, however there is no overlap between the mechanisms. A certificate defined by -SSLCertificateFile will not be matched with a key from SSLCertificateURI. +SSLCertificateFile will not be matched with a key from SSLStoreURI.

@@ -1316,9 +1316,9 @@ effect.

 -SSLCACertificateURI +SSLTrustURI Server CA certificate store for Client Authentication -SSLCACertificateURI uri +SSLTrustURI uri server config virtual host AuthConfig @@ -1327,22 +1327,27 @@ OpenSSL v3 or later.

-This directive sets the all-in-one URI where you can assemble the -Certificates of Certification Authorities (CA) whose clients you deal -with. These are used for Client Authentication. This can be used alternatively -and/or additionally to SSLCACertificateFile +This directive sets URIs where you can assemble the Certificates of Certification +Authorities (CA) whose clients you deal with. These are used for Client +Authentication. This can be used alternatively and/or additionally to +SSLCACertificateFile or SSLCACertificatePath.

Example # trust certs in a PEM encoded certificate bundle -SSLCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt" +SSLTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt" # trust all certs in a typical Linux machine -SSLCACertificateURI "pkcs11:token=System%20Trust" +SSLTrustURI "pkcs11:token=System%20Trust" # trust all certs in the Windows trust store -SSLCACertificateURI "org.openssl.winstore:" +SSLTrustURI "org.openssl.winstore:" +

+This directive will also read in Certificate Revocation Lists (CRL) of +Certification Authorities (CAs) whose clients you deal with. These are used +to revoke the client certificate on Client Authentication.

+

This URI is read at server startup, while the server is still running as root (before privilege dropping), so it may be owned by and readable only by root. The URI is not re-read during @@ -1369,12 +1374,12 @@ available.

If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLCADNRequestURI are given, then the +module="mod_ssl">SSLTrustRequestURI are given, then the set of acceptable CA names sent to the client is the names of all the CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLCACertificateURI directives; in other +module="mod_ssl">SSLTrustURI directives; in other words, the names of the CAs which will actually be used to verify the client certificate.

@@ -1384,7 +1389,7 @@ the client certificate - for example, if the client certificates are signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLCADNRequestURI can be used; the +module="mod_ssl">SSLTrustRequestURI can be used; the acceptable CA names are then taken from the complete set of certificates in the directory and/or file specified by this pair of directives.

@@ -1443,10 +1448,10 @@ to take effect.

 -SSLCADNRequestURI +SSLTrustRequestURI certificate store of CA Certificates for defining acceptable CA names -SSLCADNRequestURI uri +SSLTrustRequestURI uri server config virtual host @@ -1460,12 +1465,12 @@ available.

If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLCADNRequestURI are given, then the +module="mod_ssl">SSLTrustRequestURI are given, then the set of acceptable CA names sent to the client is the names of all the CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLCACertificateURI directives; in other +module="mod_ssl">SSLTrustURI directives; in other words, the names of the CAs which will actually be used to verify the client certificate.

@@ -1475,18 +1480,18 @@ the client certificate - for example, if the client certificates are signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLCADNRequestURI can be used; the +module="mod_ssl">SSLTrustRequestURI can be used; the acceptable CA names are then taken from the complete set of certificates in the directory and/or file specified by this pair of directives.

-

SSLCADNRequestURI must +

SSLTrustRequestURI must specify an all-in-one certificate store uri containing a set of CA certificates.

Example -SSLCADNRequestURI "file:///usr/local/apache2/conf/ca-names.crt" +SSLTrustRequestURI "file:///usr/local/apache2/conf/ca-names.crt" @@ -1570,44 +1575,6 @@ effect.

 - -SSLCARevocationURI -Server CA certificate revocation list store for Client Authentication -SSLCARevocationURI uri -server config -virtual host - - -

-This directive sets the all-in-one file where you can -assemble the Certificate Revocation Lists (CRL) of Certification -Authorities (CA) whose clients you deal with. These are used -for Client Authentication. This can be used alternatively and/or -additionally to SSLCARevocationFile and SSLCARevocationPath.

-Example - -SSLCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl" - - - -

A file: URI pointing at a file of PEM encoded CRLs -can be used instead of SSLCARevocationFile, and a file: -URI pointing at a directory of PEM encoded CRLs can be used -instead of SSLCARevocationPath. -

- -

This URI is read at server startup, while the server is still running -as root (before privilege dropping), so it may be owned by -and readable only by root. The URI is not re-read during -normal operation; a server restart is required for changes to take -effect.

- - - SSLCARevocationCheck Enable CRL-based revocation checking @@ -2387,9 +2354,9 @@ SSLProxyMachineCertificateChainFile "/usr/local/apache2/conf/ssl.crt/proxyCA.pem -SSLProxyMachineCertificateURI +SSLProxyStoreURI Proxy certificate and key stores -SSLProxyMachineCertificateURI uri +SSLProxyStoreURI uri server config virtual host proxy section Available in httpd 2.5.1 and later, when linked with @@ -2437,11 +2404,11 @@ at startup time.

Example # Example using a PEM-encoded file. -SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.pem" +SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.pem" # Example using a PKCS12 file. -SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.p12" +SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.p12" # Example use of a certificate and private key from a PKCS#11 token: -SSLProxyMachineCertificateURI "pkcs11:token=My%20Token%20Name;id=45" +SSLProxyStoreURI "pkcs11:token=My%20Token%20Name;id=45" @@ -2469,13 +2436,13 @@ likely fail the SSL/TLS handshake (depending on the remote server configuration).

Using SSLProxyMachineCertificateFile and -SSLProxyMachineCertificateURI together +SSLProxyStoreURI together

You can use both SSLProxyMachineCertificateFile and -SSLProxyMachineCertificateURI together, however there is +SSLProxyStoreURI together, however there is no overlap between the mechanisms. A certificate defined by SSLProxyMachineCertificateFile will not be matched with a -key from SSLProxyMachineCertificateURI. +key from SSLProxyStoreURI.

@@ -2790,9 +2757,9 @@ SSLProxyCACertificateFile "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-serv -SSLProxyCACertificateURI +SSLProxyTrustURI Proxy CA certificate store for Remote Server Auth -SSLProxyCACertificateURI uri +SSLProxyTrustURI uri server config virtual host proxy section Available in httpd 2.5.1 and later, when linked with @@ -2800,7 +2767,7 @@ OpenSSL v3 or later.

-This directive sets the all-in-one URI where you can assemble the +This directive sets URIs where you can assemble the Certificates of Certification Authorities (CA) whose remote servers you deal with. These are used for Remote Server Authentication. This can be used alternatively and/or additionally to @@ -2808,9 +2775,14 @@ and/or additionally to SSLProxyCACertificatePath.

Example -SSLProxyCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt" +SSLProxyTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt" +

+This directive will also process Certificate Revocation Lists (CRL) of Certification +Authorities (CAs) whose remote servers you deal with, if they fall within scope. +These are used to revoke the remote server certificate on Remote Server Authentication. +

 @@ -2868,32 +2840,6 @@ SSLProxyCARevocationFile "/usr/local/apache2/conf/ssl.crl/ca-bundle-remote-serve - -SSLProxyCARevocationURI -Proxy CA certificate revocation list store for Remote Server Auth -SSLProxyCARevocationURI uri -server config virtual host -proxy section -Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later. - - -

-This directive sets the all-in-one URI where you can -assemble the Certificate Revocation Lists (CRL) of Certification -Authorities (CA) whose remote servers you deal with. These are used -for Remote Server Authentication. This can be -used alternatively and/or additionally to SSLProxyCARevocationFile and SSLProxyCARevocationPath.

-Example - -SSLProxyCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-remote-server.crl" - - - - - SSLProxyCARevocationCheck Enable CRL-based revocation checking for Remote Server Auth diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c index 5d5efa2e8aa..c456416e9f0 100644 --- a/modules/ssl/mod_ssl.c +++ b/modules/ssl/mod_ssl.c @@ -110,7 +110,7 @@ static const command_rec ssl_config_cmds[] = { SSL_CMD_ALL(CipherSuite, TAKE12, "Colon-delimited list of permitted SSL Ciphers, optional preceded " "by protocol identifier ('XXX:...:XXX' - see manual)") - SSL_CMD_SRV(CertificateURI, TAKE1, + SSL_CMD_SRV(StoreURI, TAKE1, "SSL Server Certificate/Key uri " "('file:', 'pkcs11:' - URI of certificate or key)") SSL_CMD_SRV(CertificateFile, TAKE1, @@ -132,7 +132,7 @@ static const command_rec ssl_config_cmds[] = { "TLS ECH Key Directory" "('/path/to/dir' - directory with ECH key pairs)") #endif - SSL_CMD_SRV(CACertificateURI, TAKE1, + SSL_CMD_SRV(TrustURI, TAKE1, "SSL CA Certificate uri " "('file:', 'pkcs11:' - URI of CA certificates)") SSL_CMD_ALL(CACertificatePath, TAKE1, @@ -147,12 +147,9 @@ static const command_rec ssl_config_cmds[] = { SSL_CMD_SRV(CADNRequestFile, TAKE1, "SSL CA Distinguished Name file " "('/path/to/file' - PEM encoded to derive acceptable CA names to request)") - SSL_CMD_SRV(CADNRequestURI, TAKE1, + SSL_CMD_SRV(TrustRequestURI, TAKE1, "SSL CA Distinguished Name uri " "('file:', 'pkcs11:' - URI of certificates to derive acceptable CA names to request)") - SSL_CMD_SRV(CARevocationURI, TAKE1, - "SSL CA Certificate Revocation List (CRL) uri " - "('file:', 'pkcs11:' - URI of CRLs)") SSL_CMD_SRV(CARevocationPath, TAKE1, "SSL CA Certificate Revocation List (CRL) path " "('/path/to/dir' - contains PEM encoded files)") @@ -228,8 +225,8 @@ static const command_rec ssl_config_cmds[] = { SSL_CMD_PXY(ProxyVerifyDepth, TAKE1, "SSL Proxy: maximum certificate verification depth " "('N' - number of intermediate certificates)") - SSL_CMD_PXY(ProxyCACertificateURI, TAKE1, - "SSL Proxy: uri referring to server certificates " + SSL_CMD_PXY(ProxyTrustURI, TAKE1, + "SSL Proxy: uri referring to trusted server certificates " "('file:', 'pkcs11:' - URI of CA certificates)") SSL_CMD_PXY(ProxyCACertificateFile, TAKE1, "SSL Proxy: file containing server certificates " @@ -237,9 +234,6 @@ static const command_rec ssl_config_cmds[] = { SSL_CMD_PXY(ProxyCACertificatePath, TAKE1, "SSL Proxy: directory containing server certificates " "('/path/to/dir' - contains PEM encoded certificates)") - SSL_CMD_PXY(ProxyCARevocationURI, TAKE1, - "SSL Proxy: CA Certificate Revocation List (CRL) uri " - "('file:', 'pkcs11:' - URI of CRLs)") SSL_CMD_PXY(ProxyCARevocationPath, TAKE1, "SSL Proxy: CA Certificate Revocation List (CRL) path " "('/path/to/dir' - contains PEM encoded files)") @@ -248,7 +242,7 @@ static const command_rec ssl_config_cmds[] = { "('/path/to/file' - PEM encoded)") SSL_CMD_PXY(ProxyCARevocationCheck, RAW_ARGS, "SSL Proxy: CA Certificate Revocation List (CRL) checking mode") - SSL_CMD_PXY(ProxyMachineCertificateURI, TAKE1, + SSL_CMD_PXY(ProxyStoreURI, TAKE1, "SSL Proxy: uri referring to client certificates " "('file:', 'pkcs11:' - URI of certificate or key)") SSL_CMD_PXY(ProxyMachineCertificateFile, TAKE1, diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c index 594cfbe462c..3652b7f0cf7 100644 --- a/modules/ssl/ssl_engine_config.c +++ b/modules/ssl/ssl_engine_config.c @@ -132,10 +132,9 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) mctx->crl_file = NULL; mctx->crl_path = NULL; - mctx->crl_uri = NULL; mctx->crl_check_mask = UNSET; - mctx->auth.ca_cert_uri = NULL; + mctx->auth.trust_uris = apr_array_make(p, 3, sizeof(char *));; mctx->auth.ca_cert_path = NULL; mctx->auth.ca_cert_file = NULL; mctx->auth.cipher_suite = NULL; @@ -204,6 +203,7 @@ static void modssl_ctx_init_server(SSLSrvConfigRec *sc, mctx->pks = apr_pcalloc(p, sizeof(*mctx->pks)); mctx->pks->uris = apr_array_make(p, 3, sizeof(char *)); + mctx->pks->trust_request_uris = apr_array_make(p, 3, sizeof(char *)); mctx->pks->cert_files = apr_array_make(p, 3, sizeof(char *)); mctx->pks->key_files = apr_array_make(p, 3, sizeof(char *)); @@ -281,10 +281,9 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, cfgMerge(crl_file, NULL); cfgMerge(crl_path, NULL); - cfgMerge(crl_uri, NULL); cfgMergeInt(crl_check_mask); - cfgMergeString(auth.ca_cert_uri); + cfgMergeArray(auth.trust_uris); cfgMergeString(auth.ca_cert_path); cfgMergeString(auth.ca_cert_file); cfgMergeString(auth.cipher_suite); @@ -343,7 +342,7 @@ static void modssl_ctx_cfg_merge_server(apr_pool_t *p, cfgMergeArray(pks->cert_files); cfgMergeArray(pks->key_files); - cfgMergeString(pks->ca_name_uri); + cfgMergeArray(pks->trust_request_uris); cfgMergeString(pks->ca_name_path); cfgMergeString(pks->ca_name_file); @@ -1096,7 +1095,7 @@ static const char *ssl_cmd_check_dir(cmd_parms *parms, } -const char *ssl_cmd_SSLCertificateURI(cmd_parms *cmd, +const char *ssl_cmd_SSLStoreURI(cmd_parms *cmd, void *dcfg, const char *arg) { @@ -1185,7 +1184,7 @@ const char *ssl_cmd_SSLSessionTicketKeyFile(cmd_parms *cmd, #define NO_PER_DIR_SSL_CA \ "Your SSL library does not have support for per-directory CA" -const char *ssl_cmd_SSLCACertificateURI(cmd_parms *cmd, +const char *ssl_cmd_SSLTrustURI(cmd_parms *cmd, void *dcfg, const char *arg) { @@ -1202,7 +1201,7 @@ const char *ssl_cmd_SSLCACertificateURI(cmd_parms *cmd, } /* XXX: bring back per-dir */ - sc->server->auth.ca_cert_uri = arg; + *(const char **)apr_array_push(sc->server->auth.trust_uris) = arg; return NULL; } @@ -1251,8 +1250,8 @@ const char *ssl_cmd_SSLCACertificateFile(cmd_parms *cmd, return NULL; } -const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *cmd, void *dcfg, - const char *arg) +const char *ssl_cmd_SSLTrustRequestURI(cmd_parms *cmd, void *dcfg, + const char *arg) { SSLSrvConfigRec *sc = mySrvConfig(cmd->server); const char *err; @@ -1261,7 +1260,7 @@ const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *cmd, void *dcfg, return err; } - sc->server->pks->ca_name_uri = arg; + *(const char **)apr_array_push(sc->server->pks->trust_request_uris) = arg; return NULL; } @@ -1296,22 +1295,6 @@ const char *ssl_cmd_SSLCADNRequestFile(cmd_parms *cmd, void *dcfg, return NULL; } -const char *ssl_cmd_SSLCARevocationURI(cmd_parms *cmd, - void *dcfg, - const char *arg) -{ - SSLSrvConfigRec *sc = mySrvConfig(cmd->server); - const char *err; - - if ((err = ssl_cmd_check_uri(cmd, arg))) { - return err; - } - - sc->server->crl_uri = arg; - - return NULL; -} - const char *ssl_cmd_SSLCARevocationPath(cmd_parms *cmd, void *dcfg, const char *arg) @@ -1857,7 +1840,7 @@ const char *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *cmd, return NULL; } -const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *cmd, +const char *ssl_cmd_SSLProxyTrustURI(cmd_parms *cmd, void *dcfg, const char *arg) { @@ -1868,7 +1851,7 @@ const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *cmd, return err; } - dc->proxy->auth.ca_cert_uri = arg; + *(const char **)apr_array_push(dc->proxy->auth.trust_uris) = arg; return NULL; } @@ -1905,22 +1888,6 @@ const char *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *cmd, return NULL; } -const char *ssl_cmd_SSLProxyCARevocationURI(cmd_parms *cmd, - void *dcfg, - const char *arg) -{ - SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg; - const char *err; - - if ((err = ssl_cmd_check_uri(cmd, arg))) { - return err; - } - - dc->proxy->crl_uri = arg; - - return NULL; -} - const char *ssl_cmd_SSLProxyCARevocationPath(cmd_parms *cmd, void *dcfg, const char *arg) @@ -1962,9 +1929,9 @@ const char *ssl_cmd_SSLProxyCARevocationCheck(cmd_parms *cmd, return ssl_cmd_crlcheck_parse(cmd, arg, &dc->proxy->crl_check_mask); } -const char *ssl_cmd_SSLProxyMachineCertificateURI(cmd_parms *cmd, - void *dcfg, - const char *arg) +const char *ssl_cmd_SSLProxyStoreURI(cmd_parms *cmd, + void *dcfg, + const char *arg) { SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg; const char *err; @@ -2529,9 +2496,15 @@ void ssl_hook_ConfigTest(apr_pool_t *pconf, server_rec *s) SSLSrvConfigRec *sc = mySrvConfig(s); if (sc && sc->server) { - if (sc->server->auth.ca_cert_uri) { + + int i; + + for (i = 0; (i < sc->server->auth.trust_uris->nelts) && + APR_ARRAY_IDX(sc->server->auth.trust_uris, i, const char *); + i++) { apr_file_printf(out, " %s\n", - sc->server->auth.ca_cert_uri); + APR_ARRAY_IDX(sc->server->auth.trust_uris, + i, const char *)); } if (sc->server->auth.ca_cert_path) { apr_file_printf(out, " %s\n", @@ -2800,7 +2773,7 @@ static void modssl_auth_ctx_dump(modssl_auth_ctx_t *auth, apr_pool_t *p, int pro #endif DMP_VERIFY(proxy? "SSLProxyVerify" : "SSLVerifyClient", auth->verify_mode); DMP_LONG( proxy? "SSLProxyVerify" : "SSLVerifyDepth", auth->verify_depth); - DMP_STRING(proxy? "SSLProxyCACertificateURI" : "SSLCACertificateURI", auth->ca_cert_uri); + DMP_STRARR(proxy? "SSLProxyTrustURI" : "SSLTrustURI", auth->trust_uris); DMP_STRING(proxy? "SSLProxyCACertificateFile" : "SSLCACertificateFile", auth->ca_cert_file); DMP_STRING(proxy? "SSLProxyCACertificatePath" : "SSLCACertificatePath", auth->ca_cert_path); } @@ -2820,15 +2793,14 @@ static void modssl_ctx_dump(modssl_ctx_t *ctx, apr_pool_t *p, int proxy, DMP_STRING(proxy? "SSLProxyCARevocationFile" : "SSLCARevocationFile", ctx->crl_file); DMP_STRING(proxy? "SSLProxyCARevocationPath" : "SSLCARevocationPath", ctx->crl_path); - DMP_STRING(proxy? "SSLProxyCARevocationURI" : "SSLCARevocationURI", ctx->crl_uri); DMP_CRLCHK(proxy? "SSLProxyCARevocationCheck" : "SSLCARevocationCheck", ctx->crl_check_mask); if (!proxy) { DMP_PHRASE("SSLPassPhraseDialog", ctx->pphrase_dialog_type, ctx->pphrase_dialog_path); if (ctx->pks) { - DMP_STRING("SSLCADNRequestURI", ctx->pks->ca_name_uri); + DMP_STRARR("SSLTrustRequestURI", ctx->pks->trust_request_uris); DMP_STRING("SSLCADNRequestFile", ctx->pks->ca_name_file); DMP_STRING("SSLCADNRequestPath", ctx->pks->ca_name_path); - DMP_STRARR("SSLCertificateURI", ctx->pks->uris); + DMP_STRARR("SSLStoreURI", ctx->pks->uris); DMP_STRARR("SSLCertificateFile", ctx->pks->cert_files); DMP_STRARR("SSLCertificateKeyFile", ctx->pks->key_files); } @@ -2879,7 +2851,7 @@ static void modssl_ctx_dump(modssl_ctx_t *ctx, apr_pool_t *p, int proxy, } else { /* proxy */ if (ctx->pkp) { - DMP_STRARR("SSLProxyMachineCertificateURI", ctx->pkp->uris); + DMP_STRARR("SSLProxyStoreURI", ctx->pkp->uris); DMP_STRING("SSLProxyMachineCertificateFile", ctx->pkp->cert_file); DMP_STRING("SSLProxyMachineCertificatePath", ctx->pkp->cert_path); DMP_STRING("SSLProxyMachineCertificateChainFile", ctx->pkp->ca_cert_file); diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c index 9a03bc45cf3..d533785868b 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c @@ -339,7 +339,7 @@ static void hash_sni_policy_pk(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ct md5_strarray_hash(ptemp, hash, "key_files:", ctx->pks->key_files); } -static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx) +static void hash_sni_policy_auth(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ctx_t *ctx) { modssl_pk_server_t *pks = ctx->pks; modssl_auth_ctx_t *a = &ctx->auth; @@ -347,13 +347,12 @@ static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx) md5_fmt_update(hash, "verify_depth:%d", a->verify_depth); md5_fmt_update(hash, "verify_mode:%d", a->verify_mode); - md5_ifstr_update(hash, "ca_name_uri:", pks->ca_name_uri); + md5_strarray_hash(ptemp, hash, "trust_request_uris:", pks->trust_request_uris); md5_ifstr_update(hash, "ca_name_path:", pks->ca_name_path); md5_ifstr_update(hash, "ca_name_file:", pks->ca_name_file); - md5_ifstr_update(hash, "ca_cert_uri:", a->ca_cert_uri); + md5_strarray_hash(ptemp, hash, "trust_uris:", a->trust_uris); md5_ifstr_update(hash, "ca_cert_path:", a->ca_cert_path); md5_ifstr_update(hash, "ca_cert_file:", a->ca_cert_file); - md5_ifstr_update(hash, "crl_uri:", ctx->crl_uri); md5_ifstr_update(hash, "crl_path:", ctx->crl_path); md5_ifstr_update(hash, "crl_file:", ctx->crl_file); md5_fmt_update(hash, "crl_check_mask:%d", ctx->crl_check_mask); @@ -393,7 +392,7 @@ static char *create_sni_policy_hash(apr_pool_t *p, apr_pool_t *ptemp, /* Create the vhost policy hash for comparison later. */ apr_md5_init(&hash); - hash_sni_policy_auth(&hash, sc->server); + hash_sni_policy_auth(ptemp, &hash, sc->server); if (policy == MODSSL_SNIVH_SECURE) hash_sni_policy_pk(ptemp, &hash, sc->server); apr_md5_final(digest, &hash); @@ -1307,6 +1306,26 @@ apr_status_t modssl_CTX_load_verify_store(server_rec *s, break; } + case OSSL_STORE_INFO_CRL: { + + X509_CRL *crl; + + if (!(crl = OSSL_STORE_INFO_get0_CRL(info))) { + OSSL_STORE_close(sctx); + return APR_EGENERAL; + } + if (X509_STORE_add_crl(store, crl)) { + + ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(10601) + "Host %s: Certificate revocation list from URI: %s", + mctx->sc->vhost_id, + modssl_X509_NAME_to_string(ptemp, + X509_CRL_get_issuer(crl), 0)); + + } + + break; + } } } @@ -1361,20 +1380,30 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, */ if (mctx->auth.ca_cert_file || mctx->auth.ca_cert_path || - mctx->auth.ca_cert_uri) { + mctx->auth.trust_uris->nelts) { + const char *trust_uri; + + int i; apr_status_t rv; ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, "Configuring client authentication"); - if ((rv = modssl_CTX_load_verify_store(s, ptemp, - mctx->auth.ca_cert_uri, 1, mctx)) != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10600) - "Unable to configure verify store " - "for client authentication"); - ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); - return ssl_die(s); + for (i = 0; (i < mctx->auth.trust_uris->nelts) && + (trust_uri = APR_ARRAY_IDX(mctx->auth.trust_uris, i, + const char *)); + i++) { + + if ((rv = modssl_CTX_load_verify_store(s, ptemp, + trust_uri, 1, mctx)) != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10600) + "Unable to configure verify store " + "for client authentication: %s", trust_uri); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); + return ssl_die(s); + } + } if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file, @@ -1387,18 +1416,18 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, } if (mctx->pks && (mctx->pks->ca_name_file || mctx->pks->ca_name_path || - mctx->pks->ca_name_uri)) { + mctx->pks->trust_request_uris->nelts)) { ca_list = ssl_init_FindCAList(s, ptemp, mctx->pks->ca_name_file, mctx->pks->ca_name_path, - mctx->pks->ca_name_uri, + mctx->pks->trust_request_uris, mctx); } else { ca_list = ssl_init_FindCAList(s, ptemp, mctx->auth.ca_cert_file, mctx->auth.ca_cert_path, - mctx->auth.ca_cert_uri, + mctx->auth.trust_uris, mctx); } @@ -1493,99 +1522,6 @@ int modssl_X509_STORE_load_locations(X509_STORE *store, return 1; } -/* - * OpenSSL has a X509_STORE_load_store() function, but this - * function has side effects - it loads both CRLs and trusted - * CA certificates. - * - * An end user reasonably wants to configure a URI pointing at - * CRLs and not have any surprises if the scope of the URI - * included trusted CA certificates for whatever reason. - * - * As a result we consider CRLs exclusively below. - */ - -static APR_INLINE -apr_status_t modssl_X509_STORE_load_crl(server_rec *s, - apr_pool_t *ptemp, - const char *uri, - int depth, - modssl_ctx_t *mctx) -{ -#if MODSSL_HAVE_OPENSSL_STORE - OSSL_STORE_CTX *sctx; - OSSL_STORE_INFO *info; - - apr_status_t rv = APR_SUCCESS; - - X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx); - - ap_assert(store != NULL); /* safe to assume always non-NULL? */ - - if (!uri) { - return APR_SUCCESS; - } - - if ((!(sctx = OSSL_STORE_open_ex(uri, mctx->libctx, NULL, NULL, NULL, - NULL, NULL, NULL)))) { - return APR_EGENERAL; - } - - while (!OSSL_STORE_eof(sctx) && !OSSL_STORE_error(sctx)) { - - if (!(info = OSSL_STORE_load(sctx))) { - continue; - } - - switch(OSSL_STORE_INFO_get_type(info)) { - case OSSL_STORE_INFO_NAME: { - - if (depth > 0) { - rv = modssl_X509_STORE_load_crl(s, ptemp, - OSSL_STORE_INFO_get0_NAME(info), - depth - 1, mctx); - if (APR_SUCCESS != rv) { - OSSL_STORE_close(sctx); - return rv; - } - } - - break; - } - case OSSL_STORE_INFO_CRL: { - - X509_CRL *crl; - - if (!(crl = OSSL_STORE_INFO_get0_CRL(info))) { - return APR_EGENERAL; - } - if (X509_STORE_add_crl(store, crl)) { - - ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(10601) - "Host %s: Certificate revocation list from URI: %s", - mctx->sc->vhost_id, - modssl_X509_NAME_to_string(ptemp, - X509_CRL_get_issuer(crl), 0)); - - } - - break; - } - } - } - - OSSL_STORE_close(sctx); - - return rv; -#else - if (!uri) { - return APR_SUCCESS; - } - - return APR_ENOTIMPL; -#endif -} - static apr_status_t ssl_init_ctx_crl(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, @@ -1612,12 +1548,12 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, * Configure Certificate Revocation List (CRL) Details */ - if (!(mctx->crl_uri || mctx->crl_file || mctx->crl_path)) { + if (!(mctx->auth.trust_uris->nelts || mctx->crl_file || mctx->crl_path)) { if (crl_check_mode == SSL_CRLCHECK_LEAF || crl_check_mode == SSL_CRLCHECK_CHAIN) { ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01899) "Host %s: CRL checking has been enabled, but " - "neither %sCARevocationURI, %sCARevocationFile nor %sCARevocationPath " + "neither %sTrustURI, %sCARevocationFile nor %sCARevocationPath " "is configured", mctx->sc->vhost_id, cfgp, cfgp, cfgp); return ssl_die(s); } @@ -1627,14 +1563,6 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) "Configuring certificate revocation facility"); - if ((rv = modssl_X509_STORE_load_crl(s, ptemp, mctx->crl_uri, 1, mctx)) != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10602) - "Host %s: unable to configure X.509 CRL uri " - "for certificate revocation", mctx->sc->vhost_id); - ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); - return ssl_die(s); - } - if (!modssl_X509_STORE_load_locations(store, mctx->crl_file, mctx->crl_path)) { ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) @@ -3632,21 +3560,32 @@ STACK_OF(X509_NAME) *ssl_init_FindCAList(server_rec *s, apr_pool_t *ptemp, const char *ca_file, const char *ca_path, - const char *ca_uri, + apr_array_header_t *trust_uris, modssl_ctx_t *mctx) { + const char *trust_uri; + int i; + STACK_OF(X509_NAME) *ca_list = sk_X509_NAME_new_null();; /* * Process CA certificate store uri */ - if (ca_uri && - ssl_init_ca_cert_uri(s, ptemp, - ca_uri, ca_list, 1, mctx) != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10616) - "Failed to open Certificate URI `%s'", ca_uri); - sk_X509_NAME_pop_free(ca_list, X509_NAME_free); - return NULL; + + for (i = 0; (i < trust_uris->nelts) && + (trust_uri = APR_ARRAY_IDX(trust_uris, i, + const char *)); + i++) { + + if (trust_uris->nelts && + ssl_init_ca_cert_uri(s, ptemp, + trust_uri, ca_list, 1, mctx) != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10616) + "Failed to open Trust URI `%s'", trust_uri); + sk_X509_NAME_pop_free(ca_list, X509_NAME_free); + return NULL; + } + } /* diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h index 938adf01fec..16014186e87 100644 --- a/modules/ssl/ssl_private.h +++ b/modules/ssl/ssl_private.h @@ -761,7 +761,7 @@ typedef struct { /** Certificates which specify the set of CA names which should be * sent in the CertificateRequest message: */ - const char *ca_name_uri; + apr_array_header_t *trust_request_uris; const char *ca_name_path; const char *ca_name_file; @@ -788,7 +788,7 @@ typedef struct { /** stuff related to authentication that can also be per-dir */ typedef struct { /** known/trusted CAs */ - const char *ca_cert_uri; + apr_array_header_t *trust_uris; const char *ca_cert_path; const char *ca_cert_file; @@ -849,7 +849,6 @@ typedef struct { const char *cert_chain; /** certificate revocation list */ - const char *crl_uri; const char *crl_path; const char *crl_file; int crl_check_mask; @@ -990,17 +989,16 @@ const char *ssl_cmd_SSLEngine(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLECHKeyDir(cmd_parms *cmd, void *dcfg, const char *arg); #endif const char *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *, const char *); -const char *ssl_cmd_SSLCertificateURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLStoreURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateChainFile(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLCACertificateURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLTrustURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCACertificatePath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCACertificateFile(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLTrustRequestURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCADNRequestPath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCADNRequestFile(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLCARevocationURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCARevocationPath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCARevocationFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCARevocationCheck(cmd_parms *, void *, const char *); @@ -1027,14 +1025,13 @@ const char *ssl_cmd_SSLProxyProtocol(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *, const char *); const char *ssl_cmd_SSLProxyVerify(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLProxyTrustURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCACertificateFile(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLProxyCARevocationURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCARevocationPath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCARevocationFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCARevocationCheck(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLProxyMachineCertificateURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLProxyStoreURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyMachineCertificatePath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyMachineCertificateFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyMachineCertificateChainFile(cmd_parms *, void *, const char *); @@ -1080,7 +1077,7 @@ int ssl_proxy_section_post_config(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s, ap_conf_vector_t *section_config); STACK_OF(X509_NAME) - *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *, const char *, modssl_ctx_t *); + *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *, apr_array_header_t *, modssl_ctx_t *); void ssl_init_Child(apr_pool_t *, server_rec *); apr_status_t ssl_init_ModuleKill(void *data); From fdd6f7c7b5d89daae60c63f8b47170183317c76a Mon Sep 17 00:00:00 2001 From: Graham Leggett Date: Thu, 6 Aug 2026 11:01:52 +0000 Subject: [PATCH 41/50] Rebuild docs. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936909 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/directives.html.de | 12 +- docs/manual/mod/directives.html.en.utf8 | 12 +- docs/manual/mod/directives.html.es.utf8 | 12 +- docs/manual/mod/directives.html.fr.utf8 | 12 +- docs/manual/mod/directives.html.ja.utf8 | 12 +- docs/manual/mod/directives.html.ko.euc-kr | 12 +- docs/manual/mod/directives.html.tr.utf8 | 12 +- docs/manual/mod/directives.html.zh-cn.utf8 | 12 +- docs/manual/mod/mod_ssl.html.en.utf8 | 488 ++++++++---------- docs/manual/mod/mod_ssl.html.es.utf8 | 166 +++--- docs/manual/mod/mod_ssl.html.fr.utf8 | 166 +++--- docs/manual/mod/mod_ssl.xml.es | 2 +- docs/manual/mod/mod_ssl.xml.fr | 2 +- docs/manual/mod/overrides.html.en.utf8 | 20 +- docs/manual/mod/quickreference.html.de | 76 ++- docs/manual/mod/quickreference.html.en.utf8 | 76 ++- docs/manual/mod/quickreference.html.es.utf8 | 76 ++- docs/manual/mod/quickreference.html.fr.utf8 | 76 ++- docs/manual/mod/quickreference.html.ja.utf8 | 76 ++- docs/manual/mod/quickreference.html.ko.euc-kr | 76 ++- docs/manual/mod/quickreference.html.tr.utf8 | 76 ++- .../manual/mod/quickreference.html.zh-cn.utf8 | 76 ++- 22 files changed, 710 insertions(+), 838 deletions(-) diff --git a/docs/manual/mod/directives.html.de b/docs/manual/mod/directives.html.de index 7e18f5cc034..3a36f98a70d 100644 --- a/docs/manual/mod/directives.html.de +++ b/docs/manual/mod/directives.html.de @@ -746,18 +746,14 @@
  • SSIUndefinedEcho
  • SSLCACertificateFile
  • SSLCACertificatePath
    • -
  • SSLCACertificateURI
  • SSLCADNRequestFile
  • SSLCADNRequestPath
    • -
  • SSLCADNRequestURI
  • SSLCARevocationCheck
  • SSLCARevocationFile
  • SSLCARevocationPath
    • -
  • SSLCARevocationURI
  • SSLCertificateChainFile
  • SSLCertificateFile
  • SSLCertificateKeyFile
    • -
  • SSLCertificateURI
  • SSLCipherSuite
  • SSLClientHelloVars
  • SSLCompression
    • @@ -783,11 +779,9 @@
  • SSLProtocol
  • SSLProxyCACertificateFile
  • SSLProxyCACertificatePath
    • -
  • SSLProxyCACertificateURI
  • SSLProxyCARevocationCheck
  • SSLProxyCARevocationFile
  • SSLProxyCARevocationPath
    • -
  • SSLProxyCARevocationURI
  • SSLProxyCheckPeerCN
  • SSLProxyCheckPeerExpire
  • SSLProxyCheckPeerName
    • @@ -796,8 +790,9 @@
  • SSLProxyMachineCertificateChainFile
  • SSLProxyMachineCertificateFile
  • SSLProxyMachineCertificatePath
    • -
  • SSLProxyMachineCertificateURI
  • SSLProxyProtocol
    • +
  • SSLProxyStoreURI
    • +
  • SSLProxyTrustURI
  • SSLProxyVerify
  • SSLProxyVerifyDepth
  • SSLRandomSeed
    • @@ -819,7 +814,10 @@
  • SSLStaplingResponseTimeSkew
  • SSLStaplingReturnResponderErrors
  • SSLStaplingStandardCacheTimeout
    • +
  • SSLStoreURI
  • SSLStrictSNIVHostCheck
    • +
  • SSLTrustRequestURI
    • +
  • SSLTrustURI
  • SSLUserName
  • SSLUseStapling
  • SSLVerifyClient
    • diff --git a/docs/manual/mod/directives.html.en.utf8 b/docs/manual/mod/directives.html.en.utf8 index 5ac4b190a35..f3c352d280c 100644 --- a/docs/manual/mod/directives.html.en.utf8 +++ b/docs/manual/mod/directives.html.en.utf8 @@ -747,18 +747,14 @@
  • SSIUndefinedEcho
  • SSLCACertificateFile
  • SSLCACertificatePath
    • -
  • SSLCACertificateURI
  • SSLCADNRequestFile
  • SSLCADNRequestPath
    • -
  • SSLCADNRequestURI
  • SSLCARevocationCheck
  • SSLCARevocationFile
  • SSLCARevocationPath
    • -
  • SSLCARevocationURI
  • SSLCertificateChainFile
  • SSLCertificateFile
  • SSLCertificateKeyFile
    • -
  • SSLCertificateURI
  • SSLCipherSuite
  • SSLClientHelloVars
  • SSLCompression
    • @@ -784,11 +780,9 @@
  • SSLProtocol
  • SSLProxyCACertificateFile
  • SSLProxyCACertificatePath
    • -
  • SSLProxyCACertificateURI
  • SSLProxyCARevocationCheck
  • SSLProxyCARevocationFile
  • SSLProxyCARevocationPath
    • -
  • SSLProxyCARevocationURI
  • SSLProxyCheckPeerCN
  • SSLProxyCheckPeerExpire
  • SSLProxyCheckPeerName
    • @@ -797,8 +791,9 @@
  • SSLProxyMachineCertificateChainFile
  • SSLProxyMachineCertificateFile
  • SSLProxyMachineCertificatePath
    • -
  • SSLProxyMachineCertificateURI
  • SSLProxyProtocol
    • +
  • SSLProxyStoreURI
    • +
  • SSLProxyTrustURI
  • SSLProxyVerify
  • SSLProxyVerifyDepth
  • SSLRandomSeed
    • @@ -820,7 +815,10 @@
  • SSLStaplingResponseTimeSkew
  • SSLStaplingReturnResponderErrors
  • SSLStaplingStandardCacheTimeout
    • +
  • SSLStoreURI
  • SSLStrictSNIVHostCheck
    • +
  • SSLTrustRequestURI
    • +
  • SSLTrustURI
  • SSLUserName
  • SSLUseStapling
  • SSLVerifyClient
    • diff --git a/docs/manual/mod/directives.html.es.utf8 b/docs/manual/mod/directives.html.es.utf8 index 9116154542b..a43f5dc6090 100644 --- a/docs/manual/mod/directives.html.es.utf8 +++ b/docs/manual/mod/directives.html.es.utf8 @@ -749,18 +749,14 @@
  • SSIUndefinedEcho
  • SSLCACertificateFile
  • SSLCACertificatePath
    • -
  • SSLCACertificateURI
  • SSLCADNRequestFile
  • SSLCADNRequestPath
    • -
  • SSLCADNRequestURI
  • SSLCARevocationCheck
  • SSLCARevocationFile
  • SSLCARevocationPath
    • -
  • SSLCARevocationURI
  • SSLCertificateChainFile
  • SSLCertificateFile
  • SSLCertificateKeyFile
    • -
  • SSLCertificateURI
  • SSLCipherSuite
  • SSLClientHelloVars
  • SSLCompression
    • @@ -786,11 +782,9 @@
  • SSLProtocol
  • SSLProxyCACertificateFile
  • SSLProxyCACertificatePath
    • -
  • SSLProxyCACertificateURI
  • SSLProxyCARevocationCheck
  • SSLProxyCARevocationFile
  • SSLProxyCARevocationPath
    • -
  • SSLProxyCARevocationURI
  • SSLProxyCheckPeerCN
  • SSLProxyCheckPeerExpire
  • SSLProxyCheckPeerName
    • @@ -799,8 +793,9 @@
  • SSLProxyMachineCertificateChainFile
  • SSLProxyMachineCertificateFile
  • SSLProxyMachineCertificatePath
    • -
  • SSLProxyMachineCertificateURI
  • SSLProxyProtocol
    • +
  • SSLProxyStoreURI
    • +
  • SSLProxyTrustURI
  • SSLProxyVerify
  • SSLProxyVerifyDepth
  • SSLRandomSeed
    • @@ -822,7 +817,10 @@
  • SSLStaplingResponseTimeSkew
  • SSLStaplingReturnResponderErrors
  • SSLStaplingStandardCacheTimeout
    • +
  • SSLStoreURI
  • SSLStrictSNIVHostCheck
    • +
  • SSLTrustRequestURI
    • +
  • SSLTrustURI
  • SSLUserName
  • SSLUseStapling
  • SSLVerifyClient
    • diff --git a/docs/manual/mod/directives.html.fr.utf8 b/docs/manual/mod/directives.html.fr.utf8 index f23cc42d1ab..0d1cc8aec3e 100644 --- a/docs/manual/mod/directives.html.fr.utf8 +++ b/docs/manual/mod/directives.html.fr.utf8 @@ -748,18 +748,14 @@
  • SSIUndefinedEcho
  • SSLCACertificateFile
  • SSLCACertificatePath
    • -
  • SSLCACertificateURI
  • SSLCADNRequestFile
  • SSLCADNRequestPath
    • -
  • SSLCADNRequestURI
  • SSLCARevocationCheck
  • SSLCARevocationFile
  • SSLCARevocationPath
    • -
  • SSLCARevocationURI
  • SSLCertificateChainFile
  • SSLCertificateFile
  • SSLCertificateKeyFile
    • -
  • SSLCertificateURI
  • SSLCipherSuite
  • SSLClientHelloVars
  • SSLCompression
    • @@ -785,11 +781,9 @@
  • SSLProtocol
  • SSLProxyCACertificateFile
  • SSLProxyCACertificatePath
    • -
  • SSLProxyCACertificateURI
  • SSLProxyCARevocationCheck
  • SSLProxyCARevocationFile
  • SSLProxyCARevocationPath
    • -
  • SSLProxyCARevocationURI
  • SSLProxyCheckPeerCN
  • SSLProxyCheckPeerExpire
  • SSLProxyCheckPeerName
    • @@ -798,8 +792,9 @@
  • SSLProxyMachineCertificateChainFile
  • SSLProxyMachineCertificateFile
  • SSLProxyMachineCertificatePath
    • -
  • SSLProxyMachineCertificateURI
  • SSLProxyProtocol
    • +
  • SSLProxyStoreURI
    • +
  • SSLProxyTrustURI
  • SSLProxyVerify
  • SSLProxyVerifyDepth
  • SSLRandomSeed
    • @@ -821,7 +816,10 @@
  • SSLStaplingResponseTimeSkew
  • SSLStaplingReturnResponderErrors
  • SSLStaplingStandardCacheTimeout
    • +
  • SSLStoreURI
  • SSLStrictSNIVHostCheck
    • +
  • SSLTrustRequestURI
    • +
  • SSLTrustURI
  • SSLUserName
  • SSLUseStapling
  • SSLVerifyClient
    • diff --git a/docs/manual/mod/directives.html.ja.utf8 b/docs/manual/mod/directives.html.ja.utf8 index 6ea80fd9ca3..f62fead018c 100644 --- a/docs/manual/mod/directives.html.ja.utf8 +++ b/docs/manual/mod/directives.html.ja.utf8 @@ -744,18 +744,14 @@
  • SSIUndefinedEcho
  • SSLCACertificateFile
  • SSLCACertificatePath
    • -
  • SSLCACertificateURI
  • SSLCADNRequestFile
  • SSLCADNRequestPath
    • -
  • SSLCADNRequestURI
  • SSLCARevocationCheck
  • SSLCARevocationFile
  • SSLCARevocationPath
    • -
  • SSLCARevocationURI
  • SSLCertificateChainFile
  • SSLCertificateFile
  • SSLCertificateKeyFile
    • -
  • SSLCertificateURI
  • SSLCipherSuite
  • SSLClientHelloVars
  • SSLCompression
    • @@ -781,11 +777,9 @@
  • SSLProtocol
  • SSLProxyCACertificateFile
  • SSLProxyCACertificatePath
    • -
  • SSLProxyCACertificateURI
  • SSLProxyCARevocationCheck
  • SSLProxyCARevocationFile
  • SSLProxyCARevocationPath
    • -
  • SSLProxyCARevocationURI
  • SSLProxyCheckPeerCN
  • SSLProxyCheckPeerExpire
  • SSLProxyCheckPeerName
    • @@ -794,8 +788,9 @@
  • SSLProxyMachineCertificateChainFile
  • SSLProxyMachineCertificateFile
  • SSLProxyMachineCertificatePath
    • -
  • SSLProxyMachineCertificateURI
  • SSLProxyProtocol
    • +
  • SSLProxyStoreURI
    • +
  • SSLProxyTrustURI
  • SSLProxyVerify
  • SSLProxyVerifyDepth
  • SSLRandomSeed
    • @@ -817,7 +812,10 @@
  • SSLStaplingResponseTimeSkew
  • SSLStaplingReturnResponderErrors
  • SSLStaplingStandardCacheTimeout
    • +
  • SSLStoreURI
  • SSLStrictSNIVHostCheck
    • +
  • SSLTrustRequestURI
    • +
  • SSLTrustURI
  • SSLUserName
  • SSLUseStapling
  • SSLVerifyClient
    • diff --git a/docs/manual/mod/directives.html.ko.euc-kr b/docs/manual/mod/directives.html.ko.euc-kr index 9583d83446b..a23b548b5cc 100644 --- a/docs/manual/mod/directives.html.ko.euc-kr +++ b/docs/manual/mod/directives.html.ko.euc-kr @@ -744,18 +744,14 @@
  • SSIUndefinedEcho
  • SSLCACertificateFile
  • SSLCACertificatePath
    • -
  • SSLCACertificateURI
  • SSLCADNRequestFile
  • SSLCADNRequestPath
    • -
  • SSLCADNRequestURI
  • SSLCARevocationCheck
  • SSLCARevocationFile
  • SSLCARevocationPath
    • -
  • SSLCARevocationURI
  • SSLCertificateChainFile
  • SSLCertificateFile
  • SSLCertificateKeyFile
    • -
  • SSLCertificateURI
  • SSLCipherSuite
  • SSLClientHelloVars
  • SSLCompression
    • @@ -781,11 +777,9 @@
  • SSLProtocol
  • SSLProxyCACertificateFile
  • SSLProxyCACertificatePath
    • -
  • SSLProxyCACertificateURI
  • SSLProxyCARevocationCheck
  • SSLProxyCARevocationFile
  • SSLProxyCARevocationPath
    • -
  • SSLProxyCARevocationURI
  • SSLProxyCheckPeerCN
  • SSLProxyCheckPeerExpire
  • SSLProxyCheckPeerName
    • @@ -794,8 +788,9 @@
  • SSLProxyMachineCertificateChainFile
  • SSLProxyMachineCertificateFile
  • SSLProxyMachineCertificatePath
    • -
  • SSLProxyMachineCertificateURI
  • SSLProxyProtocol
    • +
  • SSLProxyStoreURI
    • +
  • SSLProxyTrustURI
  • SSLProxyVerify
  • SSLProxyVerifyDepth
  • SSLRandomSeed
    • @@ -817,7 +812,10 @@
  • SSLStaplingResponseTimeSkew
  • SSLStaplingReturnResponderErrors
  • SSLStaplingStandardCacheTimeout
    • +
  • SSLStoreURI
  • SSLStrictSNIVHostCheck
    • +
  • SSLTrustRequestURI
    • +
  • SSLTrustURI
  • SSLUserName
  • SSLUseStapling
  • SSLVerifyClient
    • diff --git a/docs/manual/mod/directives.html.tr.utf8 b/docs/manual/mod/directives.html.tr.utf8 index 673b50b6979..79812ce2ad5 100644 --- a/docs/manual/mod/directives.html.tr.utf8 +++ b/docs/manual/mod/directives.html.tr.utf8 @@ -743,18 +743,14 @@
  • SSIUndefinedEcho
  • SSLCACertificateFile
  • SSLCACertificatePath
    • -
  • SSLCACertificateURI
  • SSLCADNRequestFile
  • SSLCADNRequestPath
    • -
  • SSLCADNRequestURI
  • SSLCARevocationCheck
  • SSLCARevocationFile
  • SSLCARevocationPath
    • -
  • SSLCARevocationURI
  • SSLCertificateChainFile
  • SSLCertificateFile
  • SSLCertificateKeyFile
    • -
  • SSLCertificateURI
  • SSLCipherSuite
  • SSLClientHelloVars
  • SSLCompression
    • @@ -780,11 +776,9 @@
  • SSLProtocol
  • SSLProxyCACertificateFile
  • SSLProxyCACertificatePath
    • -
  • SSLProxyCACertificateURI
  • SSLProxyCARevocationCheck
  • SSLProxyCARevocationFile
  • SSLProxyCARevocationPath
    • -
  • SSLProxyCARevocationURI
  • SSLProxyCheckPeerCN
  • SSLProxyCheckPeerExpire
  • SSLProxyCheckPeerName
    • @@ -793,8 +787,9 @@
  • SSLProxyMachineCertificateChainFile
  • SSLProxyMachineCertificateFile
  • SSLProxyMachineCertificatePath
    • -
  • SSLProxyMachineCertificateURI
  • SSLProxyProtocol
    • +
  • SSLProxyStoreURI
    • +
  • SSLProxyTrustURI
  • SSLProxyVerify
  • SSLProxyVerifyDepth
  • SSLRandomSeed
    • @@ -816,7 +811,10 @@
  • SSLStaplingResponseTimeSkew
  • SSLStaplingReturnResponderErrors
  • SSLStaplingStandardCacheTimeout
    • +
  • SSLStoreURI
  • SSLStrictSNIVHostCheck
    • +
  • SSLTrustRequestURI
    • +
  • SSLTrustURI
  • SSLUserName
  • SSLUseStapling
  • SSLVerifyClient
    • diff --git a/docs/manual/mod/directives.html.zh-cn.utf8 b/docs/manual/mod/directives.html.zh-cn.utf8 index f8cdc83e1da..9fc426c75b3 100644 --- a/docs/manual/mod/directives.html.zh-cn.utf8 +++ b/docs/manual/mod/directives.html.zh-cn.utf8 @@ -742,18 +742,14 @@
  • SSIUndefinedEcho
  • SSLCACertificateFile
  • SSLCACertificatePath
    • -
  • SSLCACertificateURI
  • SSLCADNRequestFile
  • SSLCADNRequestPath
    • -
  • SSLCADNRequestURI
  • SSLCARevocationCheck
  • SSLCARevocationFile
  • SSLCARevocationPath
    • -
  • SSLCARevocationURI
  • SSLCertificateChainFile
  • SSLCertificateFile
  • SSLCertificateKeyFile
    • -
  • SSLCertificateURI
  • SSLCipherSuite
  • SSLClientHelloVars
  • SSLCompression
    • @@ -779,11 +775,9 @@
  • SSLProtocol
  • SSLProxyCACertificateFile
  • SSLProxyCACertificatePath
    • -
  • SSLProxyCACertificateURI
  • SSLProxyCARevocationCheck
  • SSLProxyCARevocationFile
  • SSLProxyCARevocationPath
    • -
  • SSLProxyCARevocationURI
  • SSLProxyCheckPeerCN
  • SSLProxyCheckPeerExpire
  • SSLProxyCheckPeerName
    • @@ -792,8 +786,9 @@
  • SSLProxyMachineCertificateChainFile
  • SSLProxyMachineCertificateFile
  • SSLProxyMachineCertificatePath
    • -
  • SSLProxyMachineCertificateURI
  • SSLProxyProtocol
    • +
  • SSLProxyStoreURI
    • +
  • SSLProxyTrustURI
  • SSLProxyVerify
  • SSLProxyVerifyDepth
  • SSLRandomSeed
    • @@ -815,7 +810,10 @@
  • SSLStaplingResponseTimeSkew
  • SSLStaplingReturnResponderErrors
  • SSLStaplingStandardCacheTimeout
    • +
  • SSLStoreURI
  • SSLStrictSNIVHostCheck
    • +
  • SSLTrustRequestURI
    • +
  • SSLTrustURI
  • SSLUserName
  • SSLUseStapling
  • SSLVerifyClient
    • diff --git a/docs/manual/mod/mod_ssl.html.en.utf8 b/docs/manual/mod/mod_ssl.html.en.utf8 index 349a9cacf18..be54579526c 100644 --- a/docs/manual/mod/mod_ssl.html.en.utf8 +++ b/docs/manual/mod/mod_ssl.html.en.utf8 @@ -57,18 +57,14 @@ to provide the cryptographic engine.

    • SSLCACertificateFile
    • SSLCACertificatePath
      • -
    • SSLCACertificateURI
    • SSLCADNRequestFile
    • SSLCADNRequestPath
      • -
    • SSLCADNRequestURI
    • SSLCARevocationCheck
    • SSLCARevocationFile
    • SSLCARevocationPath
      • -
    • SSLCARevocationURI
    • SSLCertificateChainFile
    • SSLCertificateFile
    • SSLCertificateKeyFile
      • -
    • SSLCertificateURI
    • SSLCipherSuite
    • SSLClientHelloVars
    • SSLCompression
      • @@ -94,11 +90,9 @@ to provide the cryptographic engine.

    • SSLProtocol
    • SSLProxyCACertificateFile
    • SSLProxyCACertificatePath
      • -
    • SSLProxyCACertificateURI
    • SSLProxyCARevocationCheck
    • SSLProxyCARevocationFile
    • SSLProxyCARevocationPath
      • -
    • SSLProxyCARevocationURI
    • SSLProxyCheckPeerCN
    • SSLProxyCheckPeerExpire
    • SSLProxyCheckPeerName
      • @@ -107,8 +101,9 @@ to provide the cryptographic engine.

    • SSLProxyMachineCertificateChainFile
    • SSLProxyMachineCertificateFile
    • SSLProxyMachineCertificatePath
      • -
    • SSLProxyMachineCertificateURI
    • SSLProxyProtocol
      • +
    • SSLProxyStoreURI
      • +
    • SSLProxyTrustURI
    • SSLProxyVerify
    • SSLProxyVerifyDepth
    • SSLRandomSeed
      • @@ -130,7 +125,10 @@ to provide the cryptographic engine.

    • SSLStaplingResponseTimeSkew
    • SSLStaplingReturnResponderErrors
    • SSLStaplingStandardCacheTimeout
      • +
    • SSLStoreURI
    • SSLStrictSNIVHostCheck
      • +
    • SSLTrustRequestURI
      • +
    • SSLTrustURI
    • SSLUserName
    • SSLUseStapling
    • SSLVerifyClient
      • @@ -447,39 +445,6 @@ may be owned by and readable only by root. The files are not re-read during normal operation; a server restart is required for changes to take effect.

      - -
      top
      -

      SSLCACertificateURI Directive

      - - - - - - - - -
      Description:Server CA certificate store for Client Authentication
      Syntax:SSLCACertificateURI uri
      Context:server config, virtual host
      Override:AuthConfig
      Status:Extension
      Module:mod_ssl
      Compatibility:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.
      -

      -This directive sets the all-in-one URI where you can assemble the -Certificates of Certification Authorities (CA) whose clients you deal -with. These are used for Client Authentication. This can be used alternatively -and/or additionally to SSLCACertificateFile -or SSLCACertificatePath.

      -

      Example

      # trust certs in a PEM encoded certificate bundle
-SSLCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt"
-# trust all certs in a typical Linux machine
-SSLCACertificateURI "pkcs11:token=System%20Trust"
-# trust all certs in the Windows trust store
-SSLCACertificateURI "org.openssl.winstore:"
      -
      - -

      This URI is read at server startup, while the server is still running -as root (before privilege dropping), so it may be owned by -and readable only by root. The URI is not re-read during -normal operation; a server restart is required for changes to take -effect.

      -
      top

      SSLCADNRequestFile Directive

      @@ -497,16 +462,16 @@ in the SSL handshake. These CA names can be used by the client to select an appropriate client certificate out of those it has available.

      -

      If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLCADNRequestURI are given, then the +

      If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLTrustRequestURI are given, then the set of acceptable CA names sent to the client is the names of all the -CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLCACertificateURI directives; in other +CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLTrustURI directives; in other words, the names of the CAs which will actually be used to verify the client certificate.

      In some circumstances, it is useful to be able to send a set of acceptable CA names which differs from the actual CAs used to verify the client certificate - for example, if the client certificates are -signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLCADNRequestURI can be used; the +signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLTrustRequestURI can be used; the acceptable CA names are then taken from the complete set of certificates in the directory and/or file specified by this pair of directives.

      @@ -555,56 +520,6 @@ may be owned by and readable only by root. The files are not re-read during normal operation; a server restart is required for changes to take effect.

      -
      -
      top
      -

      SSLCADNRequestURI Directive

      - - - - - - -
      Description:certificate store of CA Certificates for defining -acceptable CA names
      Syntax:SSLCADNRequestURI uri
      Context:server config, virtual host
      Status:Extension
      Module:mod_ssl
      -

      When a client certificate is requested by mod_ssl, a list of -acceptable Certificate Authority names is sent to the client -in the SSL handshake. These CA names can be used by the client to -select an appropriate client certificate out of those it has -available.

      - -

      If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLCADNRequestURI are given, then the -set of acceptable CA names sent to the client is the names of all the -CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLCACertificateURI directives; in other -words, the names of the CAs which will actually be used to verify the -client certificate.

      - -

      In some circumstances, it is useful to be able to send a set of -acceptable CA names which differs from the actual CAs used to verify -the client certificate - for example, if the client certificates are -signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLCADNRequestURI can be used; the -acceptable CA names are then taken from the complete set of -certificates in the directory and/or file specified by this pair of -directives.

      - -

      SSLCADNRequestURI must -specify an all-in-one certificate store uri containing a -set of CA certificates.

      - -

      Example

      SSLCADNRequestURI "file:///usr/local/apache2/conf/ca-names.crt"
      -
      - -

      A file: URI pointing at a file of PEM encoded certificates -can be used instead of SSLCADNRequestFile, and a file: -URI pointing at a directory of PEM encoded certificates can be used -instead of SSLCADNRequestPath. -

      - -

      This store is read at server startup, while the server is still running -as root (before privilege dropping), so it may be owned by -and readable only by root. The uri is not re-read during -normal operation; a server restart is required for changes to take -effect.

      -
      top

      SSLCARevocationCheck Directive

      @@ -710,37 +625,6 @@ may be owned by and readable only by root. The files are not re-read during normal operation; a server restart is required for changes to take effect.

      -
      -
      top
      -

      SSLCARevocationURI Directive

      - - - - - - -
      Description:Server CA certificate revocation list store for Client Authentication
      Syntax:SSLCARevocationURI uri
      Context:server config, virtual host
      Status:Extension
      Module:mod_ssl
      -

      -This directive sets the all-in-one file where you can -assemble the Certificate Revocation Lists (CRL) of Certification -Authorities (CA) whose clients you deal with. These are used -for Client Authentication. This can be used alternatively and/or -additionally to SSLCARevocationFile and SSLCARevocationPath.

      -

      Example

      SSLCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl"
      -
      - -

      A file: URI pointing at a file of PEM encoded CRLs -can be used instead of SSLCARevocationFile, and a file: -URI pointing at a directory of PEM encoded CRLs can be used -instead of SSLCARevocationPath. -

      - -

      This URI is read at server startup, while the server is still running -as root (before privilege dropping), so it may be owned by -and readable only by root. The URI is not re-read during -normal operation; a server restart is required for changes to take -effect.

      -
      top

      SSLCertificateChainFile Directive

      @@ -977,86 +861,6 @@ and readable only by root, since it contains the private key. The file is not re-read during normal operation; a server restart is required for changes to take effect.

      -
      -
      top
      -

      SSLCertificateURI Directive

      - - - - - - - -
      Description:Server certificate and key store
      Syntax:SSLCertificateURI uri
      Context:server config, virtual host
      Status:Extension
      Module:mod_ssl
      Compatibility:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.
      -

      -This directive points to a certificate store containing certificates, -intermediate certificates, and private keys, represented by a URI. -

      -

      -If no scheme is specified, the path will default to a file: -URI, pointing at PEM encoded data, or a PKCS12 file. Other schemes -include, but are not limited to, pkcs11: for smartcards and -HSMs, cng: for the Windows certificate store, and -handle: for TPMs. On Windows, where a file path is also a -valid URI, the file: scheme must be used. -

      -

      -The directive can be specified multiple times with tightly scoped -URIs to target specific certificates and keys, or could be specified -with a general URI like pkcs11: that considers all possible -certificates and keys. Certificates, intermediate certificates, and keys -can be defined in any order. -

      -

      Certificates and keys are processed as follows. -

      -
        -
      • Leaf certificates that do not have the purpose Server Authentication -are skipped.
        • -
      • Remaining leaf certificates are checked whether the -ServerName and all -ServerAlias directives match the -hostname or IP address of the certificate, and if no match is found they -are skipped.
        • -
      • Intermediate certificates are considered for building certificate -chains on a best effort basis.
        • -
      • Keys are matched up with leaf certificates, any certificate -without a private key is skipped.
        • -
      • Leaf certificates with private keys are sorted oldest to newest and -passed on for configuration.
        • -
      • The most recently issued certificate and key pair for each algorithm -type (RSA, ECDSA, etc) will be used for each virtual host.
        • -
      • The server will report back to you how many certificates of each type -were found to help you if no certificates match.
        • -
      - -

      If the private key is encrypted, the pass phrase dialog is forced -at startup time.

      - -

      Example

      # Example using a PEM-encoded file.
-SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.crt"
-# Example using a PKCS12 file.
-SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.p12"
-# Example use of a certificate and private key from a PKCS#11 token:
-SSLCertificateURI "pkcs11:token=My%20Token%20Name;id=45"
      -
      - -

      These URIs are read at server startup, while the server is still running -as root (before privilege dropping), so it may be owned by -and readable only by root. The URI is not re-read during -normal operation; a server restart is required for changes to take -effect.

      - -

      Using SSLCertificateFile and SSLCertificateURI -together

      -

      -You can use both SSLCertificateFile and SSLCertificateURI together, however -there is no overlap between the mechanisms. A certificate defined by -SSLCertificateFile will not be matched with a key from SSLCertificateURI. -

      -
      - -
      top

      SSLCipherSuite Directive

      @@ -2081,28 +1885,6 @@ contains the appropriate symbolic links.

      Example

      SSLProxyCACertificatePath "/usr/local/apache2/conf/ssl.crt/"
      -
      -
      top
      -

      SSLProxyCACertificateURI Directive

      - - - - - - - -
      Description:Proxy CA certificate store for Remote Server Auth
      Syntax:SSLProxyCACertificateURI uri
      Context:server config, virtual host, proxy section
      Status:Extension
      Module:mod_ssl
      Compatibility:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.
      -

      -This directive sets the all-in-one URI where you can assemble the -Certificates of Certification Authorities (CA) whose remote servers you deal -with. These are used for Remote Server Authentication. This can be used alternatively -and/or additionally to -SSLProxyCACertificateFile and -SSLProxyCACertificatePath.

      -

      Example

      SSLProxyCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt"
      -
      -
      top

      SSLProxyCARevocationCheck Directive

      @@ -2188,27 +1970,6 @@ contains the appropriate symbolic links.

      Example

      SSLProxyCARevocationPath "/usr/local/apache2/conf/ssl.crl/"
      -
      -
      top
      -

      SSLProxyCARevocationURI Directive

      - - - - - - - -
      Description:Proxy CA certificate revocation list store for Remote Server Auth
      Syntax:SSLProxyCARevocationURI uri
      Context:server config, virtual host, proxy section
      Status:Extension
      Module:mod_ssl
      Compatibility:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.
      -

      -This directive sets the all-in-one URI where you can -assemble the Certificate Revocation Lists (CRL) of Certification -Authorities (CA) whose remote servers you deal with. These are used -for Remote Server Authentication. This can be -used alternatively and/or additionally to SSLProxyCARevocationFile and SSLProxyCARevocationPath.

      -

      Example

      SSLProxyCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-remote-server.crl"
      -
      -
      top

      SSLProxyCheckPeerCN Directive

      @@ -2483,10 +2244,31 @@ must be converted, eg. using
      top
      -

      SSLProxyMachineCertificateURI Directive

      +

      SSLProxyProtocol Directive

      + + + + + + + + +
      Description:Configure usable SSL protocol flavors for proxy usage
      Syntax:SSLProxyProtocol [+|-]protocol ...
      Default:SSLProxyProtocol all -SSLv3
      Context:server config, virtual host, proxy section
      Status:Extension
      Module:mod_ssl
      Compatibility:The proxy section context is allowed in httpd 2.4.30 and later
      + +

      +This directive can be used to control the SSL protocol flavors mod_ssl should +use when establishing its server environment for proxy . It will only connect +to servers using one of the provided protocols.

      +

      Please refer to SSLProtocol +for additional information. +

      + +
      +
      top
      +

      SSLProxyStoreURI Directive

      - + @@ -2532,11 +2314,11 @@ were found to help you if no certificates match. at startup time.

      Example

      # Example using a PEM-encoded file.
-SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.pem"
+SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.pem"
 # Example using a PKCS12 file.
-SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.p12"
+SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.p12"
 # Example use of a certificate and private key from a PKCS#11 token:
-SSLProxyMachineCertificateURI "pkcs11:token=My%20Token%20Name;id=45"
      +SSLProxyStoreURI "pkcs11:token=My%20Token%20Name;id=45"

      These URIs are read at server startup, while the server is still running @@ -2563,36 +2345,42 @@ likely fail the SSL/TLS handshake (depending on the remote server configuration).

      Using SSLProxyMachineCertificateFile and -SSLProxyMachineCertificateURI together

      +SSLProxyStoreURI together

      You can use both SSLProxyMachineCertificateFile and -SSLProxyMachineCertificateURI together, however there is +SSLProxyStoreURI together, however there is no overlap between the mechanisms. A certificate defined by SSLProxyMachineCertificateFile will not be matched with a -key from SSLProxyMachineCertificateURI. +key from SSLProxyStoreURI.

      top
      -

      SSLProxyProtocol Directive

      +

      SSLProxyTrustURI Directive

      Description:Proxy certificate and key stores
      Syntax:SSLProxyMachineCertificateURI uri
      Syntax:SSLProxyStoreURI uri
      Context:server config, virtual host, proxy section
      Status:Extension
      Module:mod_ssl
      - - - + + - +
      Description:Configure usable SSL protocol flavors for proxy usage
      Syntax:SSLProxyProtocol [+|-]protocol ...
      Default:SSLProxyProtocol all -SSLv3
      Description:Proxy CA certificate store for Remote Server Auth
      Syntax:SSLProxyTrustURI uri
      Context:server config, virtual host, proxy section
      Status:Extension
      Module:mod_ssl
      Compatibility:The proxy section context is allowed in httpd 2.4.30 and later
      Compatibility:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.
      -

      -This directive can be used to control the SSL protocol flavors mod_ssl should -use when establishing its server environment for proxy . It will only connect -to servers using one of the provided protocols.

      -

      Please refer to SSLProtocol -for additional information. +This directive sets URIs where you can assemble the +Certificates of Certification Authorities (CA) whose remote servers you deal +with. These are used for Remote Server Authentication. This can be used alternatively +and/or additionally to +SSLProxyCACertificateFile and +SSLProxyCACertificatePath.

      +

      Example

      SSLProxyTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt"
      +
      +

      +This directive will also process Certificate Revocation Lists (CRL) of Certification +Authorities (CAs) whose remote servers you deal with, if they fall within scope. +These are used to revoke the remote server certificate on Remote Server Authentication.

      @@ -3300,6 +3088,86 @@ will expire. This directive applies to valid responses, while used for controlling the timeout for invalid/unavailable responses.

      +
      +
      top
      +

      SSLStoreURI Directive

      + + + + + + + +
      Description:Server certificate and key store
      Syntax:SSLStoreURI uri
      Context:server config, virtual host
      Status:Extension
      Module:mod_ssl
      Compatibility:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.
      +

      +This directive points to a certificate store containing certificates, +intermediate certificates, and private keys, represented by a URI. +

      +

      +If no scheme is specified, the path will default to a file: +URI, pointing at PEM encoded data, or a PKCS12 file. Other schemes +include, but are not limited to, pkcs11: for smartcards and +HSMs, cng: for the Windows certificate store, and +handle: for TPMs. On Windows, where a file path is also a +valid URI, the file: scheme must be used. +

      +

      +The directive can be specified multiple times with tightly scoped +URIs to target specific certificates and keys, or could be specified +with a general URI like pkcs11: that considers all possible +certificates and keys. Certificates, intermediate certificates, and keys +can be defined in any order. +

      +

      Certificates and keys are processed as follows. +

      +
        +
      • Leaf certificates that do not have the purpose Server Authentication +are skipped.
        • +
      • Remaining leaf certificates are checked whether the +ServerName and all +ServerAlias directives match the +hostname or IP address of the certificate, and if no match is found they +are skipped.
        • +
      • Intermediate certificates are considered for building certificate +chains on a best effort basis.
        • +
      • Keys are matched up with leaf certificates, any certificate +without a private key is skipped.
        • +
      • Leaf certificates with private keys are sorted oldest to newest and +passed on for configuration.
        • +
      • The most recently issued certificate and key pair for each algorithm +type (RSA, ECDSA, etc) will be used for each virtual host.
        • +
      • The server will report back to you how many certificates of each type +were found to help you if no certificates match.
        • +
      + +

      If the private key is encrypted, the pass phrase dialog is forced +at startup time.

      + +

      Example

      # Example using a PEM-encoded file.
+SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.crt"
+# Example using a PKCS12 file.
+SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.p12"
+# Example use of a certificate and private key from a PKCS#11 token:
+SSLStoreURI "pkcs11:token=My%20Token%20Name;id=45"
      +
      + +

      These URIs are read at server startup, while the server is still running +as root (before privilege dropping), so it may be owned by +and readable only by root. The URI is not re-read during +normal operation; a server restart is required for changes to take +effect.

      + +

      Using SSLCertificateFile and SSLStoreURI +together

      +

      +You can use both SSLCertificateFile and SSLStoreURI together, however +there is no overlap between the mechanisms. A certificate defined by +SSLCertificateFile will not be matched with a key from SSLStoreURI. +

      +
      + +
      top

      SSLStrictSNIVHostCheck Directive

      @@ -3339,6 +3207,94 @@ version of OpenSSL.

      Example

      SSLStrictSNIVHostCheck on
      +
      +
      top
      +

      SSLTrustRequestURI Directive

      + + + + + + +
      Description:certificate store of CA Certificates for defining +acceptable CA names
      Syntax:SSLTrustRequestURI uri
      Context:server config, virtual host
      Status:Extension
      Module:mod_ssl
      +

      When a client certificate is requested by mod_ssl, a list of +acceptable Certificate Authority names is sent to the client +in the SSL handshake. These CA names can be used by the client to +select an appropriate client certificate out of those it has +available.

      + +

      If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLTrustRequestURI are given, then the +set of acceptable CA names sent to the client is the names of all the +CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLTrustURI directives; in other +words, the names of the CAs which will actually be used to verify the +client certificate.

      + +

      In some circumstances, it is useful to be able to send a set of +acceptable CA names which differs from the actual CAs used to verify +the client certificate - for example, if the client certificates are +signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLTrustRequestURI can be used; the +acceptable CA names are then taken from the complete set of +certificates in the directory and/or file specified by this pair of +directives.

      + +

      SSLTrustRequestURI must +specify an all-in-one certificate store uri containing a +set of CA certificates.

      + +

      Example

      SSLTrustRequestURI "file:///usr/local/apache2/conf/ca-names.crt"
      +
      + +

      A file: URI pointing at a file of PEM encoded certificates +can be used instead of SSLCADNRequestFile, and a file: +URI pointing at a directory of PEM encoded certificates can be used +instead of SSLCADNRequestPath. +

      + +

      This store is read at server startup, while the server is still running +as root (before privilege dropping), so it may be owned by +and readable only by root. The uri is not re-read during +normal operation; a server restart is required for changes to take +effect.

      + +
      +
      top
      +

      SSLTrustURI Directive

      + + + + + + + + +
      Description:Server CA certificate store for Client Authentication
      Syntax:SSLTrustURI uri
      Context:server config, virtual host
      Override:AuthConfig
      Status:Extension
      Module:mod_ssl
      Compatibility:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.
      +

      +This directive sets URIs where you can assemble the Certificates of Certification +Authorities (CA) whose clients you deal with. These are used for Client +Authentication. This can be used alternatively and/or additionally to +SSLCACertificateFile +or SSLCACertificatePath.

      +

      Example

      # trust certs in a PEM encoded certificate bundle
+SSLTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt"
+# trust all certs in a typical Linux machine
+SSLTrustURI "pkcs11:token=System%20Trust"
+# trust all certs in the Windows trust store
+SSLTrustURI "org.openssl.winstore:"
      +
      + +

      +This directive will also read in Certificate Revocation Lists (CRL) of +Certification Authorities (CAs) whose clients you deal with. These are used +to revoke the client certificate on Client Authentication.

      + +

      This URI is read at server startup, while the server is still running +as root (before privilege dropping), so it may be owned by +and readable only by root. The URI is not re-read during +normal operation; a server restart is required for changes to take +effect.

      +
      top

      SSLUserName Directive

      diff --git a/docs/manual/mod/mod_ssl.html.es.utf8 b/docs/manual/mod/mod_ssl.html.es.utf8 index 16eebfad616..17a321eaf31 100644 --- a/docs/manual/mod/mod_ssl.html.es.utf8 +++ b/docs/manual/mod/mod_ssl.html.es.utf8 @@ -63,18 +63,14 @@ proveer el motor criptográfico.

      top
      -

      Directiva SSLCACertificateURI

      - - - - - - - - -
      Descripción:Server CA certificate store for Client Authentication
      Sintaxis:SSLCACertificateURI uri
      Contexto:server config, virtual host
      Anula:AuthConfig
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      The documentation for this directive has - not been translated yet. Please have a look at the English - version.

      -
      top

      Directiva SSLCADNRequestFile

      Descripción:Fichero de certificados CA concatenados codificados en PEM para @@ -507,18 +491,6 @@ apropiados.

      top
      -

      Directiva SSLCADNRequestURI

      - - - - - - -
      Descripción:certificate store of CA Certificates for defining -acceptable CA names
      Sintaxis:SSLCADNRequestURI uri
      Contexto:server config, virtual host
      Estado:Extensión
      Módulo:mod_ssl

      The documentation for this directive has - not been translated yet. Please have a look at the English - version.

      -
      top

      Directiva SSLCARevocationCheck

      @@ -621,17 +593,6 @@ que este directorio contiene los enlaces simbólicos apropiados.

      top
      -

      Directiva SSLCARevocationURI

      -
      Descripción:Activar comprobación de revocación basada en CRL
      - - - - - -
      Descripción:Server CA certificate revocation list store for Client Authentication
      Sintaxis:SSLCARevocationURI uri
      Contexto:server config, virtual host
      Estado:Extensión
      Módulo:mod_ssl

      The documentation for this directive has - not been translated yet. Please have a look at the English - version.

      -
      top

      Directiva SSLCertificateChainFile

      Descripción:Fichero de Certificados CA de Servidor codificado en @@ -817,19 +778,6 @@ clave privada en otro fichero.

      top
      -

      Directiva SSLCertificateURI

      - - - - - - - -
      Descripción:Server certificate and key store
      Sintaxis:SSLCertificateURI uri
      Contexto:server config, virtual host
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      The documentation for this directive has - not been translated yet. Please have a look at the English - version.

      -
      top

      Directiva SSLCipherSuite

      Descripción:Conjunto de Cifrados disponibles para negociación en el saludo SSL @@ -1777,19 +1725,6 @@ apropiados.

      top
      -

      Directiva SSLProxyCACertificateURI

      - - - - - - - -
      Descripción:Proxy CA certificate store for Remote Server Auth
      Sintaxis:SSLProxyCACertificateURI uri
      Contexto:server config, virtual host, sección de proxy
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      The documentation for this directive has - not been translated yet. Please have a look at the English - version.

      -
      top

      Directiva SSLProxyCARevocationCheck

      Descripción:Activa la comprobación de revocación basada en CRL para la @@ -1878,19 +1813,6 @@ directorio tiene los enlaces simbólicos apropiados.

      top
      -

      Directiva SSLProxyCARevocationURI

      - - - - - - - -
      Descripción:Proxy CA certificate revocation list store for Remote Server Auth
      Sintaxis:SSLProxyCARevocationURI uri
      Contexto:server config, virtual host, sección de proxy
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      The documentation for this directive has - not been translated yet. Please have a look at the English - version.

      -
      top

      Directiva SSLProxyCheckPeerCN

      Descripción:Comprobar el campo CN del certificado del servidor remoto @@ -2134,19 +2056,6 @@ de que este directorio contiene los enlaces simbólicos apropiados.

      top
      -

      Directiva SSLProxyMachineCertificateURI

      - - - - - - - -
      Descripción:Proxy certificate and key stores
      Sintaxis:SSLProxyMachineCertificateURI uri
      Contexto:server config, virtual host, sección de proxy
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      The documentation for this directive has - not been translated yet. Please have a look at the English - version.

      -
      top

      Directiva SSLProxyProtocol

      Descripción:Configure sabores de protocolo SSL utilizables para uso de @@ -2168,6 +2077,32 @@ información adicional.
      top
      +

      Directiva SSLProxyStoreURI

      + + + + + + + +
      Descripción:Proxy certificate and key stores
      Sintaxis:SSLProxyStoreURI uri
      Contexto:server config, virtual host, sección de proxy
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.

      The documentation for this directive has + not been translated yet. Please have a look at the English + version.

      +
      top
      +

      Directiva SSLProxyTrustURI

      + + + + + + + +
      Descripción:Proxy CA certificate store for Remote Server Auth
      Sintaxis:SSLProxyTrustURI uri
      Contexto:server config, virtual host, sección de proxy
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.

      The documentation for this directive has + not been translated yet. Please have a look at the English + version.

      +
      top

      Directiva SSLProxyVerify

      @@ -2900,6 +2835,19 @@ usa para controlar el límite de tiempo para respuestas inválidas/i
      top
      +

      Directiva SSLStoreURI

      +
      Descripción:Tipo de verficación de certificado del servidor remoto
      + + + + + + +
      Descripción:Server certificate and key store
      Sintaxis:SSLStoreURI uri
      Contexto:server config, virtual host
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.

      The documentation for this directive has + not been translated yet. Please have a look at the English + version.

      +
      top

      Directiva SSLStrictSNIVHostCheck

      Descripción:Permitir o no a clientes no-SNI acceder a host virtuales basados @@ -2931,6 +2879,32 @@ compatible con SNI de OpenSSL.
      top
      +

      Directiva SSLTrustRequestURI

      + + + + + + +
      Descripción:certificate store of CA Certificates for defining +acceptable CA names
      Sintaxis:SSLTrustRequestURI uri
      Contexto:server config, virtual host
      Estado:Extensión
      Módulo:mod_ssl

      The documentation for this directive has + not been translated yet. Please have a look at the English + version.

      +
      top
      +

      Directiva SSLTrustURI

      + + + + + + + + +
      Descripción:Server CA certificate store for Client Authentication
      Sintaxis:SSLTrustURI uri
      Contexto:server config, virtual host
      Anula:AuthConfig
      Estado:Extensión
      Módulo:mod_ssl
      Compatibilidad:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.

      The documentation for this directive has + not been translated yet. Please have a look at the English + version.

      +
      top

      Directiva SSLUserName

      diff --git a/docs/manual/mod/mod_ssl.html.fr.utf8 b/docs/manual/mod/mod_ssl.html.fr.utf8 index 322ba726c02..f78e1feb0e5 100644 --- a/docs/manual/mod/mod_ssl.html.fr.utf8 +++ b/docs/manual/mod/mod_ssl.html.fr.utf8 @@ -61,18 +61,14 @@ disponibles avec Require
      Descripción:Nombre de variable para determinar el nombre de usuario
      - - - - - - - -
      Description:Server CA certificate store for Client Authentication
      Syntaxe:SSLCACertificateURI uri
      Contexte:configuration globale, serveur virtuel
      Surcharges autorisées:AuthConfig
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      La documentation de cette directive - n'a pas encore été traduite. Veuillez vous reporter à la version - en langue anglaise.

      -
      top

      Directive SSLCADNRequestFile

      Description:Fichier contenant la concaténation des certificats de CA @@ -645,18 +629,6 @@ effet.

      top
      -

      Directive SSLCADNRequestURI

      - - - - - - -
      Description:certificate store of CA Certificates for defining -acceptable CA names
      Syntaxe:SSLCADNRequestURI uri
      Contexte:configuration globale, serveur virtuel
      Statut:Extension
      Module:mod_ssl

      La documentation de cette directive - n'a pas encore été traduite. Veuillez vous reporter à la version - en langue anglaise.

      -
      top

      Directive SSLCARevocationCheck

      @@ -782,17 +754,6 @@ effet.

      top
      -

      Directive SSLCARevocationURI

      -
      Description:Active la vérification des révocations basée sur les CRL
      - - - - - -
      Description:Server CA certificate revocation list store for Client Authentication
      Syntaxe:SSLCARevocationURI uri
      Contexte:configuration globale, serveur virtuel
      Statut:Extension
      Module:mod_ssl

      La documentation de cette directive - n'a pas encore été traduite. Veuillez vous reporter à la version - en langue anglaise.

      -
      top

      Directive SSLCertificateChainFile

      Description:Fichier contenant les certificats de CA du serveur codés en @@ -1042,19 +1003,6 @@ changements prennent effet.

      top
      -

      Directive SSLCertificateURI

      - - - - - - - -
      Description:Server certificate and key store
      Syntaxe:SSLCertificateURI uri
      Contexte:configuration globale, serveur virtuel
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      La documentation de cette directive - n'a pas encore été traduite. Veuillez vous reporter à la version - en langue anglaise.

      -
      top

      Directive SSLCipherSuite

      Description:Algorithmes de chiffrement disponibles pour la négociation @@ -2201,19 +2149,6 @@ assurer que ce répertoire contient les liens symboliques approprié
      top
      -

      Directive SSLProxyCACertificateURI

      - - - - - - - -
      Description:Proxy CA certificate store for Remote Server Auth
      Syntaxe:SSLProxyCACertificateURI uri
      Contexte:configuration globale, serveur virtuel,
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      La documentation de cette directive - n'a pas encore été traduite. Veuillez vous reporter à la version - en langue anglaise.

      -
      top

      Directive SSLProxyCARevocationCheck

      Description:Active la vérification des révocations basée sur les CRLs @@ -2309,19 +2244,6 @@ assurer que ce répertoire contient les liens symboliques approprié
      top
      -

      Directive SSLProxyCARevocationURI

      - - - - - - - -
      Description:Proxy CA certificate revocation list store for Remote Server Auth
      Syntaxe:SSLProxyCARevocationURI uri
      Contexte:configuration globale, serveur virtuel,
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      La documentation de cette directive - n'a pas encore été traduite. Veuillez vous reporter à la version - en langue anglaise.

      -
      top

      Directive SSLProxyCheckPeerCN

      Description:Configuration de la vérification du champ CN du certificat @@ -2621,19 +2543,6 @@ PRIVATE KEY-----", doivent être converties via une commande du styl
      top
      -

      Directive SSLProxyMachineCertificateURI

      - - - - - - - -
      Description:Proxy certificate and key stores
      Syntaxe:SSLProxyMachineCertificateURI uri
      Contexte:configuration globale, serveur virtuel,
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later.

      La documentation de cette directive - n'a pas encore été traduite. Veuillez vous reporter à la version - en langue anglaise.

      -
      top

      Directive SSLProxyProtocol

      Description:Définit les protocoles SSL disponibles pour la fonction de @@ -2657,6 +2566,32 @@ des protocoles spécifiés.

      top
      +

      Directive SSLProxyStoreURI

      + + + + + + + +
      Description:Proxy certificate and key stores
      Syntaxe:SSLProxyStoreURI uri
      Contexte:configuration globale, serveur virtuel,
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.

      La documentation de cette directive + n'a pas encore été traduite. Veuillez vous reporter à la version + en langue anglaise.

      +
      top
      +

      Directive SSLProxyTrustURI

      + + + + + + + +
      Description:Proxy CA certificate store for Remote Server Auth
      Syntaxe:SSLProxyTrustURI uri
      Contexte:configuration globale, serveur virtuel,
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.

      La documentation de cette directive + n'a pas encore été traduite. Veuillez vous reporter à la version + en langue anglaise.

      +
      top

      Directive SSLProxyVerify

      Description:Niveau de vérification du certificat du serveur @@ -3432,6 +3367,19 @@ réponses invalides ou non disponibles.
      top
      +

      Directive SSLStoreURI

      + + + + + + + +
      Description:Server certificate and key store
      Syntaxe:SSLStoreURI uri
      Contexte:configuration globale, serveur virtuel
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.

      La documentation de cette directive + n'a pas encore été traduite. Veuillez vous reporter à la version + en langue anglaise.

      +
      top

      Directive SSLStrictSNIVHostCheck

      Description:Contrôle de l'accès des clients non-SNI à un serveur virtuel à @@ -3473,6 +3421,32 @@ version d'OpenSSL supportant SNI.
      top
      +

      Directive SSLTrustRequestURI

      + + + + + + +
      Description:certificate store of CA Certificates for defining +acceptable CA names
      Syntaxe:SSLTrustRequestURI uri
      Contexte:configuration globale, serveur virtuel
      Statut:Extension
      Module:mod_ssl

      La documentation de cette directive + n'a pas encore été traduite. Veuillez vous reporter à la version + en langue anglaise.

      +
      top
      +

      Directive SSLTrustURI

      + + + + + + + + +
      Description:Server CA certificate store for Client Authentication
      Syntaxe:SSLTrustURI uri
      Contexte:configuration globale, serveur virtuel
      Surcharges autorisées:AuthConfig
      Statut:Extension
      Module:mod_ssl
      Compatibilité:Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later.

      La documentation de cette directive + n'a pas encore été traduite. Veuillez vous reporter à la version + en langue anglaise.

      +
      top

      Directive SSLUserName

      - - - - + - - - - + + + - - + + + diff --git a/docs/manual/mod/quickreference.html.de b/docs/manual/mod/quickreference.html.de index 1510b4683d4..bd390183402 100644 --- a/docs/manual/mod/quickreference.html.de +++ b/docs/manual/mod/quickreference.html.de @@ -1181,23 +1181,18 @@ displayed for Client Auth - - - - - - - - - + + + @@ -1227,13 +1222,11 @@ keys for Remote Server Auth - - - + - - - - - - + + + + - - - + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + diff --git a/docs/manual/mod/quickreference.html.en.utf8 b/docs/manual/mod/quickreference.html.en.utf8 index 63120e92c52..1d42c5fb17b 100644 --- a/docs/manual/mod/quickreference.html.en.utf8 +++ b/docs/manual/mod/quickreference.html.en.utf8 @@ -1169,23 +1169,18 @@ displayed for Client Auth - - - - - - - - - + + + @@ -1215,13 +1210,11 @@ keys for Remote Server Auth - - - + - - - - - - + + + + - - - + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + diff --git a/docs/manual/mod/quickreference.html.es.utf8 b/docs/manual/mod/quickreference.html.es.utf8 index 9dda9a58ef0..f7cc9dbc2b3 100644 --- a/docs/manual/mod/quickreference.html.es.utf8 +++ b/docs/manual/mod/quickreference.html.es.utf8 @@ -1161,25 +1161,20 @@ displayed la Autenticación de Cliente - - - - - - - - - + + @@ -1219,14 +1214,12 @@ respuesta OCSP la Autenticación Remota del Servidor - - - - - ser usadas por el proxy - - - - + + + - - - - - - + - - - - - - + + + + - - - - - + + - - + + + diff --git a/docs/manual/mod/quickreference.html.fr.utf8 b/docs/manual/mod/quickreference.html.fr.utf8 index be7cf899f77..22a9b2689be 100644 --- a/docs/manual/mod/quickreference.html.fr.utf8 +++ b/docs/manual/mod/quickreference.html.fr.utf8 @@ -1493,26 +1493,21 @@ d'une variable non définie codés en PEM pour l'authentification des clients - - - - - - - - - @@ -1553,14 +1548,12 @@ disponibles codés en PEM pour l'authentification des serveurs distants - - - - - @@ -1580,49 +1573,54 @@ mandataire de choisir un certificat clients codés en PEM que le mandataire doit utiliser - - - + + - - - - - - - - - - - - - + + + + - - + - - - - - + + + + diff --git a/docs/manual/mod/quickreference.html.ja.utf8 b/docs/manual/mod/quickreference.html.ja.utf8 index 2022a766912..1fa2e5a502c 100644 --- a/docs/manual/mod/quickreference.html.ja.utf8 +++ b/docs/manual/mod/quickreference.html.ja.utf8 @@ -1102,23 +1102,18 @@ server. for Client Auth - - - - - - - - - + + + @@ -1148,13 +1143,11 @@ keys for Remote Server Auth - - - + - - - - - - + + + + - - - + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + diff --git a/docs/manual/mod/quickreference.html.ko.euc-kr b/docs/manual/mod/quickreference.html.ko.euc-kr index babae52578f..1a1c36da3bc 100644 --- a/docs/manual/mod/quickreference.html.ko.euc-kr +++ b/docs/manual/mod/quickreference.html.ko.euc-kr @@ -1127,23 +1127,18 @@ displayed for Client Auth - - - - - - - - - + + + @@ -1173,13 +1168,11 @@ keys for Remote Server Auth - - - + - - - - - - + + + + - - - + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + diff --git a/docs/manual/mod/quickreference.html.tr.utf8 b/docs/manual/mod/quickreference.html.tr.utf8 index f3bbfb60987..563562274d4 100644 --- a/docs/manual/mod/quickreference.html.tr.utf8 +++ b/docs/manual/mod/quickreference.html.tr.utf8 @@ -1166,23 +1166,18 @@ displayed for Client Auth - - - - - - - - - + + + @@ -1212,13 +1207,11 @@ keys for Remote Server Auth - - - + - - - - - - + + + + - - - + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + diff --git a/docs/manual/mod/quickreference.html.zh-cn.utf8 b/docs/manual/mod/quickreference.html.zh-cn.utf8 index 6d12b27beb2..e302f30a4b3 100644 --- a/docs/manual/mod/quickreference.html.zh-cn.utf8 +++ b/docs/manual/mod/quickreference.html.zh-cn.utf8 @@ -1164,23 +1164,18 @@ displayed for Client Auth - - - - - - - - - + + + @@ -1210,13 +1205,11 @@ keys for Remote Server Auth - - - + - - - - - - + + + + - - - + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + From 763b50e3bce4b36199c1fb272426c0ae8979eeac Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Sat, 1 Aug 2026 20:04:47 +0100 Subject: [PATCH 42/50] * test/pytest_suite/conftest.py (framework): Record error_log's size before httpd starts, as session_log_start. * test/pytest_suite/tests/t/modules/test_proxy_beacon.py (test_proxy_beacon): Scope the "added backend" log check to session_log_start instead of the per-test window or byte 0. Assisted-by: Claude Sonnet 5 --- test/pytest_suite/conftest.py | 12 ++++++++++++ .../tests/t/modules/test_proxy_beacon.py | 19 +++++++++++++++++-- 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/test/pytest_suite/conftest.py b/test/pytest_suite/conftest.py index 5ffb1cbd79e..9fbaa80efe5 100644 --- a/test/pytest_suite/conftest.py +++ b/test/pytest_suite/conftest.py @@ -250,6 +250,18 @@ def framework(request: pytest.FixtureRequest): ) fpm_mgr.start() + # Record the error_log size right before this session's httpd starts. + # error_log is opened in append mode and t_logs/ is not cleaned between + # invocations, so it can carry entries from earlier, unrelated test runs + # (possibly hours/days old, with different pids). Tests that need "since + # this server session started" (as opposed to "since this individual + # test started") must scope their log reads to this offset, not to + # position 0 -- see test_proxy_beacon.py. + error_log = Path(config.vars["t_logs"]) / "error_log" + config.vars["session_log_start"] = str( + error_log.stat().st_size if error_log.exists() else 0 + ) + server = HttpdServer(config) server.start() try: diff --git a/test/pytest_suite/tests/t/modules/test_proxy_beacon.py b/test/pytest_suite/tests/t/modules/test_proxy_beacon.py index 2fa951c3d60..bab950c7353 100644 --- a/test/pytest_suite/tests/t/modules/test_proxy_beacon.py +++ b/test/pytest_suite/tests/t/modules/test_proxy_beacon.py @@ -68,6 +68,19 @@ def test_proxy_beacon(http): fh.seek(start) loglines = fh.read().splitlines() + # "added backend" is logged once ever per url for the life of the + # (session-scoped) httpd process -- it dedups via ctx->seen in + # mod_proxy_beacon (beacon_try_add()/beacon_handle_announce()). Since this + # test may run long after server startup, that one-time event can predate + # `start` and must be searched for since session start instead. Do NOT + # scan from byte 0 of error_log: t_logs/ isn't cleaned between separate + # test runs, so the file can carry "added backend" lines from earlier, + # unrelated httpd sessions (different pids, possibly hours old). + session_start = int(http.vars("session_log_start") or 0) + with error_log.open("r", errors="replace") as fh: + fh.seek(session_start) + session_loglines = fh.read().splitlines() + # Announcements are received and carry a routable url=. received = [ln for ln in loglines if "received: BEACON" in ln] assert received, "no announcements received by the SUB" @@ -77,7 +90,7 @@ def test_proxy_beacon(http): # Phase 2: the backend was added exactly once (dedup), no add-failure spam. # Qualify by balancer://beacon so the capacity-test balancer (below) doesn't # perturb these counts. - added = [ln for ln in loglines + added = [ln for ln in session_loglines if "added backend" in ln and "balancer://beacon" in ln] assert len(added) == 1, ( f"backend should be added exactly once; saw {len(added)}: {added}") @@ -103,7 +116,9 @@ def test_proxy_beacon(http): # Slot exhaustion: balancer://cap has room for one member but two backends # announce to it. Exactly one must be added; the other can never fit. - cap_added = [ln for ln in loglines + # Same one-time-dedup-event caveat as the balancer://beacon "added" check + # above: search since session start, not just this test's window. + cap_added = [ln for ln in session_loglines if "added backend" in ln and "balancer://cap" in ln] assert len(cap_added) == 1, ( f"exactly one backend should fit balancer://cap; saw: {cap_added}") From 35e01630bfc8767087bc963759775b097742934d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Sat, 1 Aug 2026 20:04:53 +0100 Subject: [PATCH 43/50] * test/pyhttpd/env.py (has_h2load): Verify h2load actually resolves, instead of just checking the config string is non-empty. Assisted-by: Claude Sonnet 5 --- test/pyhttpd/env.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/test/pyhttpd/env.py b/test/pyhttpd/env.py index e3cf1e72317..a3e020dd994 100644 --- a/test/pyhttpd/env.py +++ b/test/pyhttpd/env.py @@ -508,7 +508,15 @@ def httpd_is_at_least(self, minv): return hv >= self._versiontuple(minv) def has_h2load(self): - return self._h2load != "" + if self._h2load == "": + return False + # config.ini/default may just be the bare command name ("h2load"), + # not a verified path -- confirm it actually resolves so + # h2load_is_at_least() below doesn't crash with FileNotFoundError + # (breaking test collection) when the tool isn't installed. + if os.path.dirname(self._h2load): + return os.path.isfile(self._h2load) and os.access(self._h2load, os.X_OK) + return self.has_tool(self._h2load) def h2load_is_at_least(self, minv): if not self.has_h2load(): From 88442f0a0ffb8037be5296adaa8aab628bd687ce Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Sat, 1 Aug 2026 20:05:02 +0100 Subject: [PATCH 44/50] test/modules/aaa: Add a pytest suite for mod_auth_digest. Covers RFC 2617 challenge/response, nonce lifecycle (tamper/stale/ expiry/one-time), AuthDigestNcCheck, AuthDigestDomain, provider fallback, and config-time validation. Assisted-by: Claude Sonnet 5 --- test/modules/aaa/__init__.py | 0 test/modules/aaa/conftest.py | 87 +++++++++ test/modules/aaa/digest_client.py | 134 +++++++++++++ test/modules/aaa/env.py | 79 ++++++++ .../aaa/htdocs/digest/default/secret.txt | 1 + .../htdocs/digest/domain/nested/secret.txt | 1 + .../aaa/htdocs/digest/domain/secret.txt | 1 + .../aaa/htdocs/digest/nccheck/secret.txt | 1 + .../aaa/htdocs/digest/neverexpire/secret.txt | 1 + .../aaa/htdocs/digest/noprovider/secret.txt | 1 + .../aaa/htdocs/digest/onetime/secret.txt | 1 + .../aaa/htdocs/digest/shortlife/secret.txt | 1 + .../aaa/test_001_challenge_response.py | 180 ++++++++++++++++++ test/modules/aaa/test_002_nonce.py | 129 +++++++++++++ test/modules/aaa/test_003_nccheck.py | 99 ++++++++++ test/modules/aaa/test_004_domain.py | 56 ++++++ test/modules/aaa/test_005_provider.py | 37 ++++ test/modules/aaa/test_006_config_errors.py | 86 +++++++++ 18 files changed, 895 insertions(+) create mode 100644 test/modules/aaa/__init__.py create mode 100644 test/modules/aaa/conftest.py create mode 100644 test/modules/aaa/digest_client.py create mode 100644 test/modules/aaa/env.py create mode 100644 test/modules/aaa/htdocs/digest/default/secret.txt create mode 100644 test/modules/aaa/htdocs/digest/domain/nested/secret.txt create mode 100644 test/modules/aaa/htdocs/digest/domain/secret.txt create mode 100644 test/modules/aaa/htdocs/digest/nccheck/secret.txt create mode 100644 test/modules/aaa/htdocs/digest/neverexpire/secret.txt create mode 100644 test/modules/aaa/htdocs/digest/noprovider/secret.txt create mode 100644 test/modules/aaa/htdocs/digest/onetime/secret.txt create mode 100644 test/modules/aaa/htdocs/digest/shortlife/secret.txt create mode 100644 test/modules/aaa/test_001_challenge_response.py create mode 100644 test/modules/aaa/test_002_nonce.py create mode 100644 test/modules/aaa/test_003_nccheck.py create mode 100644 test/modules/aaa/test_004_domain.py create mode 100644 test/modules/aaa/test_005_provider.py create mode 100644 test/modules/aaa/test_006_config_errors.py diff --git a/test/modules/aaa/__init__.py b/test/modules/aaa/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/test/modules/aaa/conftest.py b/test/modules/aaa/conftest.py new file mode 100644 index 00000000000..3e50e5a2d0f --- /dev/null +++ b/test/modules/aaa/conftest.py @@ -0,0 +1,87 @@ +import logging +import os +import sys + +import pytest + +from .env import AAATestEnv +from pyhttpd.conf import HttpdConf + +sys.path.append(os.path.join(os.path.dirname(__file__), '../..')) + + +def pytest_report_header(config, start_path): + env = AAATestEnv() + return f"mod_auth_digest [apache: {env.get_httpd_version()}, mpm: {env.mpm_module}, {env.prefix}]" + + +def _digest_dir(docs, path, extra_lines): + lines = [ + f'', + ' AuthType Digest', + f' AuthName "{AAATestEnv.REALM}"', + ] + lines.extend(f" {l}" for l in extra_lines) + lines.append(' Require valid-user') + lines.append('') + return lines + + +@pytest.fixture(scope="package") +def env(pytestconfig) -> AAATestEnv: + level = logging.INFO + console = logging.StreamHandler() + console.setLevel(level) + console.setFormatter(logging.Formatter('%(levelname)s: %(message)s')) + logging.getLogger('').addHandler(console) + logging.getLogger('').setLevel(level=level) + env = AAATestEnv(pytestconfig=pytestconfig) + env.setup_httpd() + env.apache_access_log_clear() + env.httpd_error_log.clear_log() + + docs = env.server_docs_dir + pwfile = env.digest_pwfile + conf = HttpdConf(env) + conf.add(_digest_dir(docs, "default", [ + 'AuthDigestProvider file', + f'AuthUserFile "{pwfile}"', + ])) + conf.add(_digest_dir(docs, "nccheck", [ + 'AuthDigestProvider file', + f'AuthUserFile "{pwfile}"', + 'AuthDigestNcCheck On', + ])) + conf.add(_digest_dir(docs, "shortlife", [ + 'AuthDigestProvider file', + f'AuthUserFile "{pwfile}"', + 'AuthDigestNonceLifetime 2', + ])) + conf.add(_digest_dir(docs, "neverexpire", [ + 'AuthDigestProvider file', + f'AuthUserFile "{pwfile}"', + 'AuthDigestNonceLifetime -1', + ])) + conf.add(_digest_dir(docs, "onetime", [ + 'AuthDigestProvider file', + f'AuthUserFile "{pwfile}"', + 'AuthDigestNonceLifetime 0', + ])) + conf.add(_digest_dir(docs, "domain", [ + 'AuthDigestProvider file', + f'AuthUserFile "{pwfile}"', + 'AuthDigestDomain "/digest/domain/" "https://mirror.example.org/other/"', + ])) + conf.add(_digest_dir(docs, "noprovider", [ + # AuthDigestProvider intentionally omitted: falls back to "file". + f'AuthUserFile "{pwfile}"', + ])) + conf.install() + assert env.apache_restart() == 0 + return env + + +@pytest.fixture(autouse=True, scope="package") +def _stop_package_scope(env): + yield + assert env.apache_stop() == 0 diff --git a/test/modules/aaa/digest_client.py b/test/modules/aaa/digest_client.py new file mode 100644 index 00000000000..b0acf0fc8ad --- /dev/null +++ b/test/modules/aaa/digest_client.py @@ -0,0 +1,134 @@ +"""Minimal hand-rolled RFC 2617 Digest auth client. + +curl's own `--digest` handles the challenge/response handshake transparently, +which is no good for testing edge cases (tampered nonces, replayed +nonce-counts, wrong realms, bad algorithm tokens, ...). This module lets +tests parse a WWW-Authenticate challenge, compute the expected response by +hand, and build a (possibly deliberately broken) Authorization header. + +mod_auth_digest here only implements qop="auth" (see modules/aaa/mod_auth_digest.c +Open Issues: "MD5-sess and auth-int are not yet implemented"), so this client +only implements the qop=auth request-digest/response-auth formulas from +RFC 2617 section 3.2.2. +""" + +import hashlib +import re +from dataclasses import dataclass +from typing import Dict, List, Optional + +_PARAM_RE = re.compile(r'(\w+)=(?:"([^"]*)"|([^\s,]+))\s*,?\s*') + + +def _md5hex(s: str) -> str: + return hashlib.md5(s.encode('utf-8')).hexdigest() + + +def parse_params(value: str) -> Dict[str, str]: + """Parse a comma-separated key=value / key="value" list, as used by + both WWW-Authenticate and Authentication-Info header values.""" + params = {} + for m in _PARAM_RE.finditer(value): + key = m.group(1) + val = m.group(2) if m.group(2) is not None else m.group(3) + params[key.lower()] = val + return params + + +@dataclass +class DigestChallenge: + realm: Optional[str] + nonce: Optional[str] + algorithm: Optional[str] = None + opaque: Optional[str] = None + domain: Optional[str] = None + qop: Optional[str] = None + stale: bool = False + raw: str = "" + + @staticmethod + def parse(www_authenticate: str) -> 'DigestChallenge': + assert www_authenticate.startswith("Digest "), \ + f"not a Digest challenge: {www_authenticate}" + params = parse_params(www_authenticate[len("Digest "):]) + return DigestChallenge( + realm=params.get('realm'), + nonce=params.get('nonce'), + algorithm=params.get('algorithm'), + opaque=params.get('opaque'), + domain=params.get('domain'), + qop=params.get('qop'), + stale=params.get('stale', '').lower() == 'true', + raw=www_authenticate, + ) + + def domain_list(self) -> List[str]: + return self.domain.split() if self.domain else [] + + +def ha1(username: str, realm: str, password: str) -> str: + return _md5hex(f"{username}:{realm}:{password}") + + +def ha2(method: str, uri: str) -> str: + return _md5hex(f"{method}:{uri}") + + +def request_digest(ha1_hex: str, nonce: str, nc: str, cnonce: str, + qop: str, ha2_hex: str) -> str: + return _md5hex(f"{ha1_hex}:{nonce}:{nc}:{cnonce}:{qop}:{ha2_hex}") + + +def rspauth_digest(ha1_hex: str, nonce: str, nc: str, cnonce: str, + qop: str, uri: str) -> str: + """Authentication-Info's rspauth uses A2 = ':' + uri (no method).""" + ha2_hex = _md5hex(f":{uri}") + return _md5hex(f"{ha1_hex}:{nonce}:{nc}:{cnonce}:{qop}:{ha2_hex}") + + +def build_authorization(username: str, challenge: DigestChallenge, password: str, + method: str, uri: str, nc: str = "00000001", + cnonce: str = "0a4f113b3c2e7a1d", qop: Optional[str] = "auth", + realm: Optional[str] = None, nonce_val: Optional[str] = None, + algorithm: Optional[str] = None, response: Optional[str] = None, + opaque: Optional[str] = None, include_opaque: bool = True, + include_qop_fields: bool = True, extra: Optional[List[str]] = None + ) -> str: + """Build a Digest Authorization header value. + + By default this builds a *correct* response for the given challenge and + credentials. Any of realm=/nonce_val=/algorithm=/response=/opaque= can be + overridden to construct deliberately invalid headers, and qop=None with + include_qop_fields=False builds a legacy RFC 2069-style header (no qop, + cnonce, or nc) to prove that path is rejected. + """ + eff_realm = challenge.realm if realm is None else realm + eff_nonce = challenge.nonce if nonce_val is None else nonce_val + if response is None: + h1 = ha1(username, eff_realm, password) + h2 = ha2(method, uri) + if qop: + response = request_digest(h1, eff_nonce, nc, cnonce, qop, h2) + else: + # legacy RFC 2069: MD5(HA1:nonce:HA2), no qop/cnonce/nc + response = _md5hex(f"{h1}:{eff_nonce}:{h2}") + + parts = [ + f'username="{username}"', + f'realm="{eff_realm}"', + f'nonce="{eff_nonce}"', + f'uri="{uri}"', + f'response="{response}"', + ] + if algorithm is not None: + parts.append(f'algorithm={algorithm}') + if qop and include_qop_fields: + parts.append(f'qop={qop}') + parts.append(f'nc={nc}') + parts.append(f'cnonce="{cnonce}"') + eff_opaque = challenge.opaque if (opaque is None and include_opaque) else opaque + if eff_opaque: + parts.append(f'opaque="{eff_opaque}"') + if extra: + parts.extend(extra) + return "Digest " + ", ".join(parts) diff --git a/test/modules/aaa/env.py b/test/modules/aaa/env.py new file mode 100644 index 00000000000..0e8ed377e9c --- /dev/null +++ b/test/modules/aaa/env.py @@ -0,0 +1,79 @@ +import hashlib +import inspect +import logging +import os +from typing import List, Optional + +from pyhttpd.env import HttpdTestEnv, HttpdTestSetup +from pyhttpd.result import ExecResult + +log = logging.getLogger(__name__) + + +class AAATestSetup(HttpdTestSetup): + + def __init__(self, env: 'HttpdTestEnv'): + super().__init__(env=env) + self.add_source_dir(os.path.dirname(inspect.getfile(AAATestSetup))) + self.add_modules(["auth_digest", "authn_file", "authn_core", + "authz_core", "authz_user"]) + + +class AAATestEnv(HttpdTestEnv): + + REALM = "AAA Digest Realm" + DIGEST_USER = "digestuser" + DIGEST_PASSWORD = "digestpass2617" + DIGEST_USER2 = "otheruser" + DIGEST_PASSWORD2 = "otherpass2617" + + def __init__(self, pytestconfig=None): + super().__init__(pytestconfig=pytestconfig) + self.add_httpd_log_modules(["auth_digest", "authn_file", "authz_core"]) + self._digest_pwfile = os.path.join(self.server_dir, "digest.passwd") + + def setup_httpd(self, setup: HttpdTestSetup = None): + super().setup_httpd(setup=AAATestSetup(env=self)) + self._write_digest_pwfile() + + def _write_digest_pwfile(self): + def ha1(user, password): + return hashlib.md5( + f"{user}:{self.REALM}:{password}".encode()).hexdigest() + + with open(self._digest_pwfile, 'w') as fd: + fd.write(f"{self.DIGEST_USER}:{self.REALM}:" + f"{ha1(self.DIGEST_USER, self.DIGEST_PASSWORD)}\n") + fd.write(f"{self.DIGEST_USER2}:{self.REALM}:" + f"{ha1(self.DIGEST_USER2, self.DIGEST_PASSWORD2)}\n") + + @property + def digest_pwfile(self) -> str: + return self._digest_pwfile + + def configtest(self, directory_lines: List[str], extra_top_lines: Optional[List[str]] = None + ) -> ExecResult: + """Run `httpd -t` against a minimal, standalone config built from the + already-generated modules.conf plus `directory_lines` wrapped in a + block over the shared docroot. Used to test directives + that are rejected at config-check time (e.g. AuthDigestQop values + other than 'auth') without touching the package's running server. + """ + conf_path = os.path.join(self.gen_dir, "digest-configtest.conf") + modules_conf = os.path.join(self.server_conf_dir, "modules.conf") + lines = [ + f'ServerRoot "{self.server_dir}"', + f'Include "{modules_conf}"', + f'DocumentRoot "{self.server_docs_dir}"', + f'Listen {self.http_port2}', + ] + if extra_top_lines: + lines.extend(extra_top_lines) + lines.append(f'') + lines.extend(f" {l}" for l in directory_lines) + lines.append('') + with open(conf_path, 'w') as fd: + fd.write('\n'.join(lines)) + fd.write('\n') + httpd_bin = os.path.join(self.bin_dir, 'httpd') + return self.run([httpd_bin, '-t', '-f', conf_path]) diff --git a/test/modules/aaa/htdocs/digest/default/secret.txt b/test/modules/aaa/htdocs/digest/default/secret.txt new file mode 100644 index 00000000000..6135131adf6 --- /dev/null +++ b/test/modules/aaa/htdocs/digest/default/secret.txt @@ -0,0 +1 @@ +digest-default-secret diff --git a/test/modules/aaa/htdocs/digest/domain/nested/secret.txt b/test/modules/aaa/htdocs/digest/domain/nested/secret.txt new file mode 100644 index 00000000000..28140b2a187 --- /dev/null +++ b/test/modules/aaa/htdocs/digest/domain/nested/secret.txt @@ -0,0 +1 @@ +digest-domain-nested-secret diff --git a/test/modules/aaa/htdocs/digest/domain/secret.txt b/test/modules/aaa/htdocs/digest/domain/secret.txt new file mode 100644 index 00000000000..1103f6e9a0c --- /dev/null +++ b/test/modules/aaa/htdocs/digest/domain/secret.txt @@ -0,0 +1 @@ +digest-domain-secret diff --git a/test/modules/aaa/htdocs/digest/nccheck/secret.txt b/test/modules/aaa/htdocs/digest/nccheck/secret.txt new file mode 100644 index 00000000000..fe15209e018 --- /dev/null +++ b/test/modules/aaa/htdocs/digest/nccheck/secret.txt @@ -0,0 +1 @@ +digest-nccheck-secret diff --git a/test/modules/aaa/htdocs/digest/neverexpire/secret.txt b/test/modules/aaa/htdocs/digest/neverexpire/secret.txt new file mode 100644 index 00000000000..5375ef5f8d2 --- /dev/null +++ b/test/modules/aaa/htdocs/digest/neverexpire/secret.txt @@ -0,0 +1 @@ +digest-neverexpire-secret diff --git a/test/modules/aaa/htdocs/digest/noprovider/secret.txt b/test/modules/aaa/htdocs/digest/noprovider/secret.txt new file mode 100644 index 00000000000..f9de590a307 --- /dev/null +++ b/test/modules/aaa/htdocs/digest/noprovider/secret.txt @@ -0,0 +1 @@ +digest-noprovider-secret diff --git a/test/modules/aaa/htdocs/digest/onetime/secret.txt b/test/modules/aaa/htdocs/digest/onetime/secret.txt new file mode 100644 index 00000000000..945bf8d92d3 --- /dev/null +++ b/test/modules/aaa/htdocs/digest/onetime/secret.txt @@ -0,0 +1 @@ +digest-onetime-secret diff --git a/test/modules/aaa/htdocs/digest/shortlife/secret.txt b/test/modules/aaa/htdocs/digest/shortlife/secret.txt new file mode 100644 index 00000000000..fe422776b36 --- /dev/null +++ b/test/modules/aaa/htdocs/digest/shortlife/secret.txt @@ -0,0 +1 @@ +digest-shortlife-secret diff --git a/test/modules/aaa/test_001_challenge_response.py b/test/modules/aaa/test_001_challenge_response.py new file mode 100644 index 00000000000..aa6ff1217b2 --- /dev/null +++ b/test/modules/aaa/test_001_challenge_response.py @@ -0,0 +1,180 @@ +"""RFC 2617 Digest challenge/response scenarios against mod_auth_digest's +default configuration (AuthDigestProvider file, AuthDigestQop auth (the only +supported value), AuthDigestNonceLifetime 300, no AuthDigestDomain). +""" + +from . import digest_client as dc +from .env import AAATestEnv + + +class TestDigestChallengeResponse: + + def url(self, env, path="secret.txt", location="default"): + return env.mkurl("http", "aaa", f"/digest/{location}/{path}") + + def challenge(self, env, location="default"): + r = env.curl_get(self.url(env, location=location)) + assert r.response["status"] == 401 + return dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + + def test_digest_001_no_credentials(self, env): + # No Authorization header at all -> 401 with a well-formed challenge. + r = env.curl_get(self.url(env)) + assert r.response["status"] == 401 + auth = r.response["header"]["www-authenticate"] + challenge = dc.DigestChallenge.parse(auth) + assert challenge.realm == AAATestEnv.REALM + assert challenge.algorithm == "MD5" + assert challenge.qop == "auth" + assert challenge.stale is False + # no AuthDigestDomain configured for this Location -> no domain= + assert challenge.domain is None + # nonce-count checking is off and lifetime isn't 0 here, so the + # server has no reason to track this client -> no opaque= + assert challenge.opaque is None + + def test_digest_002_success(self, env): + challenge = self.challenge(env) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri="/digest/default/secret.txt") + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 200 + assert r.response["body"].decode() == "digest-default-secret\n" + + def test_digest_003_rspauth(self, env): + # Authentication-Info's rspauth= must match what we independently + # compute from the same HA1 -- proves the server round-trips the + # session parameters (nonce/nc/cnonce/qop) correctly. + challenge = self.challenge(env) + nc = "00000001" + cnonce = "test-cnonce-rspauth" + uri = "/digest/default/secret.txt" + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri=uri, nc=nc, cnonce=cnonce) + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 200 + ai = dc.parse_params(r.response["header"]["authentication-info"]) + h1 = dc.ha1(AAATestEnv.DIGEST_USER, challenge.realm, AAATestEnv.DIGEST_PASSWORD) + expected = dc.rspauth_digest(h1, challenge.nonce, nc, cnonce, "auth", uri) + assert ai["rspauth"] == expected + assert ai["qop"] == "auth" + assert ai["nc"] == nc + assert ai["cnonce"] == cnonce + + def test_digest_004_wrong_password(self, env): + challenge = self.challenge(env) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, "not-the-password", + method="GET", uri="/digest/default/secret.txt") + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH01794"]) + + def test_digest_005_unknown_user(self, env): + challenge = self.challenge(env) + auth = dc.build_authorization( + "no-such-user", challenge, "whatever", + method="GET", uri="/digest/default/secret.txt") + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH01790"]) + + def test_digest_006_second_user(self, env): + # a distinct user in the same password file also works + challenge = self.challenge(env) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER2, challenge, AAATestEnv.DIGEST_PASSWORD2, + method="GET", uri="/digest/default/secret.txt") + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 200 + + def test_digest_007_wrong_realm(self, env): + challenge = self.challenge(env) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri="/digest/default/secret.txt", + realm="Some Other Realm") + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH01788"]) + + def test_digest_008_bad_algorithm_token(self, env): + # a client claiming an algorithm other than MD5 is rejected outright, + # even though the response hash below is computed correctly for MD5. + challenge = self.challenge(env) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri="/digest/default/secret.txt", + algorithm="MD5-sess") + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH01789"]) + + def test_digest_009_legacy_no_qop_rejected(self, env): + # RFC 2069-style digest (no qop/cnonce/nc) is syntactically valid but + # explicitly no longer supported by this module. + challenge = self.challenge(env) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri="/digest/default/secret.txt", + qop=None, include_qop_fields=False) + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH10560"]) + + def test_digest_010_malformed_header_missing_field(self, env): + # missing "uri" entirely -> header is syntactically INVALID, so the + # server issues a fresh (non-stale) challenge rather than evaluating + # the (nonexistent) response hash. + challenge = self.challenge(env) + h1 = dc.ha1(AAATestEnv.DIGEST_USER, challenge.realm, AAATestEnv.DIGEST_PASSWORD) + auth = ('Digest username="digestuser", ' + f'realm="{challenge.realm}", nonce="{challenge.nonce}", ' + f'response="{h1}", qop=auth, nc=00000001, cnonce="x"') + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 401 + new_challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + assert new_challenge.stale is False + env.httpd_error_log.ignore_recent(lognos=["AH01782"]) + + def test_digest_011_wrong_scheme(self, env): + r = env.curl_get(self.url(env), options=[ + "-H", "Authorization: Basic ZGlnZXN0dXNlcjpkaWdlc3RwYXNz"]) + assert r.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH01781"]) + + def test_digest_012_uri_mismatch(self, env): + # The Authorization uri= must match the actual request-target; a + # self-consistent response computed for a *different* uri than the + # one actually requested is rejected as a bad request, before the + # hash is even checked. + challenge = self.challenge(env) + other_uri = "/digest/default/other-secret.txt" + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri=other_uri) + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 400 + env.httpd_error_log.ignore_recent(lognos=["AH01786"]) + + def test_digest_013_invalid_opaque(self, env): + challenge = self.challenge(env) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri="/digest/default/secret.txt", + opaque="not-a-hex-number") + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH01787"]) + + def test_digest_014_tampered_response_hash(self, env): + challenge = self.challenge(env) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri="/digest/default/secret.txt", + response="0" * 32) + r = env.curl_get(self.url(env), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH01794"]) diff --git a/test/modules/aaa/test_002_nonce.py b/test/modules/aaa/test_002_nonce.py new file mode 100644 index 00000000000..3c6079def42 --- /dev/null +++ b/test/modules/aaa/test_002_nonce.py @@ -0,0 +1,129 @@ +"""Nonce lifecycle scenarios: tampered nonces, AuthDigestNonceLifetime +expiry/reissue, a never-expiring nonce, and the one-time-nonce +(AuthDigestNonceLifetime 0) case. +""" + +import time + +from . import digest_client as dc +from .env import AAATestEnv + + +class TestDigestNonce: + + def url(self, env, location, path="secret.txt"): + return env.mkurl("http", "aaa", f"/digest/{location}/{path}") + + def challenge(self, env, location): + r = env.curl_get(self.url(env, location)) + assert r.response["status"] == 401 + return dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + + def authenticate(self, env, location, challenge, nc="00000001", + cnonce="nonce-test-cnonce", uri=None): + uri = uri or f"/digest/{location}/secret.txt" + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri=uri, nc=nc, cnonce=cnonce) + return env.curl_get(self.url(env, location), options=["-H", f"Authorization: {auth}"]) + + def test_digest_020_tampered_nonce_is_stale(self, env): + challenge = self.challenge(env, "default") + # flip a character in the middle of the opaque nonce blob: it stays + # the right length but its embedded hash no longer verifies. + bad = list(challenge.nonce) + mid = len(bad) // 2 + bad[mid] = 'x' if bad[mid] != 'x' else 'y' + challenge.nonce = ''.join(bad) + r = self.authenticate(env, "default", challenge) + assert r.response["status"] == 401 + new_challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + assert new_challenge.stale is True + env.httpd_error_log.ignore_recent(lognos=["AH01776"]) + + def test_digest_021_garbage_nonce_hash_is_stale(self, env): + # A nonce must still look like "b64(time)+sha1hex(hash)" (VALID_NONCE + # in mod_auth_digest.c checks length and the '=' padding boundary) to + # even be considered for a hash check; something that doesn't match + # that shape is instead rejected as a malformed header (see + # test_digest_010). Here we keep the genuine time-prefix (so the + # shape is valid) but replace the whole hash suffix with garbage, to + # hit check_nonce()'s "hash is not %s" path distinctly from + # test_digest_020's single-flipped-character tamper. + challenge = self.challenge(env, "default") + time_prefix = challenge.nonce[:-40] + challenge.nonce = time_prefix + ("f" * 40) + r = self.authenticate(env, "default", challenge) + assert r.response["status"] == 401 + new_challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + assert new_challenge.stale is True + env.httpd_error_log.ignore_recent(lognos=["AH01776"]) + + def test_digest_022_short_lifetime_expires(self, env): + # AuthDigestNonceLifetime 2 for this location. + challenge = self.challenge(env, "shortlife") + r = self.authenticate(env, "shortlife", challenge) + assert r.response["status"] == 200 + + time.sleep(3) + # same nonce, now past its lifetime -> 401 stale=true + r = self.authenticate(env, "shortlife", challenge) + assert r.response["status"] == 401 + stale_challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + assert stale_challenge.stale is True + env.httpd_error_log.ignore_recent(lognos=["AH01776"]) + + # the fresh nonce from the stale challenge works again + r = self.authenticate(env, "shortlife", stale_challenge) + assert r.response["status"] == 200 + + def test_digest_023_never_expiring_nonce(self, env): + # AuthDigestNonceLifetime -1 for this location: no NcCheck is + # configured, so the identical Authorization line can simply be + # replayed after a delay and must still succeed both times. + challenge = self.challenge(env, "neverexpire") + r1 = self.authenticate(env, "neverexpire", challenge) + assert r1.response["status"] == 200 + + time.sleep(3) + r2 = self.authenticate(env, "neverexpire", challenge) + assert r2.response["status"] == 200 + + def test_digest_024_one_time_nonce_rejects_reuse(self, env): + # AuthDigestNonceLifetime 0: a successful request immediately + # supersedes its nonce (the tracked "last_nonce" moves on to the + # nextnonce from Authentication-Info), so replaying the very same + # nonce right afterwards must fail as stale. Each request against + # this client (success OR failure) advances the tracked nonce again, + # so this test does exactly one success followed by exactly one + # reuse -- no longer chain that would need to account for that. + challenge = self.challenge(env, "onetime") + assert challenge.opaque is not None, \ + "one-time-nonce tracking requires an opaque to identify the client" + + r1 = self.authenticate(env, "onetime", challenge) + assert r1.response["status"] == 200 + ai1 = dc.parse_params(r1.response["header"]["authentication-info"]) + assert "nextnonce" in ai1 + assert ai1["nextnonce"] != challenge.nonce + + # reusing the exact same (now superseded) nonce fails as stale + r2 = self.authenticate(env, "onetime", challenge) + assert r2.response["status"] == 401 + stale_challenge = dc.DigestChallenge.parse(r2.response["header"]["www-authenticate"]) + assert stale_challenge.stale is True + env.httpd_error_log.ignore_recent(lognos=["AH01776"]) + + def test_digest_025_one_time_nonce_chain_continues(self, env): + # Following the nextnonce handed out on a successful response lets + # the client keep authenticating, one hop at a time. + challenge = self.challenge(env, "onetime") + r1 = self.authenticate(env, "onetime", challenge) + assert r1.response["status"] == 200 + ai1 = dc.parse_params(r1.response["header"]["authentication-info"]) + + challenge.nonce = ai1["nextnonce"] + r2 = self.authenticate(env, "onetime", challenge) + assert r2.response["status"] == 200 + ai2 = dc.parse_params(r2.response["header"]["authentication-info"]) + assert ai2["nextnonce"] != ai1["nextnonce"] diff --git a/test/modules/aaa/test_003_nccheck.py b/test/modules/aaa/test_003_nccheck.py new file mode 100644 index 00000000000..f7e7520bc04 --- /dev/null +++ b/test/modules/aaa/test_003_nccheck.py @@ -0,0 +1,99 @@ +"""AuthDigestNcCheck replay-detection scenarios. + +Note the actual semantics here are stricter than a sliding replay window: +the server keeps its own count of authenticated requests seen for a client +(incremented on *every* request carrying that client's opaque, whether or +not it goes on to authenticate) and requires the client's nc to match it +*exactly* -- so both replays of an old nc and skipping ahead are rejected. +A failed nc check also resets the server's tracked count back to 0, as part +of issuing a fresh challenge for the client (see note_digest_auth_failure() +in mod_auth_digest.c: an existing, opaque-identified client always gets its +nonce_count reset when a new challenge is generated for it, regardless of +*why* the challenge is being reissued) -- so recovery after a rejected nc +means starting the sequence over at 00000001, not continuing where the +client left off. +""" + +from . import digest_client as dc +from .env import AAATestEnv + + +class TestDigestNcCheck: + + def url(self, env, location, path="secret.txt"): + return env.mkurl("http", "aaa", f"/digest/{location}/{path}") + + def challenge(self, env, location): + r = env.curl_get(self.url(env, location)) + assert r.response["status"] == 401 + return dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + + def authenticate(self, env, location, challenge, nc, cnonce="ncc-test-cnonce", + include_opaque=True): + uri = f"/digest/{location}/secret.txt" + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri=uri, nc=nc, cnonce=cnonce, + include_opaque=include_opaque) + return env.curl_get(self.url(env, location), options=["-H", f"Authorization: {auth}"]) + + def test_digest_030_nccheck_requires_opaque(self, env): + # with AuthDigestNcCheck on, the server cannot verify nc without + # having tracked this client via its opaque -- omitting the opaque + # therefore fails the check outright, even with nc=00000001. + challenge = self.challenge(env, "nccheck") + assert challenge.opaque is not None + r = self.authenticate(env, "nccheck", challenge, nc="00000001", include_opaque=False) + assert r.response["status"] == 401 + new_challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + assert new_challenge.stale is False + + def test_digest_031_nccheck_sequential_ok(self, env): + challenge = self.challenge(env, "nccheck") + r1 = self.authenticate(env, "nccheck", challenge, nc="00000001") + assert r1.response["status"] == 200 + r2 = self.authenticate(env, "nccheck", challenge, nc="00000002") + assert r2.response["status"] == 200 + r3 = self.authenticate(env, "nccheck", challenge, nc="00000003") + assert r3.response["status"] == 200 + + def test_digest_032_nccheck_replay_rejected(self, env): + challenge = self.challenge(env, "nccheck") + r1 = self.authenticate(env, "nccheck", challenge, nc="00000001") + assert r1.response["status"] == 200 + r2 = self.authenticate(env, "nccheck", challenge, nc="00000002") + assert r2.response["status"] == 200 + + # replay an already-used nc -> rejected, and NOT reported as stale + # (this is a distinct failure mode from an invalid/expired nonce). + r3 = self.authenticate(env, "nccheck", challenge, nc="00000001") + assert r3.response["status"] == 401 + new_challenge = dc.DigestChallenge.parse(r3.response["header"]["www-authenticate"]) + assert new_challenge.stale is False + env.httpd_error_log.ignore_recent(lognos=["AH01774"]) + + # the rejected attempt reset the server's tracked count to 0 (a new + # challenge was issued for this client), so recovery restarts the + # sequence at 00000001 -- continuing from 00000003 would NOT work. + r4 = self.authenticate(env, "nccheck", challenge, nc="00000001") + assert r4.response["status"] == 200 + + def test_digest_033_nccheck_skip_ahead_rejected(self, env): + challenge = self.challenge(env, "nccheck") + r1 = self.authenticate(env, "nccheck", challenge, nc="00000001") + assert r1.response["status"] == 200 + + # skipping ahead is rejected too: nc must match exactly, not just + # be higher than what was last accepted. + r2 = self.authenticate(env, "nccheck", challenge, nc="00000009") + assert r2.response["status"] == 401 + env.httpd_error_log.ignore_recent(lognos=["AH01774"]) + + def test_digest_034_no_nccheck_allows_replay(self, env): + # the "default" location has no AuthDigestNcCheck (Off by default), + # so replaying the exact same nc is not detected or rejected. + challenge = self.challenge(env, "default") + r1 = self.authenticate(env, "default", challenge, nc="00000001") + assert r1.response["status"] == 200 + r2 = self.authenticate(env, "default", challenge, nc="00000001") + assert r2.response["status"] == 200 diff --git a/test/modules/aaa/test_004_domain.py b/test/modules/aaa/test_004_domain.py new file mode 100644 index 00000000000..829d923552f --- /dev/null +++ b/test/modules/aaa/test_004_domain.py @@ -0,0 +1,56 @@ +"""AuthDigestDomain: presence, format, and inheritance of the domain= +attribute in the WWW-Authenticate challenge. +""" + +from . import digest_client as dc +from .env import AAATestEnv + + +class TestDigestDomain: + + def url(self, env, path): + return env.mkurl("http", "aaa", path) + + def test_digest_040_domain_attribute_present(self, env): + r = env.curl_get(self.url(env, "/digest/domain/secret.txt")) + assert r.response["status"] == 401 + challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + # set_uri_list() (mod_auth_digest.c) builds a single quoted, + # space-separated list from the configured AuthDigestDomain URIs. + assert challenge.domain == "/digest/domain/ https://mirror.example.org/other/" + assert challenge.domain_list() == [ + "/digest/domain/", "https://mirror.example.org/other/"] + + def test_digest_041_no_domain_configured_omits_attribute(self, env): + r = env.curl_get(self.url(env, "/digest/default/secret.txt")) + assert r.response["status"] == 401 + challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + assert challenge.domain is None + + def test_digest_042_domain_location_still_authenticates(self, env): + r = env.curl_get(self.url(env, "/digest/domain/secret.txt")) + challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri="/digest/domain/secret.txt") + r = env.curl_get(self.url(env, "/digest/domain/secret.txt"), + options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 200 + assert r.response["body"].decode() == "digest-domain-secret\n" + + def test_digest_043_domain_inherited_by_nested_path(self, env): + # AuthDigestDomain is set on /digest/domain/; a path nested below it + # inherits the same directory config (same realm/credentials/domain). + r = env.curl_get(self.url(env, "/digest/domain/nested/secret.txt")) + assert r.response["status"] == 401 + challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + assert challenge.realm == AAATestEnv.REALM + assert challenge.domain == "/digest/domain/ https://mirror.example.org/other/" + + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri="/digest/domain/nested/secret.txt") + r = env.curl_get(self.url(env, "/digest/domain/nested/secret.txt"), + options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 200 + assert r.response["body"].decode() == "digest-domain-nested-secret\n" diff --git a/test/modules/aaa/test_005_provider.py b/test/modules/aaa/test_005_provider.py new file mode 100644 index 00000000000..d7d3fbb85ad --- /dev/null +++ b/test/modules/aaa/test_005_provider.py @@ -0,0 +1,37 @@ +"""AuthDigestProvider scenarios.""" + +from . import digest_client as dc +from .env import AAATestEnv + + +class TestDigestProvider: + + def url(self, env, path): + return env.mkurl("http", "aaa", path) + + def test_digest_050_omitted_provider_defaults_to_file(self, env): + # /digest/noprovider/ has no AuthDigestProvider directive at all; + # mod_auth_digest falls back to the "file" provider (mod_authn_file) + # by default (see get_hash() / AUTHN_DEFAULT_PROVIDER in mod_auth.h). + path = "/digest/noprovider/secret.txt" + r = env.curl_get(self.url(env, path)) + assert r.response["status"] == 401 + challenge = dc.DigestChallenge.parse(r.response["header"]["www-authenticate"]) + + auth = dc.build_authorization( + AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD, + method="GET", uri=path) + r = env.curl_get(self.url(env, path), options=["-H", f"Authorization: {auth}"]) + assert r.response["status"] == 200 + assert r.response["body"].decode() == "digest-noprovider-secret\n" + + def test_digest_051_unknown_provider_rejected_at_config_time(self, env): + r = env.configtest([ + 'AuthType Digest', + f'AuthName "{AAATestEnv.REALM}"', + 'AuthDigestProvider no-such-provider', + f'AuthUserFile "{env.digest_pwfile}"', + 'Require valid-user', + ]) + assert r.exit_code != 0 + assert "Unknown Authn provider" in r.stderr diff --git a/test/modules/aaa/test_006_config_errors.py b/test/modules/aaa/test_006_config_errors.py new file mode 100644 index 00000000000..e1284abfdf0 --- /dev/null +++ b/test/modules/aaa/test_006_config_errors.py @@ -0,0 +1,86 @@ +"""Config-time validation for directives whose *documented* syntax (see +docs/manual/mod/mod_auth_digest.xml) is broader than what this build's +mod_auth_digest.c actually implements: AuthDigestQop only accepts "auth" +(qop=none/auth-int are rejected -- the "Open Issues" comment in the source +notes MD5-sess and auth-int were removed as incomplete), AuthDigestAlgorithm +only accepts "MD5", and AuthDigestShmemSize enforces a minimum size. These +are all checked with `httpd -t` against a throwaway config so the shared +package server is never disturbed. +""" + +from .env import AAATestEnv + + +class TestDigestConfigErrors: + + def test_digest_060_qop_none_rejected(self, env): + r = env.configtest([ + 'AuthType Digest', + f'AuthName "{AAATestEnv.REALM}"', + 'AuthDigestProvider file', + f'AuthUserFile "{env.digest_pwfile}"', + 'AuthDigestQop none', + 'Require valid-user', + ]) + assert r.exit_code != 0 + assert "AuthDigestQop" in r.stderr + + def test_digest_061_qop_auth_int_rejected(self, env): + r = env.configtest([ + 'AuthType Digest', + f'AuthName "{AAATestEnv.REALM}"', + 'AuthDigestProvider file', + f'AuthUserFile "{env.digest_pwfile}"', + 'AuthDigestQop auth-int', + 'Require valid-user', + ]) + assert r.exit_code != 0 + assert "AuthDigestQop" in r.stderr + + def test_digest_062_qop_auth_accepted(self, env): + # the only value actually supported must still work. + r = env.configtest([ + 'AuthType Digest', + f'AuthName "{AAATestEnv.REALM}"', + 'AuthDigestProvider file', + f'AuthUserFile "{env.digest_pwfile}"', + 'AuthDigestQop auth', + 'Require valid-user', + ]) + assert r.exit_code == 0 + + def test_digest_063_algorithm_md5_sess_rejected(self, env): + r = env.configtest([ + 'AuthType Digest', + f'AuthName "{AAATestEnv.REALM}"', + 'AuthDigestProvider file', + f'AuthUserFile "{env.digest_pwfile}"', + 'AuthDigestAlgorithm MD5-sess', + 'Require valid-user', + ]) + assert r.exit_code != 0 + assert "Unsupported algorithm" in r.stderr + + def test_digest_064_algorithm_md5_accepted(self, env): + r = env.configtest([ + 'AuthType Digest', + f'AuthName "{AAATestEnv.REALM}"', + 'AuthDigestProvider file', + f'AuthUserFile "{env.digest_pwfile}"', + 'AuthDigestAlgorithm MD5', + 'Require valid-user', + ]) + assert r.exit_code == 0 + + def test_digest_065_shmemsize_too_small_rejected(self, env): + r = env.configtest([], extra_top_lines=["AuthDigestShmemSize 10"]) + assert r.exit_code != 0 + assert "AuthDigestShmemSize" in r.stderr + + def test_digest_066_shmemsize_valid_accepted(self, env): + r = env.configtest([], extra_top_lines=["AuthDigestShmemSize 1000"]) + assert r.exit_code == 0 + + def test_digest_067_shmemsize_units_accepted(self, env): + r = env.configtest([], extra_top_lines=["AuthDigestShmemSize 64K"]) + assert r.exit_code == 0 From b18d68b44e1bf49574d2af9f73fe2c08b68bf5da Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Sat, 1 Aug 2026 20:05:15 +0100 Subject: [PATCH 45/50] Consolidate Linux CI's pytest-based test running into TEST_PYTEST. * test/travis_run_linux.sh: Replace TEST_CORE/TEST_PROXY/TEST_H2 with one TEST_PYTEST block, running `make check-all-pytest` over every test/modules/*/ suite except modules/md (needs an ACME/pebble server not available here). Keep the old TEST_MD/pebble logic for reference, under a conditional that is never set. * .github/workflows/linux.yml: Replace the "HTTP/2 test suite" job and the disabled "ACME test suite" job with one "Python pytest test suites" job setting TEST_PYTEST=1. Drop TEST_INSTALL: check-all-pytest tests the check/ build tree directly. Drop the python3-pytest/ python3-cryptography/etc. packages, since both suites now manage their own dependencies via uv; install uv from the Ubuntu package instead. Capture the new suites' error logs as failure artifacts. Assisted-by: Claude Sonnet 5 --- .github/workflows/linux.yml | 31 ++++++--------------- test/travis_run_linux.sh | 55 ++++++++++++++++++++----------------- 2 files changed, 39 insertions(+), 47 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 38d9af194e5..89bdf778141 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -241,34 +241,19 @@ jobs: TEST_ASAN=1 CLEAR_CACHE=1 # ------------------------------------------------------------------------- - - name: HTTP/2 test suite + # Runs every pytest-based test suite (pytest_suite/ + all + # test/modules/*/ pyhttpd suites except modules/md, which needs a + # local ACME/pebble server that isn't available here) via `make + # check-all-pytest`. See TEST_PYTEST in test/travis_run_linux.sh. + - name: Python pytest test suites config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=all - pkgs: curl python3-pytest nghttp2-client python3-cryptography python3-requests python3-multipart python3-filelock python3-websockets + pkgs: curl nghttp2-client uv env: | APR_VERSION=1.7.6 APU_VERSION=1.6.3 APU_CONFIG="--with-crypto" NO_TEST_FRAMEWORK=1 - TEST_INSTALL=1 - TEST_H2=1 - TEST_CORE=1 - TEST_PROXY=1 - # ------------------------------------------------------------------------- - ### TODO: if: *condition_not_24x - ### TODO: pebble install is broken. - # - name: ACME test suite - # config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=event - # pkgs: >- - # python3-pytest nghttp2-client python3-cryptography python3-requests python3-filelock - # golang-1.17 curl - # env: | - # APR_VERSION=1.7.6 - # APU_VERSION=1.6.3 - # APU_CONFIG="--with-crypto" - # GOROOT=/usr/lib/go-1.17 - # NO_TEST_FRAMEWORK=1 - # TEST_INSTALL=1 - # TEST_MD=1 + TEST_PYTEST=1 # ------------------------------------------------------------------------- ### TODO: if: *condition_not_24x - name: Configured w/reduced exports @@ -403,3 +388,5 @@ jobs: path: | **/config.log test/perl-framework/t/logs/error_log + test/pytest_suite/t/logs/error_log + test/gen/apache/logs/error_log diff --git a/test/travis_run_linux.sh b/test/travis_run_linux.sh index 67378192a33..0ee63fe3e83 100755 --- a/test/travis_run_linux.sh +++ b/test/travis_run_linux.sh @@ -238,39 +238,44 @@ if test -v LITMUS -a $RV -eq 0; then popd fi -if test -v TEST_CORE -a $RV -eq 0; then - # Run core module tests. - MPM=event py.test-3 test/modules/core - RV=$? -fi - -if test -v TEST_PROXY -a $RV -eq 0; then - # Run proxy tests. - py.test-3 test/modules/proxy - RV=$? -fi - -if test -v TEST_H2 -a $RV -eq 0; then - # Build the test clients +if test -v TEST_PYTEST -a $RV -eq 0; then + # Run all available pytest-based test suites against this build, via + # the unified `make check-all-pytest` target: pytest_suite/ (the + # self-contained port of the classic Apache::Test suite, incl. PHP + # tests if PHP_FPM is set) and every test/modules/*/ pyhttpd suite + # (core, http1, http2, proxy, ssl, aaa, ...). This replaces the old + # per-suite TEST_CORE / TEST_PROXY / TEST_H2 / TEST_MD flags, which + # each invoked py.test-3 directly against a `make install`ed tree; + # check-all-pytest instead builds and tests entirely from the in-tree + # check/ build, needing no install. + # + # modules/md is excluded: its ACME tests need a local pebble CA server, + # which isn't available here (built from source, pebble's Go module + # currently fails to build against modern Go -- see the old commit + # history for the details of that dead end). (cd test/clients && make) - # Run HTTP/2 tests. - MPM=event py.test-3 test/modules/http2 + targets="" + for d in test/modules/*/; do + name=$(basename "$d") + case "$name" in + md|__pycache__) continue ;; + esac + targets="$targets modules/$name" + done + PYHTTPD_TARGETS="$targets" make check-all-pytest RV=$? - if test $RV -eq 0; then - MPM=worker py.test-3 test/modules/http2 - RV=$? - fi fi if test -v TEST_MD -a $RV -eq 0; then - # Run ACME tests. - # need the go based pebble as ACME test server - # which is a package on debian sid, but not on focal - # FAILS on TRAVIS with + # Preserved for reference only: nothing sets TEST_MD, so this never + # runs. modules/md is covered by TEST_PYTEST's check-all-pytest run above + # for everything except its ACME tests, which need a local pebble CA + # server -- building pebble from source last failed with: # package github.com/letsencrypt/pebble/cmd/pebble # imports crypto/ed25519: unrecognized import path "crypto/ed25519" (import path does not begin with hostname) # - # but works on a docker ubuntu-focal image. ??? + # Revive this (e.g. once a working pebble build/package is available) + # by setting TEST_MD=1 on a job and ensuring GOROOT/GOPATH are usable. export GOPATH=${PREFIX}/gocode mkdir -p "${GOPATH}" export PATH="${GOROOT}/bin:${GOPATH}/bin:${PATH}" From 82048825d25cc515754785ccb6767d5c02da9cf4 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Sat, 1 Aug 2026 20:49:55 +0100 Subject: [PATCH 46/50] * .github/workflows/linux.yml: Install uv via pipx, not apt: uv isn't an Ubuntu package, so the shared "Install prerequisites" apt-get command was failing outright. Assisted-by: Claude Sonnet 5 --- .github/workflows/linux.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 89bdf778141..48b45feaf50 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -247,7 +247,7 @@ jobs: # check-all-pytest`. See TEST_PYTEST in test/travis_run_linux.sh. - name: Python pytest test suites config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=all - pkgs: curl nghttp2-client uv + pkgs: curl nghttp2-client pipx env: | APR_VERSION=1.7.6 APU_VERSION=1.6.3 @@ -379,6 +379,11 @@ jobs: name: config.log-${{ env.JOBID }} path: | /home/runner/build/**/config.log + - name: Install uv + if: env.TEST_PYTEST == '1' + run: | + pipx install uv + echo "$HOME/.local/bin" >> $GITHUB_PATH - name: Build and test run: ./test/travis_run_linux.sh - uses: actions/upload-artifact@v7 From 3fa3dd6016b385a7a38da72ac099b6b54dbe7e65 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Sat, 1 Aug 2026 21:10:43 +0100 Subject: [PATCH 47/50] * .github/workflows/linux.yml: Set TEST_PYTEST=1 for the UBSan, ASan, and ASan pool-debug jobs. Move pipx and curl into the always-installed base packages; add nghttp2-client to the ASan jobs. * test/travis_run_linux.sh: Exclude modules/http2 from the pytest run when mod_http2.so wasn't built. Assisted-by: Claude Sonnet 5 --- .github/workflows/linux.yml | 11 ++++++++--- test/travis_run_linux.sh | 6 ++++++ 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 48b45feaf50..0992098c202 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -219,26 +219,31 @@ jobs: env: | NOTEST_LIBS=-lubsan TEST_UBSAN=1 + TEST_PYTEST=1 # ------------------------------------------------------------------------- - name: ASan notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer config: --enable-mods-shared=reallyall + pkgs: nghttp2-client env: | APR_VERSION=1.7.x APU_VERSION=1.7.x APU_CONFIG="--with-crypto --with-ldap" TEST_ASAN=1 + TEST_PYTEST=1 CLEAR_CACHE=1 # ------------------------------------------------------------------------- - name: ASan, pool-debug notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer config: --enable-mods-shared=reallyall + pkgs: nghttp2-client env: | APR_VERSION=1.7.x APR_CONFIG="--enable-pool-debug" APU_VERSION=1.7.x APU_CONFIG="--with-crypto --with-ldap" TEST_ASAN=1 + TEST_PYTEST=1 CLEAR_CACHE=1 # ------------------------------------------------------------------------- # Runs every pytest-based test suite (pytest_suite/ + all @@ -247,7 +252,7 @@ jobs: # check-all-pytest`. See TEST_PYTEST in test/travis_run_linux.sh. - name: Python pytest test suites config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=all - pkgs: curl nghttp2-client pipx + pkgs: nghttp2-client env: | APR_VERSION=1.7.6 APU_VERSION=1.6.3 @@ -350,9 +355,9 @@ jobs: - name: Install prerequisites run: sudo apt-get install -o Acquire::Retries=5 cpanminus libtool-bin libapr1-dev libaprutil1-dev - liblua5.3-dev libbrotli-dev libcurl4-openssl-dev + liblua5.3-dev libbrotli-dev libcurl4-openssl-dev libnghttp2-dev libjansson-dev libpcre2-dev gdb - perl-doc libsasl2-dev ${{ matrix.pkgs }} check + perl-doc libsasl2-dev curl pipx ${{ matrix.pkgs }} check - uses: actions/checkout@v6 - uses: actions/checkout@v6 with: diff --git a/test/travis_run_linux.sh b/test/travis_run_linux.sh index 0ee63fe3e83..d7771148e1d 100755 --- a/test/travis_run_linux.sh +++ b/test/travis_run_linux.sh @@ -253,12 +253,18 @@ if test -v TEST_PYTEST -a $RV -eq 0; then # which isn't available here (built from source, pebble's Go module # currently fails to build against modern Go -- see the old commit # history for the details of that dead end). + # + # modules/http2 is excluded when mod_http2 wasn't built (e.g. the + # UBSan job's --disable-http2): its pytest package hard-requires + # both http2 and proxy_http2 to load, and errors at fixture setup + # otherwise rather than skipping. (cd test/clients && make) targets="" for d in test/modules/*/; do name=$(basename "$d") case "$name" in md|__pycache__) continue ;; + http2) test -f modules/http2/.libs/mod_http2.so || continue ;; esac targets="$targets modules/$name" done From c11dfa10cb5527c09f8bbfcc4176e5dbca71ea8d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Sat, 1 Aug 2026 21:36:41 +0100 Subject: [PATCH 48/50] * test/pytest_suite/.gitignore: Ignore generated .htaccess files, t/conf/cacheroot/, t/htdocs/modules/autoindex2/, t/htdocs/modules/substitute/test.txt, and t/state/. * test/pytest_suite/t/htdocs/apache/cfg_getline/.htaccess, authz_core/a/.htaccess, authz_core/a/b/.htaccess, authz_core/a/b/c/.htaccess: Remove stale generated content that had been committed by mistake. Assisted-by: Claude Sonnet 5 --- test/pytest_suite/.gitignore | 17 +++++++++++++++++ .../t/htdocs/apache/cfg_getline/.htaccess | 1 - .../t/htdocs/authz_core/a/.htaccess | 10 ---------- .../t/htdocs/authz_core/a/b/.htaccess | 5 ----- .../t/htdocs/authz_core/a/b/c/.htaccess | 3 --- 5 files changed, 17 insertions(+), 19 deletions(-) delete mode 100644 test/pytest_suite/t/htdocs/apache/cfg_getline/.htaccess delete mode 100644 test/pytest_suite/t/htdocs/authz_core/a/.htaccess delete mode 100644 test/pytest_suite/t/htdocs/authz_core/a/b/.htaccess delete mode 100644 test/pytest_suite/t/htdocs/authz_core/a/b/c/.htaccess diff --git a/test/pytest_suite/.gitignore b/test/pytest_suite/.gitignore index 5dedf971e2a..ada6cfd53c7 100644 --- a/test/pytest_suite/.gitignore +++ b/test/pytest_suite/.gitignore @@ -15,11 +15,28 @@ t/conf/*.conf t/conf/ssl/*.pl t/conf/ssl/*.conf t/conf/ssl/ca +t/conf/cacheroot/ t/logs/ +t/state/ # Generated test scripts t/htdocs/**/*.pl + +# Generated .htaccess files +t/htdocs/apache/cfg_getline/.htaccess +t/htdocs/apache/expr/.htaccess +t/htdocs/authz_core/a/.htaccess +t/htdocs/authz_core/a/b/.htaccess +t/htdocs/authz_core/a/b/c/.htaccess t/htdocs/modules/access/htaccess/.htaccess +t/htdocs/modules/autoindex/htaccess/.htaccess +t/htdocs/modules/autoindex2/ +t/htdocs/modules/dir/htaccess/.htaccess +t/htdocs/modules/expires/htaccess/.htaccess +t/htdocs/modules/headers/htaccess/.htaccess +t/htdocs/modules/setenvif/htaccess/.htaccess +t/htdocs/modules/substitute/.htaccess +t/htdocs/modules/substitute/test.txt # Logs t/php-fpm/log/ diff --git a/test/pytest_suite/t/htdocs/apache/cfg_getline/.htaccess b/test/pytest_suite/t/htdocs/apache/cfg_getline/.htaccess deleted file mode 100644 index d5bb7518f44..00000000000 --- a/test/pytest_suite/t/htdocs/apache/cfg_getline/.htaccess +++ /dev/null @@ -1 +0,0 @@ -SetEnvIf User-Agent ^ testvar=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa diff --git a/test/pytest_suite/t/htdocs/authz_core/a/.htaccess b/test/pytest_suite/t/htdocs/authz_core/a/.htaccess deleted file mode 100644 index a127d674af8..00000000000 --- a/test/pytest_suite/t/htdocs/authz_core/a/.htaccess +++ /dev/null @@ -1,10 +0,0 @@ - -Require env allowed2 -Require env allowed1 -Require group user2 -Require group user1 - -AuthType basic -AuthName basic1 -AuthUserFile basic1 -AuthGroupFile groups1 diff --git a/test/pytest_suite/t/htdocs/authz_core/a/b/.htaccess b/test/pytest_suite/t/htdocs/authz_core/a/b/.htaccess deleted file mode 100644 index df636707723..00000000000 --- a/test/pytest_suite/t/htdocs/authz_core/a/b/.htaccess +++ /dev/null @@ -1,5 +0,0 @@ -AuthMerging And - -Require env allowed2 -Require env allowed3 - diff --git a/test/pytest_suite/t/htdocs/authz_core/a/b/c/.htaccess b/test/pytest_suite/t/htdocs/authz_core/a/b/c/.htaccess deleted file mode 100644 index 66562e31431..00000000000 --- a/test/pytest_suite/t/htdocs/authz_core/a/b/c/.htaccess +++ /dev/null @@ -1,3 +0,0 @@ - -Require env allowed4 - From df3fb9282f469934e92f0d68ba7e50b1b1595215 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Sat, 1 Aug 2026 21:52:02 +0100 Subject: [PATCH 49/50] * test/pytest_suite/apache_pytest/config.py (_build_vars): Add @STATEDIR@ config template variable. * test/pytest_suite/t/conf/cache.conf.in, tests/t/modules/test_cache.py: Use @STATEDIR@/cacheroot/ for CacheRoot, instead of t/conf/cacheroot. * test/pytest_suite/.gitignore: Drop the now-obsolete t/conf/cacheroot/ entry. Assisted-by: Claude Sonnet 5 --- test/pytest_suite/.gitignore | 1 - test/pytest_suite/apache_pytest/config.py | 1 + test/pytest_suite/t/conf/cache.conf.in | 4 ++-- test/pytest_suite/tests/t/modules/test_cache.py | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/test/pytest_suite/.gitignore b/test/pytest_suite/.gitignore index ada6cfd53c7..12dddfc44e0 100644 --- a/test/pytest_suite/.gitignore +++ b/test/pytest_suite/.gitignore @@ -15,7 +15,6 @@ t/conf/*.conf t/conf/ssl/*.pl t/conf/ssl/*.conf t/conf/ssl/ca -t/conf/cacheroot/ t/logs/ t/state/ diff --git a/test/pytest_suite/apache_pytest/config.py b/test/pytest_suite/apache_pytest/config.py index 07939d3d235..3e362be077f 100644 --- a/test/pytest_suite/apache_pytest/config.py +++ b/test/pytest_suite/apache_pytest/config.py @@ -295,6 +295,7 @@ def _build_vars(self, top_dir: Path, servername: str, base_port: int) -> dict[st v["t_conf"] = str(serverroot / "conf") v["t_logs"] = str(serverroot / "logs") v["t_state"] = str(serverroot / "state") + v["statedir"] = v["t_state"] v["t_conf_file"] = str(serverroot / "conf" / "httpd.conf") v["t_pid_file"] = str(serverroot / "logs" / "httpd.pid") v["sslca"] = str(serverroot / "conf" / "ssl" / "ca") diff --git a/test/pytest_suite/t/conf/cache.conf.in b/test/pytest_suite/t/conf/cache.conf.in index fa06db72ebb..91284d13644 100644 --- a/test/pytest_suite/t/conf/cache.conf.in +++ b/test/pytest_suite/t/conf/cache.conf.in @@ -7,7 +7,7 @@ CacheEnable disk /cache/ - CacheRoot @SERVERROOT@/conf/cacheroot/ + CacheRoot @STATEDIR@/cacheroot/ CacheDirLevels 1 CacheDirLength 1 @@ -15,7 +15,7 @@ CacheEnable disk /cache/ - CacheRoot @SERVERROOT@/conf/cacheroot/ + CacheRoot @STATEDIR@/cacheroot/ CacheDirLevels 1 CacheDirLength 1 diff --git a/test/pytest_suite/tests/t/modules/test_cache.py b/test/pytest_suite/tests/t/modules/test_cache.py index 071fec3ba70..76f10b107a7 100644 --- a/test/pytest_suite/tests/t/modules/test_cache.py +++ b/test/pytest_suite/tests/t/modules/test_cache.py @@ -18,7 +18,7 @@ def test_cache(http): http.module("mod_cache") - cacheroot = os.path.join(http.vars("serverroot"), "conf", "cacheroot") + cacheroot = os.path.join(http.vars("statedir"), "cacheroot") os.makedirs(cacheroot, exist_ok=True) r = http.GET("/cache/") From 9a0a827c1ecda27a2a26b0ff556a7b991a364dec Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 7 Aug 2026 14:46:54 +0100 Subject: [PATCH 50/50] * modules/ssl/ssl_engine_init.c (ssl_init_ctx_crl): Remove unused variable. Fixes: 01a5969080 (SVN r1936849) Co-Authored-By: Claude Opus 4.6 --- modules/ssl/ssl_engine_init.c | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c index d533785868b..3f15ca8eaaf 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c @@ -1531,7 +1531,6 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, unsigned long crlflags = 0; char *cfgp = mctx->pkp ? "SSLProxy" : "SSL"; int crl_check_mode; - apr_status_t rv; ap_assert(store != NULL); /* safe to assume always non-NULL? */
      Description:Nom de la variable servant à déterminer le nom de diff --git a/docs/manual/mod/mod_ssl.xml.es b/docs/manual/mod/mod_ssl.xml.es index 481a856a7a3..2d2f87acbca 100644 --- a/docs/manual/mod/mod_ssl.xml.es +++ b/docs/manual/mod/mod_ssl.xml.es @@ -1,7 +1,7 @@ - + diff --git a/docs/manual/mod/mod_ssl.xml.fr b/docs/manual/mod/mod_ssl.xml.fr index 10de66ddad1..46493333873 100644 --- a/docs/manual/mod/mod_ssl.xml.fr +++ b/docs/manual/mod/mod_ssl.xml.fr @@ -1,7 +1,7 @@ - + diff --git a/docs/manual/mod/overrides.html.en.utf8 b/docs/manual/mod/overrides.html.en.utf8 index 012a28e4e12..6f911f725b6 100644 --- a/docs/manual/mod/overrides.html.en.utf8 +++ b/docs/manual/mod/overrides.html.en.utf8 @@ -485,19 +485,19 @@ for Client Auth
      SSLCACertificatePathmod_ssl
      Directory of PEM-encoded CA Certificates for Client Auth
      SSLCACertificateURImod_ssl
      Server CA certificate store for Client Authentication
      SSLCipherSuitemod_ssl
      Cipher Suite available for negotiation in SSL +
      SSLCipherSuitemod_ssl
      Cipher Suite available for negotiation in SSL handshake
      SSLRenegBufferSizemod_ssl
      Set the size for the SSL renegotiation buffer
      SSLRequiremod_ssl
      Allow access only when an arbitrarily complex +
      SSLRenegBufferSizemod_ssl
      Set the size for the SSL renegotiation buffer
      SSLRequiremod_ssl
      Allow access only when an arbitrarily complex boolean expression is true
      SSLRequireSSLmod_ssl
      Deny access when SSL is not used for the +
      SSLRequireSSLmod_ssl
      Deny access when SSL is not used for the HTTP request
      SSLTrustURImod_ssl
      Server CA certificate store for Client Authentication
      SSLUserNamemod_ssl
      Variable name to determine user name
      SSLVerifyClientmod_ssl
      SSLCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Client Auth
      SSLCACertificateURI urisvE
      Server CA certificate store for Client Authentication
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates +
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for +
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestURI urisvE
      certificate store of CA Certificates for defining -acceptable CA names
      SSLCARevocationCheck chain|leaf|none [flags ...] none svE
      Enable CRL-based revocation checking
      SSLCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Client Auth
      SSLCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Client Auth
      SSLCARevocationURI urisvE
      Server CA certificate revocation list store for Client Authentication
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCertificateURI urisvE
      Server certificate and key store
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhE
      Cipher Suite available for negotiation in SSL handshake
      SSLClientHelloVars on|off off svE
      Enable collection of ClientHello variables
      SSLProxyCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Remote Server Auth
      SSLProxyCACertificateURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for +
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for +
      SSLProxyCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationURI urisvE
      Proxy CA certificate revocation list store for Remote Server Auth
      SSLProxyCheckPeerCN on|off on svE
      Whether to check the remote server certificate's CN field
      SSLProxyCheckPeerExpire on|off on svE
      Whether to check if remote server certificate is expired @@ -1246,39 +1239,44 @@ proxy handshake
      SSLProxyMachineCertificateChainFile filenamesvE
      File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate
      SSLProxyMachineCertificateFile filenamesvE
      File of concatenated PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificatePath directorysvE
      Directory of PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificateURI urisvE
      Proxy certificate and key stores
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyVerify level none svE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svE
      Maximum depth of CA Certificates in Remote Server +
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyStoreURI urisvE
      Proxy certificate and key stores
      SSLProxyTrustURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyVerify level none svE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svE
      Maximum depth of CA Certificates in Remote Server Certificate verification
      SSLRandomSeed context source -[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding +
      SSLRandomSeed context source +[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding source
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex +
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex boolean expression is true
      SSLRequireSSLdhE
      Deny access when SSL is not used for the +
      SSLRequireSSLdhE
      Deny access when SSL is not used for the HTTP request
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session +
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session Cache
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires +
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires in the Session Cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLStoreURI urisvE
      Server certificate and key store
      SSLStrictSNIVHostCheck on|off off svE
      Whether to allow non-SNI clients to access a name-based virtual host.
      SSLTrustRequestURI urisvE
      certificate store of CA Certificates for defining +acceptable CA names
      SSLTrustURI urisvE
      Server CA certificate store for Client Authentication
      SSLUserName varnamesdhE
      Variable name to determine user name
      SSLUseStapling on|off off svE
      Enable stapling of OCSP responses in the TLS handshake
      SSLVerifyClient level none svdhE
      Type of Client Certificate verification
      SSLCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Client Auth
      SSLCACertificateURI urisvE
      Server CA certificate store for Client Authentication
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates +
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for +
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestURI urisvE
      certificate store of CA Certificates for defining -acceptable CA names
      SSLCARevocationCheck chain|leaf|none [flags ...] none svE
      Enable CRL-based revocation checking
      SSLCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Client Auth
      SSLCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Client Auth
      SSLCARevocationURI urisvE
      Server CA certificate revocation list store for Client Authentication
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCertificateURI urisvE
      Server certificate and key store
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhE
      Cipher Suite available for negotiation in SSL handshake
      SSLClientHelloVars on|off off svE
      Enable collection of ClientHello variables
      SSLProxyCACertificatePath directory-pathsvpE
      Directory of PEM-encoded CA Certificates for Remote Server Auth
      SSLProxyCACertificateURI urisvpE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyCARevocationCheck chain|leaf|none none svpE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvpE
      File of concatenated PEM-encoded CA CRLs for +
      SSLProxyCARevocationCheck chain|leaf|none none svpE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvpE
      File of concatenated PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationPath directory-pathsvpE
      Directory of PEM-encoded CA CRLs for +
      SSLProxyCARevocationPath directory-pathsvpE
      Directory of PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationURI urisvpE
      Proxy CA certificate revocation list store for Remote Server Auth
      SSLProxyCheckPeerCN on|off on svpE
      Whether to check the remote server certificate's CN field
      SSLProxyCheckPeerExpire on|off on svpE
      Whether to check if remote server certificate is expired @@ -1234,39 +1227,44 @@ proxy handshake
      SSLProxyMachineCertificateChainFile filenamesvpE
      File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate
      SSLProxyMachineCertificateFile filenamesvpE
      File of concatenated PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificatePath directorysvpE
      Directory of PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificateURI urisvpE
      Proxy certificate and key stores
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svpE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyVerify level none svpE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svpE
      Maximum depth of CA Certificates in Remote Server +
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svpE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyStoreURI urisvpE
      Proxy certificate and key stores
      SSLProxyTrustURI urisvpE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyVerify level none svpE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svpE
      Maximum depth of CA Certificates in Remote Server Certificate verification
      SSLRandomSeed context source -[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding +
      SSLRandomSeed context source +[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding source
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex +
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex boolean expression is true
      SSLRequireSSLdhE
      Deny access when SSL is not used for the +
      SSLRequireSSLdhE
      Deny access when SSL is not used for the HTTP request
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session +
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session Cache
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires +
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires in the Session Cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLStoreURI urisvE
      Server certificate and key store
      SSLStrictSNIVHostCheck on|off off svE
      Whether to allow non-SNI clients to access a name-based virtual host.
      SSLTrustRequestURI urisvE
      certificate store of CA Certificates for defining +acceptable CA names
      SSLTrustURI urisvE
      Server CA certificate store for Client Authentication
      SSLUserName varnamesdhE
      Variable name to determine user name
      SSLUseStapling on|off off svE
      Enable stapling of OCSP responses in the TLS handshake
      SSLVerifyClient level none svdhE
      Type of Client Certificate verification
      SSLCACertificatePath ruta-de-directoriosvE
      Directorio de certificados CA codificados en PEM para la autenticación de Cliente
      SSLCACertificateURI urisvE
      Server CA certificate store for Client Authentication
      SSLCADNRequestFile ruta-al-ficherosvE
      Fichero de certificados CA concatenados codificados en PEM para +
      SSLCADNRequestFile ruta-al-ficherosvE
      Fichero de certificados CA concatenados codificados en PEM para definir nombres de CA aceptables
      SSLCADNRequestPath ruta-al-directoriosvE
      Directorio de Certificados CA codificados en PEM para definir +
      SSLCADNRequestPath ruta-al-directoriosvE
      Directorio de Certificados CA codificados en PEM para definir nombres de CA aceptables
      SSLCADNRequestURI urisvE
      certificate store of CA Certificates for defining -acceptable CA names
      SSLCARevocationCheck chain|leaf|none modificadores none svE
      Activar comprobación de revocación basada en CRL
      SSLCARevocationFile ruta-al-ficherosvE
      Fichero de CRL's de CA concatenados y codificados en PEM para la Autenticación de ClienteFile of concatenated PEM-encoded CA CRLs for
      SSLCARevocationPath ruta-al-directoriosvE
      Directorio de CRLs de CA codificados en PEM para la Autenticación de Cliente
      SSLCARevocationURI urisvE
      Server CA certificate revocation list store for Client Authentication
      SSLCertificateChainFile ruta-al-ficherosvE
      Fichero de Certificados CA de Servidor codificado en +
      SSLCertificateChainFile ruta-al-ficherosvE
      Fichero de Certificados CA de Servidor codificado en PEM
      SSLCertificateFile ruta-al-ficherosvE
      Fichero de datos Certificado X.509 codificado en PEM
      SSLCertificateKeyFile ruta-al-ficherosvE
      Fichero de clave privada de Servidor codificada en PEM
      SSLCertificateURI urisvE
      Server certificate and key store
      SSLCertificateFile ruta-al-ficherosvE
      Fichero de datos Certificado X.509 codificado en PEM
      SSLCertificateKeyFile ruta-al-ficherosvE
      Fichero de clave privada de Servidor codificada en PEM
      SSLCipherSuite especificación-de-cifrado DEFAULT (depende de +svdhE
      Conjunto de Cifrados disponibles para negociación en el saludo SSL
      SSLClientHelloVars on|off off svE
      Enable collection of ClientHello variables
      SSLProxyCACertificatePath ruta-al-directoriosvpE
      Directorio de Certificados CA codificados en PEM para la Autenticación de Servidor Remoto
      SSLProxyCACertificateURI urisvpE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyCARevocationCheck chain|leaf|none none svpE
      Activa la comprobación de revocación basada en CRL para la +
      SSLProxyCARevocationCheck chain|leaf|none none svpE
      Activa la comprobación de revocación basada en CRL para la Autenticación Remota de Servidor
      SSLProxyCARevocationFile ruta-al-ficherosvpE
      Fichero de CRLs de CA codificados en PEM concatenados para la +
      SSLProxyCARevocationFile ruta-al-ficherosvpE
      Fichero de CRLs de CA codificados en PEM concatenados para la Autenticación Remota de Servidor
      SSLProxyCARevocationPath ruta-al-directoriosvpE
      Directorio de CRLs de CA codificadas en PEM para la Autenticación +
      SSLProxyCARevocationPath ruta-al-directoriosvpE
      Directorio de CRLs de CA codificadas en PEM para la Autenticación Remota de Servidor
      SSLProxyCARevocationURI urisvpE
      Proxy CA certificate revocation list store for Remote Server Auth
      SSLProxyCheckPeerCN on|off on svpE
      Comprobar el campo CN del certificado del servidor remoto
      SSLProxyCheckPeerExpire on|off on svpE
      Comprobar si el certificado del servidor remoto está expirado @@ -1243,47 +1236,52 @@ ser usados por el proxy para elegir un certificado
      SSLProxyMachineCertificatePath directoriosvpE
      Directorio de certificados cliente codificados en PEM y claves para ser usadas por el proxy
      SSLProxyMachineCertificateURI urisvpE
      Proxy certificate and key stores
      SSLProxyProtocol [+|-]protocolo ... all -SSLv3 svpE
      Configure sabores de protocolo SSL utilizables para uso de +
      SSLProxyProtocol [+|-]protocolo ... all -SSLv3 svpE
      Configure sabores de protocolo SSL utilizables para uso de proxy
      SSLProxyVerify level none svpE
      Tipo de verficación de certificado del servidor remoto
      SSLProxyVerifyDepth number 1 svpE
      Máxima profundidad de los Certificados CA en la verificación del +
      SSLProxyStoreURI urisvpE
      Proxy certificate and key stores
      SSLProxyTrustURI urisvpE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyVerify level none svpE
      Tipo de verficación de certificado del servidor remoto
      SSLProxyVerifyDepth number 1 svpE
      Máxima profundidad de los Certificados CA en la verificación del Certificado en el Servidor Remoto
      SSLRandomSeed contexto fuente -[bytes]sE
      Fuente de generación de semilla pseudoaleatoria de números +
      SSLRandomSeed contexto fuente +[bytes]sE
      Fuente de generación de semilla pseudoaleatoria de números (PRNG)
      SSLRenegBufferSize bytes 131072 dhE
      Configure el tamaño para el búfer de renegociación +
      SSLRenegBufferSize bytes 131072 dhE
      Configure el tamaño para el búfer de renegociación SSL
      SSLRequire expresióndhE
      Permite acceso sólo cuando una compleja expresión booleana +
      SSLRequire expresióndhE
      Permite acceso sólo cuando una compleja expresión booleana arbitraría es cierta
      SSLRequireSSLdhE
      Denegar el acceso cuando no se usa SSL para la petición +
      SSLRequireSSLdhE
      Denegar el acceso cuando no se usa SSL para la petición HTTP
      SSLSessionCache tipo none sE
      Tipo de la Caché global/interproceso de la sesión SSL
      SSLSessionCacheTimeout segundos 300 svE
      Número de segundos antes de que la sesión SSL expira +
      SSLSessionCache tipo none sE
      Tipo de la Caché global/interproceso de la sesión SSL
      SSLSessionCacheTimeout segundos 300 svE
      Número de segundos antes de que la sesión SSL expira en la Cache de Sesión
      SSLSessionTicketKeyFile ruta-al-ficherosvE
      Clave persistente de encriptación/desencriptación para ticket de +
      SSLSessionTicketKeyFile ruta-al-ficherosvE
      Clave persistente de encriptación/desencriptación para ticket de sesión TLS
      SSLSessionTickets on|off on svE
      Activa o desactiva el uso de tickets de sesión TLS
      SSLSRPUnknownUserSeed cadenadecaracteres-secretasvE
      Semilla de usuario desconocido SRP
      SSLSRPVerifierFile ruta-al-ficherosvE
      Ruta hacia el fichero verificador SRP
      SSLStaplingCache tiposE
      Configura la cache del stapling de OCSP
      SSLStaplingErrorCacheTimeout segundos 600 svE
      Número de segundos antes de expirar respuestas inválidas en la +
      SSLSessionTickets on|off on svE
      Activa o desactiva el uso de tickets de sesión TLS
      SSLSRPUnknownUserSeed cadenadecaracteres-secretasvE
      Semilla de usuario desconocido SRP
      SSLSRPVerifierFile ruta-al-ficherosvE
      Ruta hacia el fichero verificador SRP
      SSLStaplingCache tiposE
      Configura la cache del stapling de OCSP
      SSLStaplingErrorCacheTimeout segundos 600 svE
      Número de segundos antes de expirar respuestas inválidas en la cache del stapling de OCSP
      SSLStaplingFakeTryLater on|off on svE
      Sintetiza respuestas "tryLater" para consultas fallidas de stapling +
      SSLStaplingFakeTryLater on|off on svE
      Sintetiza respuestas "tryLater" para consultas fallidas de stapling de OCSP
      SSLStaplingForceURL urisvE
      Sobreescribe la URI especificada por el respondedor OCSP +
      SSLStaplingForceURL urisvE
      Sobreescribe la URI especificada por el respondedor OCSP especificada en la extensión AIA del certificado
      SSLStaplingResponderTimeout segundos 10 svE
      Tiempo máximo para las consultas de stapling de OCSP
      SSLStaplingResponseMaxAge segundos -1 svE
      Edad máxima permitida para respuesta de stapling OCSP
      SSLStaplingResponseTimeSkew segundos 300 svE
      Tiempo máximo permitido para la validación del stapling +
      SSLStaplingResponderTimeout segundos 10 svE
      Tiempo máximo para las consultas de stapling de OCSP
      SSLStaplingResponseMaxAge segundos -1 svE
      Edad máxima permitida para respuesta de stapling OCSP
      SSLStaplingResponseTimeSkew segundos 300 svE
      Tiempo máximo permitido para la validación del stapling OCSP
      SSLStaplingReturnResponderErrors on|off on svE
      Pasa los errores relacionados con stapling de OCSP al cliente +
      SSLStaplingReturnResponderErrors on|off on svE
      Pasa los errores relacionados con stapling de OCSP al cliente
      SSLStaplingStandardCacheTimeout segundos 3600 svE
      Número de segundos antes de expirar las respuestas en la cache del +
      SSLStaplingStandardCacheTimeout segundos 3600 svE
      Número de segundos antes de expirar las respuestas en la cache del stapling de OCSP
      SSLStoreURI urisvE
      Server certificate and key store
      SSLStrictSNIVHostCheck on|off off svE
      Permitir o no a clientes no-SNI acceder a host virtuales basados en nombre.
      SSLTrustRequestURI urisvE
      certificate store of CA Certificates for defining +acceptable CA names
      SSLTrustURI urisvE
      Server CA certificate store for Client Authentication
      SSLUserName nombre de variablesdhE
      Nombre de variable para determinar el nombre de usuario
      SSLUseStapling on|off off svE
      Activa stapling de las respuestas OCSP en el saludo TLS
      SSLCACertificatePath chemin-répertoiresvE
      Répertoire des certificats de CA codés en PEM pour l'authentification des clients
      SSLCACertificateURI urisvE
      Server CA certificate store for Client Authentication
      SSLCADNRequestFile file-pathsvE
      Fichier contenant la concaténation des certificats de CA +
      SSLCADNRequestFile file-pathsvE
      Fichier contenant la concaténation des certificats de CA codés en PEM pour la définition de noms de CA acceptables
      SSLCADNRequestPath chemin-répertoiresvE
      Répertoire contenant des fichiers de certificats de CA +
      SSLCADNRequestPath chemin-répertoiresvE
      Répertoire contenant des fichiers de certificats de CA codés en PEM pour la définition de noms de CA acceptables
      SSLCADNRequestURI urisvE
      certificate store of CA Certificates for defining -acceptable CA names
      SSLCARevocationCheck chain|leaf|none [flags ...] none svE
      Active la vérification des révocations basée sur les CRL
      SSLCARevocationFile file-pathsvE
      Fichier contenant la concaténation des CRLs des CA codés en PEM pour l'authentification des clients
      SSLCARevocationPath chemin-répertoiresvE
      Répertoire des CRLs de CA codés en PEM pour l'authentification des clients
      SSLCARevocationURI urisvE
      Server CA certificate revocation list store for Client Authentication
      SSLCertificateChainFile file-pathsvE
      Fichier contenant les certificats de CA du serveur codés en +
      SSLCertificateChainFile file-pathsvE
      Fichier contenant les certificats de CA du serveur codés en PEM
      SSLCertificateFile file-path|certidsvE
      Fichier de données contenant les informations de certificat X.509 du serveur +
      SSLCertificateFile file-path|certidsvE
      Fichier de données contenant les informations de certificat X.509 du serveur codées au format PEM ou identificateur de jeton
      SSLCertificateKeyFile file-path|keyidsvE
      Fichier contenant la clé privée du serveur codée en +
      SSLCertificateKeyFile file-path|keyidsvE
      Fichier contenant la clé privée du serveur codée en PEM
      SSLCertificateURI urisvE
      Server certificate and key store
      SSLCipherSuite [protocol] cipher-spec DEFAULT (dépend de +svdhE
      Algorithmes de chiffrement disponibles pour la négociation au cours de l'initialisation de la connexion SSL
      SSLClientHelloVars on|off off svE
      Activer la collecte des variables de ClientHello
      SSLProxyCACertificatePath chemin-répertoiresvE
      Répertoire des certificats de CA codés en PEM pour l'authentification des serveurs distants
      SSLProxyCACertificateURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Active la vérification des révocations basée sur les CRLs +
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Active la vérification des révocations basée sur les CRLs pour l'authentification du serveur distant
      SSLProxyCARevocationFile file-pathsvE
      Fichier contenant la concaténation des CRLs de CA codés en +
      SSLProxyCARevocationFile file-pathsvE
      Fichier contenant la concaténation des CRLs de CA codés en PEM pour l'authentification des serveurs distants
      SSLProxyCARevocationPath chemin-répertoiresvE
      Répertoire des CRLs de CA codés en PEM pour +
      SSLProxyCARevocationPath chemin-répertoiresvE
      Répertoire des CRLs de CA codés en PEM pour l'authentification des serveurs distants
      SSLProxyCARevocationURI urisvE
      Proxy CA certificate revocation list store for Remote Server Auth
      SSLProxyCheckPeerCN on|off on svE
      Configuration de la vérification du champ CN du certificat du serveur distant
      SSLProxyMachineCertificatePath chemin-répertoiresvE
      Répertoire des clés et certificats clients codés en PEM que le mandataire doit utiliser
      SSLProxyMachineCertificateURI urisvE
      Proxy certificate and key stores
      SSLProxyProtocol [+|-]protocole ... all -SSLv3 svE
      Définit les protocoles SSL disponibles pour la fonction de +
      SSLProxyProtocol [+|-]protocole ... all -SSLv3 svE
      Définit les protocoles SSL disponibles pour la fonction de mandataire
      SSLProxyVerify niveau none svE
      Niveau de vérification du certificat du serveur +
      SSLProxyStoreURI urisvE
      Proxy certificate and key stores
      SSLProxyTrustURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyVerify niveau none svE
      Niveau de vérification du certificat du serveur distant
      SSLProxyVerifyDepth niveau 1 svE
      Niveau de profondeur maximum dans les certificats de CA +
      SSLProxyVerifyDepth niveau 1 svE
      Niveau de profondeur maximum dans les certificats de CA lors de la vérification du certificat du serveur distant
      SSLRandomSeed contexte source -[nombre]sE
      Source de déclenchement du Générateur de Nombres +
      SSLRandomSeed contexte source +[nombre]sE
      Source de déclenchement du Générateur de Nombres Pseudo-Aléatoires (PRNG)
      SSLRenegBufferSize taille 131072 dhE
      Définit la taille du tampon de renégociation +
      SSLRenegBufferSize taille 131072 dhE
      Définit la taille du tampon de renégociation SSL
      SSLRequire expressiondhE
      N'autorise l'accès que lorsqu'une expression booléenne +
      SSLRequire expressiondhE
      N'autorise l'accès que lorsqu'une expression booléenne complexe et arbitraire est vraie
      SSLRequireSSLdhE
      Interdit l'accès lorsque la requête HTTP n'utilise pas +
      SSLRequireSSLdhE
      Interdit l'accès lorsque la requête HTTP n'utilise pas SSL
      SSLSessionCache type none sE
      Type du cache de session SSL global et +
      SSLSessionCache type none sE
      Type du cache de session SSL global et inter-processus
      SSLSessionCacheTimeout secondes 300 svE
      Nombre de secondes avant l'expiration d'une session SSL +
      SSLSessionCacheTimeout secondes 300 svE
      Nombre de secondes avant l'expiration d'une session SSL dans le cache de sessions
      SSLSessionTicketKeyFile file-pathsvE
      Clé de chiffrement/déchiffrement permanente pour les +
      SSLSessionTicketKeyFile file-pathsvE
      Clé de chiffrement/déchiffrement permanente pour les tickets de session TLS
      SSLSessionTickets on|off on svE
      Active ou désactive les tickets de session TLS
      SSLSRPUnknownUserSeed secret-stringsvE
      Source de randomisation pour utilisateur SRP inconnu
      SSLSRPVerifierFile file-pathsvE
      Chemin du fichier de vérification SRP
      SSLStaplingCache typesE
      Configuration du cache pour l'agrafage OCSP
      SSLStaplingErrorCacheTimeout secondes 600 svE
      Durée de vie des réponses invalides dans le cache pour +
      SSLSessionTickets on|off on svE
      Active ou désactive les tickets de session TLS
      SSLSRPUnknownUserSeed secret-stringsvE
      Source de randomisation pour utilisateur SRP inconnu
      SSLSRPVerifierFile file-pathsvE
      Chemin du fichier de vérification SRP
      SSLStaplingCache typesE
      Configuration du cache pour l'agrafage OCSP
      SSLStaplingErrorCacheTimeout secondes 600 svE
      Durée de vie des réponses invalides dans le cache pour agrafage OCSP
      SSLStaplingFakeTryLater on|off on svE
      Génère une réponse "tryLater" pour les requêtes OCSP échouées
      SSLStaplingForceURL urisvE
      Remplace l'URI du serveur OCSP spécifié dans l'extension +
      SSLStaplingFakeTryLater on|off on svE
      Génère une réponse "tryLater" pour les requêtes OCSP échouées
      SSLStaplingForceURL urisvE
      Remplace l'URI du serveur OCSP spécifié dans l'extension AIA du certificat
      SSLStaplingResponderTimeout secondes 10 svE
      Temps d'attente maximum pour les requêtes vers les serveurs +
      SSLStaplingResponderTimeout secondes 10 svE
      Temps d'attente maximum pour les requêtes vers les serveurs OCSP
      SSLStaplingResponseMaxAge secondes -1 svE
      Age maximum autorisé des réponses OCSP incluses dans la +
      SSLStaplingResponseMaxAge secondes -1 svE
      Age maximum autorisé des réponses OCSP incluses dans la négociation TLS
      SSLStaplingResponseTimeSkew secondes 300 svE
      Durée de vie maximale autorisée des réponses OCSP incluses dans la +
      SSLStaplingResponseTimeSkew secondes 300 svE
      Durée de vie maximale autorisée des réponses OCSP incluses dans la négociation TLS
      SSLStaplingReturnResponderErrors on|off on svE
      Transmet au client les erreurs survenues lors des requêtes +
      SSLStaplingReturnResponderErrors on|off on svE
      Transmet au client les erreurs survenues lors des requêtes OCSP
      SSLStaplingStandardCacheTimeout secondes 3600 svE
      Durée de vie des réponses OCSP dans le cache
      SSLStaplingStandardCacheTimeout secondes 3600 svE
      Durée de vie des réponses OCSP dans le cache
      SSLStoreURI urisvE
      Server certificate and key store
      SSLStrictSNIVHostCheck on|off off svE
      Contrôle de l'accès des clients non-SNI à un serveur virtuel à base de nom.
      SSLTrustRequestURI urisvE
      certificate store of CA Certificates for defining +acceptable CA names
      SSLTrustURI urisvE
      Server CA certificate store for Client Authentication
      SSLUserName nom-varsdhE
      Nom de la variable servant à déterminer le nom de l'utilisateur
      SSLUseStapling on|off off svE
      Active l'ajout des réponses OCSP à la négociation TLS
      SSLCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Client Auth
      SSLCACertificateURI urisvE
      Server CA certificate store for Client Authentication
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates +
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for +
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestURI urisvE
      certificate store of CA Certificates for defining -acceptable CA names
      SSLCARevocationCheck chain|leaf|none [flags ...] none svE
      Enable CRL-based revocation checking
      SSLCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Client Auth
      SSLCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Client Auth
      SSLCARevocationURI urisvE
      Server CA certificate revocation list store for Client Authentication
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCertificateURI urisvE
      Server certificate and key store
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhE
      Cipher Suite available for negotiation in SSL handshake
      SSLClientHelloVars on|off off svE
      Enable collection of ClientHello variables
      SSLProxyCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Remote Server Auth
      SSLProxyCACertificateURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for +
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for +
      SSLProxyCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationURI urisvE
      Proxy CA certificate revocation list store for Remote Server Auth
      SSLProxyCheckPeerCN on|off on svE
      Whether to check the remote server certificate's CN field
      SSLProxyCheckPeerExpire on|off on svE
      Whether to check if remote server certificate is expired @@ -1167,39 +1160,44 @@ proxy handshake
      SSLProxyMachineCertificateChainFile filenamesvE
      File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate
      SSLProxyMachineCertificateFile filenamesvE
      File of concatenated PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificatePath directorysvE
      Directory of PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificateURI urisvE
      Proxy certificate and key stores
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyVerify level none svE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svE
      Maximum depth of CA Certificates in Remote Server +
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyStoreURI urisvE
      Proxy certificate and key stores
      SSLProxyTrustURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyVerify level none svE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svE
      Maximum depth of CA Certificates in Remote Server Certificate verification
      SSLRandomSeed context source -[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding +
      SSLRandomSeed context source +[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding source
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex +
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex boolean expression is true
      SSLRequireSSLdhE
      Deny access when SSL is not used for the +
      SSLRequireSSLdhE
      Deny access when SSL is not used for the HTTP request
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session +
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session Cache
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires +
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires in the Session Cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLStoreURI urisvE
      Server certificate and key store
      SSLStrictSNIVHostCheck on|off off svE
      Whether to allow non-SNI clients to access a name-based virtual host.
      SSLTrustRequestURI urisvE
      certificate store of CA Certificates for defining +acceptable CA names
      SSLTrustURI urisvE
      Server CA certificate store for Client Authentication
      SSLUserName varnamesdhE
      Variable name to determine user name
      SSLUseStapling on|off off svE
      Enable stapling of OCSP responses in the TLS handshake
      SSLVerifyClient level none svdhE
      Type of Client Certificate verification
      SSLCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Client Auth
      SSLCACertificateURI urisvE
      Server CA certificate store for Client Authentication
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates +
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for +
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestURI urisvE
      certificate store of CA Certificates for defining -acceptable CA names
      SSLCARevocationCheck chain|leaf|none [flags ...] none svE
      Enable CRL-based revocation checking
      SSLCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Client Auth
      SSLCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Client Auth
      SSLCARevocationURI urisvE
      Server CA certificate revocation list store for Client Authentication
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCertificateURI urisvE
      Server certificate and key store
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhE
      Cipher Suite available for negotiation in SSL handshake
      SSLClientHelloVars on|off off svE
      Enable collection of ClientHello variables
      SSLProxyCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Remote Server Auth
      SSLProxyCACertificateURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for +
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for +
      SSLProxyCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationURI urisvE
      Proxy CA certificate revocation list store for Remote Server Auth
      SSLProxyCheckPeerCN on|off on svE
      Whether to check the remote server certificate's CN field
      SSLProxyCheckPeerExpire on|off on svE
      Whether to check if remote server certificate is expired @@ -1192,39 +1185,44 @@ proxy handshake
      SSLProxyMachineCertificateChainFile filenamesvE
      File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate
      SSLProxyMachineCertificateFile filenamesvE
      File of concatenated PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificatePath directorysvE
      Directory of PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificateURI urisvE
      Proxy certificate and key stores
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyVerify level none svE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svE
      Maximum depth of CA Certificates in Remote Server +
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyStoreURI urisvE
      Proxy certificate and key stores
      SSLProxyTrustURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyVerify level none svE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svE
      Maximum depth of CA Certificates in Remote Server Certificate verification
      SSLRandomSeed context source -[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding +
      SSLRandomSeed context source +[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding source
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex +
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex boolean expression is true
      SSLRequireSSLdhE
      Deny access when SSL is not used for the +
      SSLRequireSSLdhE
      Deny access when SSL is not used for the HTTP request
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session +
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session Cache
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires +
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires in the Session Cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLStoreURI urisvE
      Server certificate and key store
      SSLStrictSNIVHostCheck on|off off svE
      Whether to allow non-SNI clients to access a name-based virtual host.
      SSLTrustRequestURI urisvE
      certificate store of CA Certificates for defining +acceptable CA names
      SSLTrustURI urisvE
      Server CA certificate store for Client Authentication
      SSLUserName varnamesdhE
      Variable name to determine user name
      SSLUseStapling on|off off svE
      Enable stapling of OCSP responses in the TLS handshake
      SSLVerifyClient level none svdhE
      Type of Client Certificate verification
      SSLCACertificatePath directory-pathskE
      Directory of PEM-encoded CA Certificates for Client Auth
      SSLCACertificateURI uriskE
      Server CA certificate store for Client Authentication
      SSLCADNRequestFile file-pathskE
      File of concatenated PEM-encoded CA Certificates +
      SSLCADNRequestFile file-pathskE
      File of concatenated PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestPath directory-pathskE
      Directory of PEM-encoded CA Certificates for +
      SSLCADNRequestPath directory-pathskE
      Directory of PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestURI uriskE
      certificate store of CA Certificates for defining -acceptable CA names
      SSLCARevocationCheck chain|leaf|none [flags ...] none skE
      Enable CRL-based revocation checking
      SSLCARevocationFile file-pathskE
      File of concatenated PEM-encoded CA CRLs for Client Auth
      SSLCARevocationPath directory-pathskE
      Directory of PEM-encoded CA CRLs for Client Auth
      SSLCARevocationURI uriskE
      Server CA certificate revocation list store for Client Authentication
      SSLCertificateChainFile file-pathskE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidskE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidskE
      Server PEM-encoded private key file
      SSLCertificateURI uriskE
      Server certificate and key store
      SSLCertificateChainFile file-pathskE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidskE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidskE
      Server PEM-encoded private key file
      SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +skdhE
      Cipher Suite available for negotiation in SSL handshake
      SSLClientHelloVars on|off off skE
      Enable collection of ClientHello variables
      SSLProxyCACertificatePath directory-pathskE
      Directory of PEM-encoded CA Certificates for Remote Server Auth
      SSLProxyCACertificateURI uriskE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyCARevocationCheck chain|leaf|none none skE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathskE
      File of concatenated PEM-encoded CA CRLs for +
      SSLProxyCARevocationCheck chain|leaf|none none skE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathskE
      File of concatenated PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationPath directory-pathskE
      Directory of PEM-encoded CA CRLs for +
      SSLProxyCARevocationPath directory-pathskE
      Directory of PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationURI uriskE
      Proxy CA certificate revocation list store for Remote Server Auth
      SSLProxyCheckPeerCN on|off on skE
      Whether to check the remote server certificate's CN field
      SSLProxyCheckPeerExpire on|off on skE
      Whether to check if remote server certificate is expired @@ -1231,39 +1224,44 @@ proxy handshake
      SSLProxyMachineCertificateChainFile filenameskE
      File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate
      SSLProxyMachineCertificateFile filenameskE
      File of concatenated PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificatePath directoryskE
      Directory of PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificateURI uriskE
      Proxy certificate and key stores
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 skE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyVerify level none skE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 skE
      Maximum depth of CA Certificates in Remote Server +
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 skE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyStoreURI uriskE
      Proxy certificate and key stores
      SSLProxyTrustURI uriskE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyVerify level none skE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 skE
      Maximum depth of CA Certificates in Remote Server Certificate verification
      SSLRandomSeed context source -[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding +
      SSLRandomSeed context source +[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding source
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex +
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex boolean expression is true
      SSLRequireSSLdhE
      Deny access when SSL is not used for the +
      SSLRequireSSLdhE
      Deny access when SSL is not used for the HTTP request
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session +
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session Cache
      SSLSessionCacheTimeout seconds 300 skE
      Number of seconds before an SSL session expires +
      SSLSessionCacheTimeout seconds 300 skE
      Number of seconds before an SSL session expires in the Session Cache
      SSLSessionTicketKeyFile file-pathskE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on skE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringskE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathskE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 skE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on skE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL uriskE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 skE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 skE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 skE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on skE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 skE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLSessionTicketKeyFile file-pathskE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on skE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringskE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathskE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 skE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on skE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL uriskE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 skE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 skE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 skE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on skE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 skE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLStoreURI uriskE
      Server certificate and key store
      SSLStrictSNIVHostCheck on|off off skE
      Whether to allow non-SNI clients to access a name-based virtual host.
      SSLTrustRequestURI uriskE
      certificate store of CA Certificates for defining +acceptable CA names
      SSLTrustURI uriskE
      Server CA certificate store for Client Authentication
      SSLUserName varnamesdhE
      Variable name to determine user name
      SSLUseStapling on|off off skE
      Enable stapling of OCSP responses in the TLS handshake
      SSLVerifyClient level none skdhE
      Type of Client Certificate verification
      SSLCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Client Auth
      SSLCACertificateURI urisvE
      Server CA certificate store for Client Authentication
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates +
      SSLCADNRequestFile file-pathsvE
      File of concatenated PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for +
      SSLCADNRequestPath directory-pathsvE
      Directory of PEM-encoded CA Certificates for defining acceptable CA names
      SSLCADNRequestURI urisvE
      certificate store of CA Certificates for defining -acceptable CA names
      SSLCARevocationCheck chain|leaf|none [flags ...] none svE
      Enable CRL-based revocation checking
      SSLCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Client Auth
      SSLCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Client Auth
      SSLCARevocationURI urisvE
      Server CA certificate revocation list store for Client Authentication
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCertificateURI urisvE
      Server certificate and key store
      SSLCertificateChainFile file-pathsvE
      File of PEM-encoded Server CA Certificates
      SSLCertificateFile file-path|certidsvE
      Server PEM-encoded X.509 certificate data file or token identifier
      SSLCertificateKeyFile file-path|keyidsvE
      Server PEM-encoded private key file
      SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhE
      Cipher Suite available for negotiation in SSL handshake
      SSLClientHelloVars on|off off svE
      Enable collection of ClientHello variables
      SSLProxyCACertificatePath directory-pathsvE
      Directory of PEM-encoded CA Certificates for Remote Server Auth
      SSLProxyCACertificateURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for +
      SSLProxyCARevocationCheck chain|leaf|none none svE
      Enable CRL-based revocation checking for Remote Server Auth
      SSLProxyCARevocationFile file-pathsvE
      File of concatenated PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for +
      SSLProxyCARevocationPath directory-pathsvE
      Directory of PEM-encoded CA CRLs for Remote Server Auth
      SSLProxyCARevocationURI urisvE
      Proxy CA certificate revocation list store for Remote Server Auth
      SSLProxyCheckPeerCN on|off on svE
      Whether to check the remote server certificate's CN field
      SSLProxyCheckPeerExpire on|off on svE
      Whether to check if remote server certificate is expired @@ -1229,39 +1222,44 @@ proxy handshake
      SSLProxyMachineCertificateChainFile filenamesvE
      File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate
      SSLProxyMachineCertificateFile filenamesvE
      File of concatenated PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificatePath directorysvE
      Directory of PEM-encoded client certificates and keys to be used by the proxy
      SSLProxyMachineCertificateURI urisvE
      Proxy certificate and key stores
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyVerify level none svE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svE
      Maximum depth of CA Certificates in Remote Server +
      SSLProxyProtocol [+|-]protocol ... all -SSLv3 svE
      Configure usable SSL protocol flavors for proxy usage
      SSLProxyStoreURI urisvE
      Proxy certificate and key stores
      SSLProxyTrustURI urisvE
      Proxy CA certificate store for Remote Server Auth
      SSLProxyVerify level none svE
      Type of remote server Certificate verification
      SSLProxyVerifyDepth number 1 svE
      Maximum depth of CA Certificates in Remote Server Certificate verification
      SSLRandomSeed context source -[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding +
      SSLRandomSeed context source +[bytes]sE
      Pseudo Random Number Generator (PRNG) seeding source
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex +
      SSLRenegBufferSize bytes 131072 dhE
      Set the size for the SSL renegotiation buffer
      SSLRequire expressiondhE
      Allow access only when an arbitrarily complex boolean expression is true
      SSLRequireSSLdhE
      Deny access when SSL is not used for the +
      SSLRequireSSLdhE
      Deny access when SSL is not used for the HTTP request
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session +
      SSLSessionCache type none sE
      Type of the global/inter-process SSL Session Cache
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires +
      SSLSessionCacheTimeout seconds 300 svE
      Number of seconds before an SSL session expires in the Session Cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLSessionTicketKeyFile file-pathsvE
      Persistent encryption/decryption key for TLS session tickets
      SSLSessionTickets on|off on svE
      Enable or disable use of TLS session tickets
      SSLSRPUnknownUserSeed secret-stringsvE
      SRP unknown user seed
      SSLSRPVerifierFile file-pathsvE
      Path to SRP verifier file
      SSLStaplingCache typesE
      Configures the OCSP stapling cache
      SSLStaplingErrorCacheTimeout seconds 600 svE
      Number of seconds before expiring invalid responses in the OCSP stapling cache
      SSLStaplingFakeTryLater on|off on svE
      Synthesize "tryLater" responses for failed OCSP stapling queries
      SSLStaplingForceURL urisvE
      Override the OCSP responder URI specified in the certificate's AIA extension
      SSLStaplingResponderTimeout seconds 10 svE
      Timeout for OCSP stapling queries
      SSLStaplingResponseMaxAge seconds -1 svE
      Maximum allowable age for OCSP stapling responses
      SSLStaplingResponseTimeSkew seconds 300 svE
      Maximum allowable time skew for OCSP stapling response validation
      SSLStaplingReturnResponderErrors on|off on svE
      Pass stapling related OCSP errors on to client
      SSLStaplingStandardCacheTimeout seconds 3600 svE
      Number of seconds before expiring responses in the OCSP stapling cache
      SSLStoreURI urisvE
      Server certificate and key store
      SSLStrictSNIVHostCheck on|off off svE
      Whether to allow non-SNI clients to access a name-based virtual host.
      SSLTrustRequestURI urisvE
      certificate store of CA Certificates for defining +acceptable CA names
      SSLTrustURI urisvE
      Server CA certificate store for Client Authentication
      SSLUserName varnamesdhE
      Variable name to determine user name
      SSLUseStapling on|off off svE
      Enable stapling of OCSP responses in the TLS handshake
      SSLVerifyClient level none svdhE
      Type of Client Certificate verification