summaryrefslogtreecommitdiff
path: root/docs/manual/ssl
diff options
context:
space:
mode:
authorStefan Fritsch <sf@sfritsch.de>2011-12-27 19:42:03 +0100
committerStefan Fritsch <sf@sfritsch.de>2011-12-27 19:42:03 +0100
commit80db94fff6a9620fb469ee911347ed973e3f7735 (patch)
tree35ccde4018b7e6b84103e5e85dc1085ef9e7d6c2 /docs/manual/ssl
downloadapache2-upstream/2.2.3.tar.gz
Upstream tarball 2.2.3upstream/2.2.3
Diffstat (limited to 'docs/manual/ssl')
-rw-r--r--docs/manual/ssl/index.html7
-rw-r--r--docs/manual/ssl/index.html.en57
-rw-r--r--docs/manual/ssl/index.html.ja.euc-jp59
-rw-r--r--docs/manual/ssl/ssl_compat.html3
-rw-r--r--docs/manual/ssl/ssl_compat.html.en226
-rw-r--r--docs/manual/ssl/ssl_faq.html3
-rw-r--r--docs/manual/ssl/ssl_faq.html.en1044
-rw-r--r--docs/manual/ssl/ssl_howto.html3
-rw-r--r--docs/manual/ssl/ssl_howto.html.en294
-rw-r--r--docs/manual/ssl/ssl_intro.html7
-rw-r--r--docs/manual/ssl/ssl_intro.html.en650
-rw-r--r--docs/manual/ssl/ssl_intro.html.ja.euc-jp697
12 files changed, 3050 insertions, 0 deletions
diff --git a/docs/manual/ssl/index.html b/docs/manual/ssl/index.html
new file mode 100644
index 00000000..39629cac
--- /dev/null
+++ b/docs/manual/ssl/index.html
@@ -0,0 +1,7 @@
+URI: index.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
+
+URI: index.html.ja.euc-jp
+Content-Language: ja
+Content-type: text/html; charset=EUC-JP
diff --git a/docs/manual/ssl/index.html.en b/docs/manual/ssl/index.html.en
new file mode 100644
index 00000000..86476391
--- /dev/null
+++ b/docs/manual/ssl/index.html.en
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ This file is generated from xml source: DO NOT EDIT
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ -->
+<title>Apache SSL/TLS Encryption - Apache HTTP Server</title>
+<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
+<link href="../images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.2</p>
+<img alt="" src="../images/feather.gif" /></div>
+<div class="up"><a href="../"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.2</a></div><div id="page-content"><div id="preamble"><h1>Apache SSL/TLS Encryption</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="../en/ssl/" title="English">&nbsp;en&nbsp;</a> |
+<a href="../ja/ssl/" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a></p>
+</div>
+
+<p>The Apache HTTP Server module <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>
+provides an interface to the <a href="http://www.openssl.org/">OpenSSL</a> library, which provides
+Strong Encryption using the Secure Sockets Layer and Transport Layer
+Security protocols. The module and this documentation are based on
+Ralf S. Engelschall's mod_ssl project.</p>
+</div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#documentation">Documentation</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#mod-ssl">mod_ssl</a></li>
+</ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="documentation" id="documentation">Documentation</a></h2>
+<ul>
+<li><a href="ssl_intro.html">Introduction</a></li>
+<li><a href="ssl_compat.html">Compatibility</a></li>
+<li><a href="ssl_howto.html">How-To</a></li>
+<li><a href="ssl_faq.html">Frequently Asked Questions</a></li>
+<li><a href="../glossary.html">Glossary</a></li>
+</ul>
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="mod-ssl" id="mod-ssl">mod_ssl</a></h2>
+<p>Extensive documentation on the directives and environment variables
+provided by this module is provided in the <a href="../mod/mod_ssl.html">mod_ssl reference documentation</a>.
+</p>
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="../en/ssl/" title="English">&nbsp;en&nbsp;</a> |
+<a href="../ja/ssl/" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a></p>
+</div><div id="footer">
+<p class="apache">Copyright 2006 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
+</body></html> \ No newline at end of file
diff --git a/docs/manual/ssl/index.html.ja.euc-jp b/docs/manual/ssl/index.html.ja.euc-jp
new file mode 100644
index 00000000..bfa1c7e8
--- /dev/null
+++ b/docs/manual/ssl/index.html.ja.euc-jp
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="EUC-JP"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="ja" xml:lang="ja"><head><!--
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ This file is generated from xml source: DO NOT EDIT
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ -->
+<title>Apache の SSL/TLS 暗号化 - Apache HTTP サーバ</title>
+<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
+<link href="../images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="../mod/">モジュール</a> | <a href="../mod/directives.html">ディレクティブ</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">用語</a> | <a href="../sitemap.html">サイトマップ</a></p>
+<p class="apache">Apache HTTP サーバ バージョン 2.2</p>
+<img alt="" src="../images/feather.gif" /></div>
+<div class="up"><a href="../"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP サーバ</a> &gt; <a href="http://httpd.apache.org/docs/">ドキュメンテーション</a> &gt; <a href="../">バージョン 2.2</a></div><div id="page-content"><div id="preamble"><h1>Apache の SSL/TLS 暗号化</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="../en/ssl/" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="../ja/ssl/" title="Japanese">&nbsp;ja&nbsp;</a></p>
+</div>
+
+<p>Apache HTTP サーバモジュール <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> が
+<a href="http://www.openssl.org/">OpenSSL</a>
+ライブラリへのインターフェースを提供していますが、これは
+Secure Sockts Layer と Transport Layer Security
+プロトコルを用いた強力な暗号化を提供します。
+このモジュールやこの文書は Ralf S. Engelschall の mod_ssl
+プロジェクトに基づいています。</p>
+</div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#documentation">Documentation</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#mod-ssl">mod_ssl</a></li>
+</ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="documentation" id="documentation">Documentation</a></h2>
+<ul>
+<li><a href="ssl_intro.html">はじめに</a></li>
+<li><a href="ssl_compat.html">互換性</a></li>
+<li><a href="ssl_howto.html">How-To</a></li>
+<li><a href="ssl_faq.html">よくある質問</a></li>
+<li><a href="../glossary.html">用語</a></li>
+</ul>
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="mod-ssl" id="mod-ssl">mod_ssl</a></h2>
+<p>このモジュールで提供されるディレクティブや環境変数に関する
+詳しい文書は、<a href="../mod/mod_ssl.html">mod_ssl
+リファレンス</a>をご覧下さい。</p>
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="../en/ssl/" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="../ja/ssl/" title="Japanese">&nbsp;ja&nbsp;</a></p>
+</div><div id="footer">
+<p class="apache">Copyright 2006 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="../mod/">モジュール</a> | <a href="../mod/directives.html">ディレクティブ</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">用語</a> | <a href="../sitemap.html">サイトマップ</a></p></div>
+</body></html> \ No newline at end of file
diff --git a/docs/manual/ssl/ssl_compat.html b/docs/manual/ssl/ssl_compat.html
new file mode 100644
index 00000000..3a8ed1be
--- /dev/null
+++ b/docs/manual/ssl/ssl_compat.html
@@ -0,0 +1,3 @@
+URI: ssl_compat.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
diff --git a/docs/manual/ssl/ssl_compat.html.en b/docs/manual/ssl/ssl_compat.html.en
new file mode 100644
index 00000000..be0865f0
--- /dev/null
+++ b/docs/manual/ssl/ssl_compat.html.en
@@ -0,0 +1,226 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ This file is generated from xml source: DO NOT EDIT
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ -->
+<title>SSL/TLS Strong Encryption: Compatibility - Apache HTTP Server</title>
+<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
+<link href="../images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.2</p>
+<img alt="" src="../images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.2</a> &gt; <a href="./">SSL/TLS</a></div><div id="page-content"><div id="preamble"><h1>SSL/TLS Strong Encryption: Compatibility</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_compat.html" title="English">&nbsp;en&nbsp;</a></p>
+</div>
+
+<blockquote>
+<p>All PCs are compatible. But some of
+them are more compatible than others.</p>
+<p class="cite">-- <cite>Unknown</cite></p>
+</blockquote>
+
+<p>
+This page covers backwards compatibility between mod_ssl and other
+SSL solutions. mod_ssl is not the only SSL solution for Apache; four
+additional products are (or were) also available: Ben Laurie's freely
+available <a href="http://www.apache-ssl.org/">Apache-SSL</a> (from
+where mod_ssl were originally derived in 1998), Red Hat's commercial
+<a href="http://www.redhat.com/products/product-details.phtml?id=rhsa">Secure
+Web Server</a> (which was based on mod_ssl), Covalent's commercial <a href="http://www.covalent.net/">Raven SSL Module</a> (also based on
+mod_ssl) and finally C2Net's (now Red Hat's) commercial product <a href="http://www.redhat.com/explore/stronghold/">Stronghold</a> (based
+on a different evolution branch named Sioux up to Stronghold 2.x and
+based on mod_ssl since Stronghold 3.x).</p>
+
+<p>
+mod_ssl mostly provides a superset of the functionality of all the other
+solutions, so it's simple to migrate from one of the older modules to
+mod_ssl. The configuration directives and environment variable names
+used by the older SSL solutions vary from those used in mod_ssl;
+mapping tables are included here to give the equivalents used by mod_ssl.</p>
+</div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#configuration">Configuration Directives</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#variables">Environment Variables</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#customlog">Custom Log Functions</a></li>
+</ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="configuration" id="configuration">Configuration Directives</a></h2>
+<p>The mapping between configuration directives used by Apache-SSL
+1.x and mod_ssl 2.0.x is given in <a href="#table1">Table
+1</a>. The mapping from Sioux 1.x and Stronghold 2.x is only partial
+because of special functionality in these interfaces which mod_ssl
+doesn't provide.</p>
+
+
+<h3><a name="table1" id="table1">Table 1: Configuration Directive Mapping</a></h3>
+
+<table><tr class="header"><th>Old Directive</th><th>mod_ssl Directive</th><th>Comment</th></tr>
+<tr class="header"><th colspan="3">Apache-SSL 1.x &amp; mod_ssl 2.0.x compatibility:</th></tr>
+<tr><td><code>SSLEnable</code></td><td><code>SSLEngine on</code></td><td>compactified</td></tr>
+<tr class="odd"><td><code>SSLDisable</code></td><td><code>SSLEngine off</code></td><td>compactified</td></tr>
+<tr><td><code>SSLLogFile</code> <em>file</em></td><td><code>SSLLog</code> <em>file</em></td><td>compactified</td></tr>
+<tr class="odd"><td><code>SSLRequiredCiphers</code> <em>spec</em></td><td><code>SSLCipherSuite</code> <em>spec</em></td><td>renamed</td></tr>
+<tr><td><code>SSLRequireCipher</code> <em>c1</em> ...</td><td><code>SSLRequire %{SSL_CIPHER} in {"</code><em>c1</em><code>",
+...}</code></td><td>generalized</td></tr>
+<tr class="odd"><td><code>SSLBanCipher</code> <em>c1</em> ...</td><td><code>SSLRequire not (%{SSL_CIPHER} in {"</code><em>c1</em><code>",
+...})</code></td><td>generalized</td></tr>
+<tr><td><code>SSLFakeBasicAuth</code></td><td><code>SSLOptions +FakeBasicAuth</code></td><td>merged</td></tr>
+<tr class="odd"><td><code>SSLCacheServerPath</code> <em>dir</em></td><td>-</td><td>functionality removed</td></tr>
+<tr><td><code>SSLCacheServerPort</code> <em>integer</em></td><td>-</td><td>functionality removed</td></tr>
+<tr class="header"><th colspan="3">Apache-SSL 1.x compatibility:</th></tr>
+<tr class="odd"><td><code>SSLExportClientCertificates</code></td><td><code>SSLOptions +ExportCertData</code></td><td>merged</td></tr>
+<tr><td><code>SSLCacheServerRunDir</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr class="header"><th colspan="3">Sioux 1.x compatibility:</th></tr>
+<tr class="odd"><td><code>SSL_CertFile</code> <em>file</em></td><td><code>SSLCertificateFile</code> <em>file</em></td><td>renamed</td></tr>
+<tr><td><code>SSL_KeyFile</code> <em>file</em></td><td><code>SSLCertificateKeyFile</code> <em>file</em></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CipherSuite</code> <em>arg</em></td><td><code>SSLCipherSuite</code> <em>arg</em></td><td>renamed</td></tr>
+<tr><td><code>SSL_X509VerifyDir</code> <em>arg</em></td><td><code>SSLCACertificatePath</code> <em>arg</em></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_Log</code> <em>file</em></td><td><code>SSLLogFile</code> <em>file</em></td><td>renamed</td></tr>
+<tr><td><code>SSL_Connect</code> <em>flag</em></td><td><code>SSLEngine</code> <em>flag</em></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_ClientAuth</code> <em>arg</em></td><td><code>SSLVerifyClient</code> <em>arg</em></td><td>renamed</td></tr>
+<tr><td><code>SSL_X509VerifyDepth</code> <em>arg</em></td><td><code>SSLVerifyDepth</code> <em>arg</em></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_FetchKeyPhraseFrom</code> <em>arg</em></td><td>-</td><td>not directly mappable; use SSLPassPhraseDialog</td></tr>
+<tr><td><code>SSL_SessionDir</code> <em>dir</em></td><td>-</td><td>not directly mappable; use SSLSessionCache</td></tr>
+<tr class="odd"><td><code>SSL_Require</code> <em>expr</em></td><td>-</td><td>not directly mappable; use SSLRequire</td></tr>
+<tr><td><code>SSL_CertFileType</code> <em>arg</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr class="odd"><td><code>SSL_KeyFileType</code> <em>arg</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr><td><code>SSL_X509VerifyPolicy</code> <em>arg</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr class="odd"><td><code>SSL_LogX509Attributes</code> <em>arg</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr class="header"><th colspan="3">Stronghold 2.x compatibility:</th></tr>
+<tr><td><code>StrongholdAccelerator</code> <em>engine</em></td><td><code>SSLCryptoDevice</code> <em>engine</em></td><td>renamed</td></tr>
+<tr class="odd"><td><code>StrongholdKey</code> <em>dir</em></td><td>-</td><td>functionality not needed</td></tr>
+<tr><td><code>StrongholdLicenseFile</code> <em>dir</em></td><td>-</td><td>functionality not needed</td></tr>
+<tr class="odd"><td><code>SSLFlag</code> <em>flag</em></td><td><code>SSLEngine</code> <em>flag</em></td><td>renamed</td></tr>
+<tr><td><code>SSLSessionLockFile</code> <em>file</em></td><td><code>SSLMutex</code> <em>file</em></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSLCipherList</code> <em>spec</em></td><td><code>SSLCipherSuite</code> <em>spec</em></td><td>renamed</td></tr>
+<tr><td><code>RequireSSL</code></td><td><code>SSLRequireSSL</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSLErrorFile</code> <em>file</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr><td><code>SSLRoot</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr class="odd"><td><code>SSL_CertificateLogDir</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr><td><code>AuthCertDir</code> <em>dir</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr class="odd"><td><code>SSL_Group</code> <em>name</em></td><td>-</td><td>functionality not supported</td></tr>
+<tr><td><code>SSLProxyMachineCertPath</code> <em>dir</em></td><td><code>SSLProxyMachineCertificatePath</code> <em>dir</em></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSLProxyMachineCertFile</code> <em>file</em></td><td><code>SSLProxyMachineCertificateFile</code> <em>file</em></td><td>renamed</td></tr>
+<tr><td><code>SSLProxyCipherList</code> <em>spec</em></td><td><code>SSLProxyCipherSpec</code> <em>spec</em></td><td>renamed</td></tr>
+</table>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="variables" id="variables">Environment Variables</a></h2>
+
+<p>The mapping between environment variable names used by the older
+SSL solutions and the names used by mod_ssl is given in <a href="#table2">Table 2</a>.</p>
+
+<h3><a name="table2" id="table2">Table 2: Environment Variable Derivation</a></h3>
+
+<table><tr class="header"><th>Old Variable</th><th>mod_ssl Variable</th><th>Comment</th></tr>
+<tr><td><code>SSL_PROTOCOL_VERSION</code></td><td><code>SSL_PROTOCOL</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSLEAY_VERSION</code></td><td><code>SSL_VERSION_LIBRARY</code></td><td>renamed</td></tr>
+<tr><td><code>HTTPS_SECRETKEYSIZE</code></td><td><code>SSL_CIPHER_USEKEYSIZE</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>HTTPS_KEYSIZE</code></td><td><code>SSL_CIPHER_ALGKEYSIZE</code></td><td>renamed</td></tr>
+<tr><td><code>HTTPS_CIPHER</code></td><td><code>SSL_CIPHER</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>HTTPS_EXPORT</code></td><td><code>SSL_CIPHER_EXPORT</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_KEY_SIZE</code></td><td><code>SSL_CIPHER_ALGKEYSIZE</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_CERTIFICATE</code></td><td><code>SSL_SERVER_CERT</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_CERT_START</code></td><td><code>SSL_SERVER_V_START</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_CERT_END</code></td><td><code>SSL_SERVER_V_END</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_CERT_SERIAL</code></td><td><code>SSL_SERVER_M_SERIAL</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_SIGNATURE_ALGORITHM</code></td><td><code>SSL_SERVER_A_SIG</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_DN</code></td><td><code>SSL_SERVER_S_DN</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_CN</code></td><td><code>SSL_SERVER_S_DN_CN</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_EMAIL</code></td><td><code>SSL_SERVER_S_DN_Email</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_O</code></td><td><code>SSL_SERVER_S_DN_O</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_OU</code></td><td><code>SSL_SERVER_S_DN_OU</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_C</code></td><td><code>SSL_SERVER_S_DN_C</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_SP</code></td><td><code>SSL_SERVER_S_DN_SP</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_L</code></td><td><code>SSL_SERVER_S_DN_L</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_IDN</code></td><td><code>SSL_SERVER_I_DN</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_ICN</code></td><td><code>SSL_SERVER_I_DN_CN</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_IEMAIL</code></td><td><code>SSL_SERVER_I_DN_Email</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_IO</code></td><td><code>SSL_SERVER_I_DN_O</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_IOU</code></td><td><code>SSL_SERVER_I_DN_OU</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_IC</code></td><td><code>SSL_SERVER_I_DN_C</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SERVER_ISP</code></td><td><code>SSL_SERVER_I_DN_SP</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_IL</code></td><td><code>SSL_SERVER_I_DN_L</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_CERTIFICATE</code></td><td><code>SSL_CLIENT_CERT</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_CERT_START</code></td><td><code>SSL_CLIENT_V_START</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_CERT_END</code></td><td><code>SSL_CLIENT_V_END</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_CERT_SERIAL</code></td><td><code>SSL_CLIENT_M_SERIAL</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_SIGNATURE_ALGORITHM</code></td><td><code>SSL_CLIENT_A_SIG</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_DN</code></td><td><code>SSL_CLIENT_S_DN</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_CN</code></td><td><code>SSL_CLIENT_S_DN_CN</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_EMAIL</code></td><td><code>SSL_CLIENT_S_DN_Email</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_O</code></td><td><code>SSL_CLIENT_S_DN_O</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_OU</code></td><td><code>SSL_CLIENT_S_DN_OU</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_C</code></td><td><code>SSL_CLIENT_S_DN_C</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_SP</code></td><td><code>SSL_CLIENT_S_DN_SP</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_L</code></td><td><code>SSL_CLIENT_S_DN_L</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_IDN</code></td><td><code>SSL_CLIENT_I_DN</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_ICN</code></td><td><code>SSL_CLIENT_I_DN_CN</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_IEMAIL</code></td><td><code>SSL_CLIENT_I_DN_Email</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_IO</code></td><td><code>SSL_CLIENT_I_DN_O</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_IOU</code></td><td><code>SSL_CLIENT_I_DN_OU</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_IC</code></td><td><code>SSL_CLIENT_I_DN_C</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_ISP</code></td><td><code>SSL_CLIENT_I_DN_SP</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_CLIENT_IL</code></td><td><code>SSL_CLIENT_I_DN_L</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_EXPORT</code></td><td><code>SSL_CIPHER_EXPORT</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_KEYSIZE</code></td><td><code>SSL_CIPHER_ALGKEYSIZE</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_SECKEYSIZE</code></td><td><code>SSL_CIPHER_USEKEYSIZE</code></td><td>renamed</td></tr>
+<tr><td><code>SSL_SSLEAY_VERSION</code></td><td><code>SSL_VERSION_LIBRARY</code></td><td>renamed</td></tr>
+<tr class="odd"><td><code>SSL_STRONG_CRYPTO</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr><td><code>SSL_SERVER_KEY_EXP</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_KEY_ALGORITHM</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr><td><code>SSL_SERVER_KEY_SIZE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_SESSIONDIR</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr><td><code>SSL_SERVER_CERTIFICATELOGDIR</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_CERTFILE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr><td><code>SSL_SERVER_KEYFILE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr class="odd"><td><code>SSL_SERVER_KEYFILETYPE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr><td><code>SSL_CLIENT_KEY_EXP</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr class="odd"><td><code>SSL_CLIENT_KEY_ALGORITHM</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+<tr><td><code>SSL_CLIENT_KEY_SIZE</code></td><td><code>-</code></td><td>Not supported by mod_ssl</td></tr>
+</table>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="customlog" id="customlog">Custom Log Functions</a></h2>
+<p>
+When mod_ssl is enabled, additional functions exist for the <a href="../mod/mod_log_config.html#formats">Custom Log Format</a> of
+<code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code> as documented in the Reference
+Chapter. Beside the ``<code>%{</code><em>varname</em><code>}x</code>''
+eXtension format function which can be used to expand any variables provided
+by any module, an additional Cryptography
+``<code>%{</code><em>name</em><code>}c</code>'' cryptography format function
+exists for backward compatibility. The currently implemented function calls
+are listed in <a href="#table3">Table 3</a>.</p>
+
+<h3><a name="table3" id="table3">Table 3: Custom Log Cryptography Function</a></h3>
+
+<table>
+
+<tr><th>Function Call</th><th>Description</th></tr>
+
+<tr><td><code>%...{version}c</code></td> <td>SSL protocol version</td></tr>
+<tr><td><code>%...{cipher}c</code></td> <td>SSL cipher</td></tr>
+<tr><td><code>%...{subjectdn}c</code></td> <td>Client Certificate Subject Distinguished Name</td></tr>
+<tr><td><code>%...{issuerdn}c</code></td> <td>Client Certificate Issuer Distinguished Name</td></tr>
+<tr><td><code>%...{errcode}c</code></td> <td>Certificate Verification Error (numerical)</td></tr>
+
+<tr><td><code>%...{errstr}c</code></td> <td>Certificate Verification Error (string)</td></tr>
+</table>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_compat.html" title="English">&nbsp;en&nbsp;</a></p>
+</div><div id="footer">
+<p class="apache">Copyright 2006 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
+</body></html> \ No newline at end of file
diff --git a/docs/manual/ssl/ssl_faq.html b/docs/manual/ssl/ssl_faq.html
new file mode 100644
index 00000000..c6d2ea13
--- /dev/null
+++ b/docs/manual/ssl/ssl_faq.html
@@ -0,0 +1,3 @@
+URI: ssl_faq.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
diff --git a/docs/manual/ssl/ssl_faq.html.en b/docs/manual/ssl/ssl_faq.html.en
new file mode 100644
index 00000000..0526f619
--- /dev/null
+++ b/docs/manual/ssl/ssl_faq.html.en
@@ -0,0 +1,1044 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ This file is generated from xml source: DO NOT EDIT
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ -->
+<title>SSL/TLS Strong Encryption: FAQ - Apache HTTP Server</title>
+<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
+<link href="../images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.2</p>
+<img alt="" src="../images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.2</a> &gt; <a href="./">SSL/TLS</a></div><div id="page-content"><div id="preamble"><h1>SSL/TLS Strong Encryption: FAQ</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_faq.html" title="English">&nbsp;en&nbsp;</a></p>
+</div>
+
+<blockquote>
+<p>The wise man doesn't give the right answers,
+he poses the right questions.</p>
+<p class="cite">-- <cite>Claude Levi-Strauss</cite></p>
+
+</blockquote>
+<p>This chapter is a collection of frequently asked questions (FAQ) and
+corresponding answers following the popular USENET tradition. Most of these
+questions occurred on the Newsgroup <code><a href="news:comp.infosystems.www.servers.unix">comp.infosystems.www.servers.unix</a></code> or the mod_ssl Support
+Mailing List <code><a href="mailto:modssl-users@modssl.org">modssl-users@modssl.org</a></code>. They are collected at this place
+to avoid answering the same questions over and over.</p>
+
+<p>Please read this chapter at least once when installing mod_ssl or at least
+search for your problem here before submitting a problem report to the
+author.</p>
+</div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#about">About The Module</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#installation">Installation</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#aboutconfig">Configuration</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#aboutcerts">Certificates</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#aboutssl">The SSL Protocol</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#support">mod_ssl Support</a></li>
+</ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="about" id="about">About The Module</a></h2>
+<ul>
+<li><a href="#history">What is the history of mod_ssl?</a></li>
+<li><a href="#y2k">mod_ssl and Year 2000?</a></li>
+<li><a href="#wassenaar">mod_ssl and Wassenaar Arrangement?</a></li>
+</ul>
+
+<h3><a name="history" id="history">What is the history of mod_ssl?</a></h3>
+<p>The mod_ssl v1 package was initially created in April 1998 by <a href="mailto:rse@engelschall.com">Ralf S. Engelschall</a> via porting <a href="mailto:ben@algroup.co.uk">Ben Laurie</a>'s <a href="http://www.apache-ssl.org/">Apache-SSL</a> 1.17 source patches for
+ Apache 1.2.6 to Apache 1.3b6. Because of conflicts with Ben
+ Laurie's development cycle it then was re-assembled from scratch for
+ Apache 1.3.0 by merging the old mod_ssl 1.x with the newer Apache-SSL
+ 1.18. From this point on mod_ssl lived its own life as mod_ssl v2. The
+ first publicly released version was mod_ssl 2.0.0 from August 10th,
+ 1998. </p>
+
+ <p>After US export restrictions on cryptographic software were
+ loosened, <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> became part of the Apache HTTP
+ Server with the release of Apache httpd 2.</p>
+
+
+<h3><a name="wassenaar" id="wassenaar">Is mod_ssl affected by the Wassenaar Arrangement?</a></h3>
+<p>First, let us explain what <dfn>Wassenaar</dfn> and its <dfn>Arrangement on
+ Export Controls for Conventional Arms and Dual-Use Goods and
+ Technologies</dfn> is: This is a international regime, established in 1995, to
+ control trade in conventional arms and dual-use goods and technology. It
+ replaced the previous <dfn>CoCom</dfn> regime. Further details on
+ both the Arrangement and its signatories are available at <a href="http://www.wassenaar.org/">http://www.wassenaar.org/</a>.</p>
+
+ <p>In short, the aim of the Wassenaar Arrangement is to prevent the build up
+ of military capabilities that threaten regional and international security
+ and stability. The Wassenaar Arrangement controls the export of
+ cryptography as a dual-use good, that is, something that has both military and
+ civilian applications. However, the Wassenaar Arrangement also provides an
+ exemption from export controls for mass-market software and free software.</p>
+
+ <p>In the current Wassenaar <cite>List of Dual Use Goods and Technologies And
+ Munitions</cite>, under <q>GENERAL SOFTWARE NOTE (GSN)</q> it says
+ <q>The Lists do not control "software" which is either: 1. [...] 2. "in
+ the public domain".</q> And under <q>DEFINITIONS OF TERMS USED IN
+ THESE LISTS</q> we find <q>In the public
+ domain</q> defined as <q>"technology" or "software" which has been made
+ available without restrictions upon its further dissemination. Note:
+ Copyright restrictions do not remove "technology" or "software" from being
+ "in the public domain".</q></p>
+
+ <p>So, both mod_ssl and OpenSSL are <q>in the public domain</q> for the purposes
+ of the Wassenaar Arrangement and its <q>List of Dual Use Goods and
+ Technologies And Munitions List</q>, and thus not affected by its provisions.</p>
+
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="installation" id="installation">Installation</a></h2>
+<ul>
+<li><a href="#mutex">Why do I get permission errors related to
+SSLMutex when I start Apache?</a></li>
+<li><a href="#entropy">Why does mod_ssl stop with the error "Failed to
+generate temporary 512 bit RSA private key", when I start Apache?</a></li>
+</ul>
+
+<h3><a name="mutex" id="mutex">Why do I get permission errors related to
+ SSLMutex when I start Apache?</a></h3>
+ <p>Errors such as ``<code>mod_ssl: Child could not open
+ SSLMutex lockfile /opt/apache/logs/ssl_mutex.18332 (System error follows)
+ [...] System: Permission denied (errno: 13)</code>'' are usually
+ caused by overly restrictive permissions on the <em>parent</em> directories.
+ Make sure that all parent directories (here <code>/opt</code>,
+ <code>/opt/apache</code> and <code>/opt/apache/logs</code>) have the x-bit
+ set for, at minimum, the UID under which Apache's children are running (see
+ the <code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> directive).</p>
+
+
+<h3><a name="entropy" id="entropy">Why does mod_ssl stop with the error
+ "Failed to generate temporary 512 bit RSA private key", when I start
+ Apache?</a></h3>
+ <p>Cryptographic software needs a source of unpredictable data
+ to work correctly. Many open source operating systems provide
+ a "randomness device" that serves this purpose (usually named
+ <code>/dev/random</code>). On other systems, applications have to
+ seed the OpenSSL Pseudo Random Number Generator (PRNG) manually with
+ appropriate data before generating keys or performing public key
+ encryption. As of version 0.9.5, the OpenSSL functions that need
+ randomness report an error if the PRNG has not been seeded with
+ at least 128 bits of randomness.</p>
+ <p>To prevent this error, <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> has to provide
+ enough entropy to the PRNG to allow it to work correctly. This can
+ be done via the <code class="directive"><a href="../mod/mod_ssl.html#sslrandomseed">SSLRandomSeed</a></code>
+ directives.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="aboutconfig" id="aboutconfig">Configuration</a></h2>
+<ul>
+<li><a href="#parallel">Is it possible to provide HTTP and HTTPS from
+the same server?</a></li>
+<li><a href="#ports">Which port does HTTPS use?</a></li>
+<li><a href="#httpstest">How do I speak HTTPS manually for testing
+purposes?</a></li>
+<li><a href="#hang">Why does the connection hang when I connect to my
+SSL-aware Apache server</a></li>
+<li><a href="#refused">Why do I get ``Connection Refused'' errors, when
+trying to access my newly installed Apache+mod_ssl server via HTTPS?</a></li>
+<li><a href="#envvars">Why are the <code>SSL_XXX</code> variables not
+available to my CGI &amp; SSI scripts?</a></li>
+<li><a href="#relative">How can I switch between HTTP and HTTPS in
+relative hyperlinks?</a></li>
+</ul>
+
+<h3><a name="parallel" id="parallel">Is it possible to provide HTTP and HTTPS
+ from the same server?</a></h3>
+ <p>Yes. HTTP and HTTPS use different server ports (HTTP binds to
+ port 80, HTTPS to port 443), so there is no direct conflict between
+ them. You can either run two separate server instances bound to
+ these ports, or use Apache's elegant virtual hosting facility to
+ create two virtual servers over one instance of Apache - one
+ responding to requests on port 80 and speaking HTTP and the other
+ responding to requests on port 443 speaking HTTPS.</p>
+
+
+<h3><a name="ports" id="ports">Which port does HTTPS use?</a></h3>
+<p>You can run HTTPS on any port, but the standards specify port 443, which
+ is where any HTTPS compliant browser will look by default. You can force
+ your browser to look on a different port by specifying it in the URL like
+ this (for port 666): <code>https://secure.server.dom:666/</code></p>
+
+
+<h3><a name="httpstest" id="httpstest">How do I speak HTTPS manually for testing purposes?</a></h3>
+ <p>While you usually just use</p>
+
+ <div class="example"><p><code>$ telnet localhost 80<br />
+ GET / HTTP/1.0</code></p></div>
+
+ <p>for simple testing of Apache via HTTP, it's not so easy for
+ HTTPS because of the SSL protocol between TCP and HTTP. With the
+ help of OpenSSL's <code>s_client</code> command, however, you can
+ do a similar check for HTTPS:</p>
+
+ <div class="example"><p><code>$ openssl s_client -connect localhost:443 -state -debug<br />
+ GET / HTTP/1.0</code></p></div>
+
+ <p>Before the actual HTTP response you will receive detailed
+ information about the SSL handshake. For a more general command
+ line client which directly understands both HTTP and HTTPS, can
+ perform GET and POST operations, can use a proxy, supports byte
+ ranges, etc. you should have a look at the nifty
+ <a href="http://curl.haxx.se/">cURL</a> tool. Using this, you can
+ check that Apache is responding correctly on ports 80 and 443 as
+ follows:</p>
+
+ <div class="example"><p><code>$ curl http://localhost/<br />
+ $ curl https://localhost/</code></p></div>
+
+
+<h3><a name="hang" id="hang">Why does the connection hang when I connect
+ to my SSL-aware Apache server?</a></h3>
+<p>Because you connected with HTTP to the HTTPS port, i.e. you used an URL of
+ the form ``<code>http://</code>'' instead of ``<code>https://</code>''.
+ This also happens the other way round when you connect via HTTPS to a HTTP
+ port, i.e. when you try to use ``<code>https://</code>'' on a server that
+ doesn't support SSL (on this port). Make sure you are connecting to a
+ virtual server that supports SSL, which is probably the IP associated with
+ your hostname, not localhost (127.0.0.1).</p>
+
+
+<h3><a name="refused" id="refused">Why do I get ``Connection Refused'' messages,
+ when trying to access my newly installed Apache+mod_ssl server via HTTPS?</a></h3>
+<p>This can happen for various reasons. The most common mistakes
+ include starting Apache with just <code>apachectl start</code> (or
+ <code class="program"><a href="../programs/httpd.html">httpd</a></code>) instead of <code>apachectl startssl</code> (or
+ <code>httpd -DSSL</code>). Your configuration may also be incorrect.
+ Please make sure that your <code class="directive"><a href="../mod/mpm_common.html#listen">Listen</a></code> directives match your
+ <code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>
+ directives. If all else fails, please start afresh, using the default
+ configuration provided by <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>.</p>
+
+
+<h3><a name="envvars" id="envvars">Why are the <code>SSL_XXX</code> variables
+ not available to my CGI &amp; SSI scripts?</a></h3>
+<p>Please make sure you have ``<code>SSLOptions +StdEnvVars</code>''
+ enabled for the context of your CGI/SSI requests.</p>
+
+
+<h3><a name="relative" id="relative">How can I switch between HTTP and HTTPS in relative
+ hyperlinks?</a></h3>
+
+<p>Usually, to switch between HTTP and HTTPS, you have to use
+ fully-qualified hyperlinks (because you have to change the URL
+ scheme). Using <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code> however, you can
+ manipulate relative hyperlinks, to achieve the same effect.</p>
+ <div class="example"><p><code>
+ RewriteEngine on<br />
+ RewriteRule ^/(.*):SSL$ https://%{SERVER_NAME}/$1 [R,L]<br />
+ RewriteRule ^/(.*):NOSSL$ http://%{SERVER_NAME}/$1 [R,L]
+ </code></p></div>
+
+ <p>This rewrite ruleset lets you use hyperlinks of the form
+ <code>&lt;a href="document.html:SSL"&gt;</code>, to switch to HTTPS
+ in a relative link.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="aboutcerts" id="aboutcerts">Certificates</a></h2>
+<ul>
+<li><a href="#keyscerts">What are RSA Private Keys, CSRs and
+Certificates?</a></li>
+<li><a href="#startup">Is there a difference on startup between
+the original Apache and an SSL-aware Apache?</a></li>
+<li><a href="#selfcert">How do I create a self-signed SSL
+Certificate for testing purposes?</a></li>
+<li><a href="#realcert">How do I create a real SSL Certificate?</a></li>
+<li><a href="#ownca">How do I create and use my own Certificate
+Authority (CA)?</a></li>
+<li><a href="#passphrase">How can I change the pass-phrase on my private
+key file?</a></li>
+<li><a href="#removepassphrase">How can I get rid of the pass-phrase
+dialog at Apache startup time?</a></li>
+<li><a href="#verify">How do I verify that a private key matches its
+Certificate?</a></li>
+<li><a href="#badcert">Why do connections fail with an "alert bad
+certificate" error?</a></li>
+<li><a href="#keysize">Why does my 2048-bit private key not work?</a></li>
+<li><a href="#hashsymlinks">Why is client authentication broken after
+upgrading from SSLeay version 0.8 to 0.9?</a></li>
+<li><a href="#pemder">How can I convert a certificate from PEM to DER
+format?</a></li>
+<li><a href="#verisign">Why can't I find the
+<code>getca</code> or <code>getverisign</code> programs mentioned by
+Verisign, for installing my Verisign certificate?</a></li>
+<li><a href="#sgc">Can I use the Server Gated Cryptography (SGC)
+facility (aka Verisign Global ID) with mod_ssl?</a></li>
+<li><a href="#gid">Why do browsers complain that they cannot
+verify my Verisign Global ID server certificate?</a></li>
+</ul>
+
+<h3><a name="keyscerts" id="keyscerts">What are RSA Private Keys, CSRs and Certificates?</a></h3>
+<p>An RSA private key file is a digital file that you can use to decrypt
+ messages sent to you. It has a public component which you distribute (via
+ your Certificate file) which allows people to encrypt those messages to
+ you.</p>
+ <p>A Certificate Signing Request (CSR) is a digital file which contains
+ your public key and your name. You send the CSR to a Certifying Authority
+ (CA), who will convert it into a real Certificate, by signing it.</p>
+ <p>A Certificate contains your
+ RSA public key, your name, the name of the CA, and is digitally signed by
+ the CA. Browsers that know the CA can verify the signature on that
+ Certificate, thereby obtaining your RSA public key. That enables them to
+ send messages which only you can decrypt.</p>
+ <p>See the <a href="ssl_intro.html">Introduction</a> chapter for a general
+ description of the SSL protocol.</p>
+
+
+<h3><a name="startup" id="startup">Is there a difference on startup between
+ the original Apache and an SSL-aware Apache?</a></h3>
+<p>Yes. In general, starting Apache with
+ <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> built-in is just like starting Apache
+ without it. However, if you have a passphrase on your SSL private
+ key file, a startup dialog will pop up which asks you to enter the
+ pass phrase.</p>
+
+ <p>Having to manually enter the passphrase when starting the server
+ can be problematic - for example, when starting the server from the
+ system boot scripts. In this case, you can follow the steps
+ <a href="#removepassphrase">below</a> to remove the passphrase from
+ your private key.</p>
+
+
+<h3><a name="selfcert" id="selfcert">How do I create a self-signed SSL
+Certificate for testing purposes?</a></h3>
+ <ol>
+ <li>Make sure OpenSSL is installed and in your <code>PATH</code>.<br />
+ <br />
+ </li>
+ <li>Run the following command, to create <code>server.key</code> and
+ <code>server.crt</code> files:<br />
+ <code><strong>$ openssl req -new -x509 -nodes -out server.crt
+ -keyout server.key</strong></code><br />
+ These can be used as follows in your <code>httpd.conf</code>
+ file:
+ <pre>
+ SSLCertificateFile /path/to/this/server.crt
+ SSLCertificateKeyFile /path/to/this/server.key
+ </pre>
+ </li>
+ <li>It is important that you are aware that this
+ <code>server.key</code> does <em>not</em> have any passphrase.
+ To add a passphrase to the key, you should run the following
+ command, and enter &amp; verify the passphrase as requested.<br />
+ <p><code><strong>$ openssl rsa -des3 -in server.key -out
+ server.key.new</strong></code><br />
+ <code><strong>$ mv server.key.new server.key</strong></code><br /></p>
+ Please backup the <code>server.key</code> file, and the passphrase
+ you entered, in a secure location.
+ </li>
+ </ol>
+
+
+<h3><a name="realcert" id="realcert">How do I create a real SSL Certificate?</a></h3>
+<p>Here is a step-by-step description:</p>
+ <ol>
+ <li>Make sure OpenSSL is installed and in your <code>PATH</code>.
+ <br />
+ <br />
+ </li>
+ <li>Create a RSA private key for your Apache server
+ (will be Triple-DES encrypted and PEM formatted):<br />
+ <br />
+ <code><strong>$ openssl genrsa -des3 -out server.key 1024</strong></code><br />
+ <br />
+ Please backup this <code>server.key</code> file and the
+ pass-phrase you entered in a secure location.
+ You can see the details of this RSA private key by using the command:<br />
+
+ <br />
+ <code><strong>$ openssl rsa -noout -text -in server.key</strong></code><br />
+ <br />
+ If necessary, you can also create a decrypted PEM version (not
+ recommended) of this RSA private key with:<br />
+ <br />
+ <code><strong>$ openssl rsa -in server.key -out server.key.unsecure</strong></code><br />
+ <br />
+
+ </li>
+ <li>Create a Certificate Signing Request (CSR) with the server RSA private
+ key (output will be PEM formatted):<br />
+ <br />
+ <code><strong>$ openssl req -new -key server.key -out server.csr</strong></code><br />
+ <br />
+ Make sure you enter the FQDN ("Fully Qualified Domain Name") of the
+ server when OpenSSL prompts you for the "CommonName", i.e. when you
+ generate a CSR for a website which will be later accessed via
+ <code>https://www.foo.dom/</code>, enter "www.foo.dom" here.
+ You can see the details of this CSR by using<br />
+
+ <br />
+ <code><strong>$ openssl req -noout -text -in server.csr</strong></code><br />
+ <br />
+ </li>
+ <li>You now have to send this Certificate Signing Request (CSR) to
+ a Certifying Authority (CA) to be signed. Once the CSR has been
+ signed, you will have a real Certificate, which can be used by
+ Apache. You can have a CSR signed by a commercial CA, or you can
+ create your own CA to sign it.<br />
+ Commercial CAs usually ask you to post the CSR into a web form,
+ pay for the signing, and then send a signed Certificate, which
+ you can store in a server.crt file. For more information about
+ commercial CAs see the following locations:<br />
+ <br />
+ <ol>
+ <li> Verisign<br />
+ <a href="http://digitalid.verisign.com/server/apacheNotice.htm">
+ http://digitalid.verisign.com/server/apacheNotice.htm
+ </a>
+ </li>
+ <li> Thawte<br />
+ <a href="http://www.thawte.com/">http://www.thawte.com/</a>
+ </li>
+ <li> CertiSign Certificadora Digital Ltda.<br />
+ <a href="http://www.certisign.com.br">
+ http://www.certisign.com.br
+ </a>
+ </li>
+ <li> IKS GmbH<br />
+ <a href="http://www.iks-jena.de/leistungen/ca/">
+ http://www.iks-jena.de/leistungen/ca/
+ </a>
+ </li>
+ <li> Uptime Commerce Ltd.<br />
+ <a href="http://www.uptimecommerce.com">
+ http://www.uptimecommerce.com
+ </a>
+ </li>
+ <li> BelSign NV/SA<br />
+ <a href="http://www.belsign.be">
+ http://www.belsign.be
+ </a>
+ </li>
+ </ol>
+
+ For details on how to create your own CA, and use this to sign
+ a CSR, see <a href="#ownca">below</a>.<br />
+
+ Once your CSR has been signed, you can see the details of the
+ Certificate as follows:<br />
+ <br />
+ <code><strong>$ openssl x509 -noout -text -in server.crt</strong></code><br />
+
+ </li>
+ <li>You should now have two files: <code>server.key</code> and
+ <code>server.crt</code>. These can be used as follows in your
+ <code>httpd.conf</code> file:
+ <pre>
+ SSLCertificateFile /path/to/this/server.crt
+ SSLCertificateKeyFile /path/to/this/server.key
+ </pre>
+ The <code>server.csr</code> file is no longer needed.
+ </li>
+
+ </ol>
+
+
+<h3><a name="ownca" id="ownca">How do I create and use my own Certificate Authority (CA)?</a></h3>
+ <p>The short answer is to use the <code>CA.sh</code> or <code>CA.pl</code>
+ script provided by OpenSSL. Unless you have a good reason not to,
+ you should use these for preference. If you cannot, you can create a
+ self-signed Certificate as follows:</p>
+
+ <ol>
+ <li>Create a RSA private key for your server
+ (will be Triple-DES encrypted and PEM formatted):<br />
+ <br />
+ <code><strong>$ openssl genrsa -des3 -out server.key 1024</strong></code><br />
+ <br />
+ Please backup this <code>host.key</code> file and the
+ pass-phrase you entered in a secure location.
+ You can see the details of this RSA private key by using the
+ command:<br />
+ <code><strong>$ openssl rsa -noout -text -in server.key</strong></code><br />
+ <br />
+ If necessary, you can also create a decrypted PEM version (not
+ recommended) of this RSA private key with:<br />
+ <br />
+ <code><strong>$ openssl rsa -in server.key -out server.key.unsecure</strong></code><br />
+ <br />
+ </li>
+ <li>Create a self-signed Certificate (X509 structure)
+ with the RSA key you just created (output will be PEM formatted):<br />
+ <br />
+ <code><strong>$ openssl req -new -x509 -nodes -sha1 -days 365
+ -key server.key -out server.crt</strong></code><br />
+ <br />
+ This signs the server CSR and results in a <code>server.crt</code> file.<br />
+ You can see the details of this Certificate using:<br />
+ <br />
+ <code><strong>$ openssl x509 -noout -text -in server.crt</strong></code><br />
+ <br />
+ </li>
+ </ol>
+
+
+<h3><a name="passphrase" id="passphrase">How can I change the pass-phrase on my private key file?</a></h3>
+<p>You simply have to read it with the old pass-phrase and write it again,
+ specifying the new pass-phrase. You can accomplish this with the following
+ commands:</p>
+
+
+ <p><code><strong>$ openssl rsa -des3 -in server.key -out server.key.new</strong></code><br />
+ <code><strong>$ mv server.key.new server.key</strong></code><br /></p>
+
+ <p>The first time you're asked for a PEM pass-phrase, you should
+ enter the old pass-phrase. After that, you'll be asked again to
+ enter a pass-phrase - this time, use the new pass-phrase. If you
+ are asked to verify the pass-phrase, you'll need to enter the new
+ pass-phrase a second time.</p>
+
+
+<h3><a name="removepassphrase" id="removepassphrase">How can I get rid of the pass-phrase dialog at Apache startup time?</a></h3>
+<p>The reason this dialog pops up at startup and every re-start
+ is that the RSA private key inside your server.key file is stored in
+ encrypted format for security reasons. The pass-phrase is needed decrypt
+ this file, so it can be read and parsed. Removing the pass-phrase
+ removes a layer of security from your server - proceed with caution!</p>
+ <ol>
+ <li>Remove the encryption from the RSA private key (while
+ keeping a backup copy of the original file):<br />
+ <br />
+ <code><strong>$ cp server.key server.key.org</strong></code><br />
+ <code><strong>$ openssl rsa -in server.key.org -out server.key</strong></code><br />
+
+ <br />
+ </li>
+ <li>Make sure the server.key file is only readable by root:<br />
+ <br />
+ <code><strong>$ chmod 400 server.key</strong></code><br />
+ <br />
+ </li>
+ </ol>
+
+ <p>Now <code>server.key</code> contains an unencrypted copy of the key.
+ If you point your server at this file, it will not prompt you for a
+ pass-phrase. HOWEVER, if anyone gets this key they will be able to
+ impersonate you on the net. PLEASE make sure that the permissions on this
+ file are such that only root or the web server user can read it
+ (preferably get your web server to start as root but run as another
+ user, and have the key readable only by root).</p>
+
+ <p>As an alternative approach you can use the ``<code>SSLPassPhraseDialog
+ exec:/path/to/program</code>'' facility. Bear in mind that this is
+ neither more nor less secure, of course.</p>
+
+
+<h3><a name="verify" id="verify">How do I verify that a private key matches its Certificate?</a></h3>
+<p>A private key contains a series of numbers. Two of these numbers form
+ the "public key", the others are part of the "private key". The "public
+ key" bits are included when you generate a CSR, and subsequently form
+ part of the associated Certificate.</p>
+ <p>To check that the public key in your Certificate matches the public
+ portion of your private key, you simply need to compare these numbers.
+ To view the Certificate and the key run the commands:</p>
+
+ <p><code><strong>$ openssl x509 -noout -text -in server.crt</strong></code><br />
+ <code><strong>$ openssl rsa -noout -text -in server.key</strong></code></p>
+
+ <p>The `modulus' and the `public exponent' portions in the key and the
+ Certificate must match. As the public exponent is usually 65537
+ and it's difficult to visually check that the long modulus numbers
+ are the same, you can use the following approach:</p>
+
+ <p><code><strong>$ openssl x509 -noout -modulus -in server.crt | openssl md5</strong></code><br />
+ <code><strong>$ openssl rsa -noout -modulus -in server.key | openssl md5</strong></code></p>
+
+ <p>This leaves you with two rather shorter numbers to compare. It is,
+ in theory, possible that these numbers may be the same, without the
+ modulus numbers being the same, but the chances of this are
+ overwhelmingly remote.</p>
+ <p>Should you wish to check to which key or certificate a particular
+ CSR belongs you can perform the same calculation on the CSR as
+ follows:</p>
+
+ <p><code><strong>$ openssl req -noout -modulus -in server.csr | openssl md5</strong></code></p>
+
+
+<h3><a name="badcert" id="badcert">Why do connections fail with an "alert
+bad certificate" error?</a></h3>
+<p>Errors such as <code>OpenSSL: error:14094412: SSL
+ routines:SSL3_READ_BYTES:sslv3 alert bad certificate</code> in the SSL
+ logfile, are usually caused a browser which is unable to handle the server
+ certificate/private-key. For example, Netscape Navigator 3.x is
+ unable to handle RSA key lengths not equal to 1024 bits.</p>
+
+
+<h3><a name="keysize" id="keysize">Why does my 2048-bit private key not work?</a></h3>
+<p>The private key sizes for SSL must be either 512 or 1024 bits, for compatibility
+ with certain web browsers. A keysize of 1024 bits is recommended because
+ keys larger than 1024 bits are incompatible with some versions of Netscape
+ Navigator and Microsoft Internet Explorer, and with other browsers that
+ use RSA's BSAFE cryptography toolkit.</p>
+
+
+<h3><a name="hashsymlinks" id="hashsymlinks">Why is client authentication broken after upgrading from
+SSLeay version 0.8 to 0.9?</a></h3>
+<p>The CA certificates under the path you configured with
+ <code>SSLCACertificatePath</code> are found by SSLeay through hash
+ symlinks. These hash values are generated by the `<code>openssl x509 -noout
+ -hash</code>' command. However, the algorithm used to calculate the hash for a
+ certificate changed between SSLeay 0.8 and 0.9. You will need to remove
+ all old hash symlinks and create new ones after upgrading. Use the
+ <code>Makefile</code> provided by <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>.</p>
+
+
+<h3><a name="pemder" id="pemder">How can I convert a certificate from PEM to DER format?</a></h3>
+<p>The default certificate format for SSLeay/OpenSSL is PEM, which is simply
+ Base64 encoded DER, with header and footer lines. For some applications
+ (e.g. Microsoft Internet Explorer) you need the certificate in plain DER
+ format. You can convert a PEM file <code>cert.pem</code> into the
+ corresponding DER file <code>cert.der</code> using the following command:
+ <code><strong>$ openssl x509 -in cert.pem -out cert.der -outform DER</strong></code></p>
+
+
+<h3><a name="verisign" id="verisign">Why can't I find the
+<code>getca</code> or <code>getverisign</code> programs mentioned by
+Verisign, for installing my Verisign certificate?</a></h3>
+<p>Verisign has never provided specific instructions
+ for Apache+mod_ssl. The instructions provided are for C2Net's
+ Stronghold (a commercial Apache based server with SSL support).</p>
+ <p>To install your certificate, all you need to do is to save the
+ certificate to a file, and give the name of that file to the
+ <code class="directive"><a href="../mod/mod_ssl.html#sslcertificatefile">SSLCertificateFile</a></code> directive.
+ You will also need to give it the key file. For more information,
+ see the <code class="directive"><a href="../mod/mod_ssl.html#sslcertificatekeyfile">SSLCertificateKeyFile</a></code>
+ directive.</p>
+
+
+<h3><a name="sgc" id="sgc">Can I use the Server Gated Cryptography (SGC)
+facility (aka Verisign Global ID) with mod_ssl?</a></h3>
+<p>Yes. <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> has included support for the SGC
+ facility since version 2.1. No special configuration is required -
+ just use the Global ID as your server certificate. The
+ <em>step up</em> of the clients is then automatically handled by
+ <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> at run-time.</p>
+
+
+<h3><a name="gid" id="gid">Why do browsers complain that they cannot
+verify my Verisign Global ID server certificate?</a></h3>
+<p>Verisign uses an intermediate CA certificate between the root CA
+ certificate (which is installed in the browsers) and the server
+ certificate (which you installed on the server). You should have
+ received this additional CA certificate from Verisign.
+ If not, complain to them. Then, configure this certificate with the
+ <code class="directive"><a href="../mod/mod_ssl.html#sslcertificatechainfile">SSLCertificateChainFile</a></code>
+ directive. This ensures that the intermediate CA certificate is
+ sent to the browser, filling the gap in the certificate chain.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="aboutssl" id="aboutssl">The SSL Protocol</a></h2>
+<ul>
+<li><a href="#random">Why do I get lots of random SSL protocol
+errors under heavy server load?</a></li>
+<li><a href="#load">Why does my webserver have a higher load, now
+that it serves SSL encrypted traffic?</a></li>
+<li><a href="#establishing">Why do HTTPS connections to my server
+sometimes take up to 30 seconds to establish a connection?</a></li>
+<li><a href="#ciphers">What SSL Ciphers are supported by mod_ssl?</a></li>
+<li><a href="#adh">Why do I get ``no shared cipher'' errors, when
+trying to use Anonymous Diffie-Hellman (ADH) ciphers?</a></li>
+<li><a href="#sharedciphers">Why do I get a 'no shared ciphers'
+error when connecting to my newly installed server?</a></li>
+<li><a href="#vhosts">Why can't I use SSL with name-based/non-IP-based
+virtual hosts?</a></li>
+<li><a href="#vhosts2">Why is it not possible to use Name-Based Virtual
+Hosting to identify different SSL virtual hosts?</a></li>
+<li><a href="#comp">How do I get SSL compression working?</a></li>
+<li><a href="#lockicon">When I use Basic Authentication over HTTPS
+the lock icon in Netscape browsers stays unlocked when the dialog pops up.
+Does this mean the username/password is being sent unencrypted?</a></li>
+<li><a href="#msie">Why do I get I/O errors when connecting via
+HTTPS to an Apache+mod_ssl server with Microsoft Internet Explorer
+(MSIE)?</a></li>
+<li><a href="#nn">Why do I get I/O errors, or the message "Netscape has
+encountered bad data from the server", when connecting via
+HTTPS to an Apache+mod_ssl server with Netscape Navigator?</a></li>
+</ul>
+
+<h3><a name="random" id="random">Why do I get lots of random SSL protocol
+errors under heavy server load?</a></h3>
+<p>There can be a number of reasons for this, but the main one
+ is problems with the SSL session Cache specified by the
+ <code class="directive"><a href="../mod/mod_ssl.html#sslsessioncache">SSLSessionCache</a></code> directive. The DBM session
+ cache is the most likely source of the problem, so using the SHM session cache (or
+ no cache at all) may help.</p>
+
+
+<h3><a name="load" id="load">Why does my webserver have a higher load, now
+that it serves SSL encrypted traffic?</a></h3>
+<p>SSL uses strong cryptographic encryption, which necessitates a lot of
+ number crunching. When you request a webpage via HTTPS, everything (even
+ the images) is encrypted before it is transferred. So increased HTTPS
+ traffic leads to load increases.</p>
+
+
+<h3><a name="establishing" id="establishing">Why do HTTPS connections to my server
+sometimes take up to 30 seconds to establish a connection?</a></h3>
+<p>This is usually caused by a <code>/dev/random</code> device for
+ <code class="directive"><a href="../mod/mod_ssl.html#sslrandomseed">SSLRandomSeed</a></code> which blocks the
+ read(2) call until enough entropy is available to service the
+ request. More information is available in the reference
+ manual for the <code class="directive"><a href="../mod/mod_ssl.html#sslrandomseed">SSLRandomSeed</a></code>
+ directive.</p>
+
+
+<h3><a name="ciphers" id="ciphers">What SSL Ciphers are supported by mod_ssl?</a></h3>
+<p>Usually, any SSL ciphers supported by the version of OpenSSL in use,
+ are also supported by <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>. Which ciphers are
+ available can depend on the way you built OpenSSL. Typically, at
+ least the following ciphers are supported:</p>
+
+ <ol>
+ <li>RC4 with MD5</li>
+ <li>RC4 with MD5 (export version restricted to 40-bit key)</li>
+ <li>RC2 with MD5</li>
+ <li>RC2 with MD5 (export version restricted to 40-bit key)</li>
+ <li>IDEA with MD5</li>
+ <li>DES with MD5</li>
+ <li>Triple-DES with MD5</li>
+ </ol>
+
+ <p>To determine the actual list of ciphers available, you should run
+ the following:</p>
+ <div class="example"><p><code>$ openssl ciphers -v</code></p></div>
+
+
+<h3><a name="adh" id="adh">Why do I get ``no shared cipher'' errors, when
+trying to use Anonymous Diffie-Hellman (ADH) ciphers?</a></h3>
+<p>By default, OpenSSL does <em>not</em> allow ADH ciphers, for security
+ reasons. Please be sure you are aware of the potential side-effects
+ if you choose to enable these ciphers.</p>
+ <p>In order to use Anonymous Diffie-Hellman (ADH) ciphers, you must
+ build OpenSSL with ``<code>-DSSL_ALLOW_ADH</code>'', and then add
+ ``<code>ADH</code>'' into your <code class="directive"><a href="../mod/mod_ssl.html#sslciphersuite">SSLCipherSuite</a></code>.</p>
+
+
+<h3><a name="sharedciphers" id="sharedciphers">Why do I get a 'no shared ciphers'
+error when connecting to my newly installed server?</a></h3>
+<p>Either you have made a mistake with your
+ <code class="directive"><a href="../mod/mod_ssl.html#sslciphersuite">SSLCipherSuite</a></code>
+ directive (compare it with the pre-configured example in
+ <code>httpd.conf-dist</code>) or you chose to use DSA/DH
+ algorithms instead of RSA when you generated your private key
+ and ignored or overlooked the warnings. If you have chosen
+ DSA/DH, then your server cannot communicate using RSA-based SSL
+ ciphers (at least until you configure an additional RSA-based
+ certificate/key pair). Modern browsers like NS or IE can only
+ communicate over SSL using RSA ciphers. The result is the
+ "no shared ciphers" error. To fix this, regenerate your server
+ certificate/key pair, using the RSA algorithm.</p>
+
+
+<h3><a name="vhosts" id="vhosts">Why can't I use SSL with name-based/non-IP-based virtual hosts?</a></h3>
+<p>The reason is very technical, and a somewhat "chicken and egg" problem.
+ The SSL protocol layer stays below the HTTP protocol layer and
+ encapsulates HTTP. When an SSL connection (HTTPS) is established
+ Apache/mod_ssl has to negotiate the SSL protocol parameters with the
+ client. For this, mod_ssl has to consult the configuration of the virtual
+ server (for instance it has to look for the cipher suite, the server
+ certificate, etc.). But in order to go to the correct virtual server
+ Apache has to know the <code>Host</code> HTTP header field. To do this, the
+ HTTP request header has to be read. This cannot be done before the SSL
+ handshake is finished, but the information is needed in order to
+ complete the SSL handshake phase. Bingo!</p>
+
+
+<h3><a name="vhosts2" id="vhosts2">Why is it not possible to use Name-Based
+Virtual Hosting to identify different SSL virtual hosts?</a></h3>
+ <p>Name-Based Virtual Hosting is a very popular method of identifying
+ different virtual hosts. It allows you to use the same IP address and
+ the same port number for many different sites. When people move on to
+ SSL, it seems natural to assume that the same method can be used to have
+ lots of different SSL virtual hosts on the same server.</p>
+
+ <p>It comes as rather a shock to learn that it is impossible.</p>
+
+ <p>The reason is that the SSL protocol is a separate layer which
+ encapsulates the HTTP protocol. So the SSL session is a separate
+ transaction, that takes place before the HTTP session has begun.
+ The server receives an SSL request on IP address X and port Y
+ (usually 443). Since the SSL request does not contain any Host:
+ field, the server has no way to decide which SSL virtual host to use.
+ Usually, it will just use the first one it finds, which matches the
+ port and IP address specified.</p>
+
+ <p>You can, of course, use Name-Based Virtual Hosting to identify many
+ non-SSL virtual hosts (all on port 80, for example) and then
+ have a single SSL virtual host (on port 443). But if you do this,
+ you must make sure to put the non-SSL port number on the NameVirtualHost
+ directive, e.g.</p>
+
+ <div class="example"><p><code>
+ NameVirtualHost 192.168.1.1:80
+ </code></p></div>
+
+ <p>Other workaround solutions include: </p>
+
+ <p>Using separate IP addresses for different SSL hosts.
+ Using different port numbers for different SSL hosts.</p>
+
+
+<h3><a name="comp" id="comp">How do I get SSL compression working?</a></h3>
+<p>Although SSL compression negotiation was defined in the specification
+of SSLv2 and TLS, it took until May 2004 for RFC 3749 to define DEFLATE as
+a negotiable standard compression method.
+</p>
+<p>OpenSSL 0.9.8 started to support this by default when compiled with the
+<code>zlib</code> option. If both the client and the server support compression,
+it will be used. However, most clients still try to initially connect with an
+SSLv2 Hello. As SSLv2 did not include an array of prefered compression algorithms
+in its handshake, compression cannot be negotiated with these clients.
+If the client disables support for SSLv2, either an SSLv3 or TLS Hello
+may be sent, depending on which SSL library is used, and compression may
+be set up. You can verify whether clients make use of SSL compression by
+logging the <code>%{SSL_COMPRESS_METHOD}x</code> variable.
+</p>
+
+
+<h3><a name="lockicon" id="lockicon">When I use Basic Authentication over HTTPS
+the lock icon in Netscape browsers stays unlocked when the dialog pops up.
+Does this mean the username/password is being sent unencrypted?</a></h3>
+<p>No, the username/password is transmitted encrypted. The icon in
+ Netscape browsers is not actually synchronized with the SSL/TLS layer.
+ It only toggles to the locked state when the first part of the actual
+ webpage data is transferred, which may confuse people. The Basic
+ Authentication facility is part of the HTTP layer, which is above
+ the SSL/TLS layer in HTTPS. Before any HTTP data communication takes
+ place in HTTPS, the SSL/TLS layer has already completed its handshake
+ phase, and switched to encrypted communication. So don't be
+ confused by this icon.</p>
+
+
+<h3><a name="msie" id="msie">Why do I get I/O errors when connecting via
+HTTPS to an Apache+mod_ssl server with Microsoft Internet Explorer (MSIE)?</a></h3>
+<p>The first reason is that the SSL implementation in some MSIE versions has
+ some subtle bugs related to the HTTP keep-alive facility and the SSL close
+ notify alerts on socket connection close. Additionally the interaction
+ between SSL and HTTP/1.1 features are problematic in some MSIE versions.
+ You can work around these problems by forcing Apache not to use HTTP/1.1,
+ keep-alive connections or send the SSL close notify messages to MSIE clients.
+ This can be done by using the following directive in your SSL-aware
+ virtual host section:</p>
+ <div class="example"><p><code>
+ SetEnvIf User-Agent ".*MSIE.*" \<br />
+ nokeepalive ssl-unclean-shutdown \<br />
+ downgrade-1.0 force-response-1.0
+ </code></p></div>
+ <p>Further, some MSIE versions have problems with particular ciphers.
+ Unfortunately, it is not possible to implement a MSIE-specific
+ workaround for this, because the ciphers are needed as early as the
+ SSL handshake phase. So a MSIE-specific
+ <code class="directive"><a href="../mod/mod_setenvif.html#setenvif">SetEnvIf</a></code> won't solve these
+ problems. Instead, you will have to make more drastic
+ adjustments to the global parameters. Before you decide to do
+ this, make sure your clients really have problems. If not, do not
+ make these changes - they will affect <em>all</em> your clients, MSIE
+ or otherwise.</p>
+
+ <p>The next problem is that 56bit export versions of MSIE 5.x
+ browsers have a broken SSLv3 implementation, which interacts badly
+ with OpenSSL versions greater than 0.9.4. You can accept this and
+ require your clients to upgrade their browsers, you can downgrade to
+ OpenSSL 0.9.4 (not advised), or you can work around this, accepting
+ that your workaround will affect other browsers too:</p>
+ <div class="example"><p><code>SSLProtocol all -SSLv3</code></p></div>
+ <p>will completely disables the SSLv3 protocol and allow those
+ browsers to work. A better workaround is to disable only those
+ ciphers which cause trouble.</p>
+ <div class="example"><p><code>SSLCipherSuite
+ ALL:!ADH:<strong>!EXPORT56</strong>:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code>
+ </p></div>
+
+ <p>This also allows the broken MSIE versions to work, but only removes the
+ newer 56bit TLS ciphers.</p>
+
+ <p>Another problem with MSIE 5.x clients is that they refuse to connect to
+ URLs of the form <code>https://12.34.56.78/</code> (where IP-addresses are used
+ instead of the hostname), if the server is using the Server Gated
+ Cryptography (SGC) facility. This can only be avoided by using the fully
+ qualified domain name (FQDN) of the website in hyperlinks instead, because
+ MSIE 5.x has an error in the way it handles the SGC negotiation.</p>
+
+ <p>And finally there are versions of MSIE which seem to require that
+ an SSL session can be reused (a totally non standard-conforming
+ behaviour, of course). Connecting with those MSIE versions only work
+ if a SSL session cache is used. So, as a work-around, make sure you
+ are using a session cache (see the <code class="directive"><a href="../mod/mod_ssl.html#sslsessioncache">SSLSessionCache</a></code> directive).</p>
+
+
+<h3><a name="nn" id="nn">Why do I get I/O errors, or the message "Netscape has
+encountered bad data from the server", when connecting via
+HTTPS to an Apache+mod_ssl server with Netscape Navigator?</a></h3>
+<p>
+ This usually occurs when you have created a new server certificate for
+ a given domain, but had previously told your browser to always accept
+ the old server certificate. Once you clear the entry for the old
+ certificate from your browser, everything should be fine. Netscape's SSL
+ implementation is correct, so when you encounter I/O errors with Netscape
+ Navigator it is usually caused by the configured certificates.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="support" id="support">mod_ssl Support</a></h2>
+<ul>
+<li><a href="#resources">What information resources are available in
+case of mod_ssl problems?</a></li>
+<li><a href="#contact">What support contacts are available in case of
+mod_ssl problems?</a></li>
+<li><a href="#reportdetails">What information should I
+provide when writing a bug report?</a></li>
+<li><a href="#coredumphelp">I had a core dump, can you help me?</a></li>
+<li><a href="#backtrace">How do I get a backtrace, to help find the reason
+for my core dump?</a></li>
+</ul>
+
+<h3><a name="resources" id="resources">What information resources are available in case of mod_ssl problems?</a></h3>
+<p>The following information resources are available.
+ In case of problems you should search here first.</p>
+
+ <dl>
+ <dt>Answers in the User Manual's F.A.Q. List (this)</dt>
+ <dd><a href="http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html">
+ http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html</a><br />
+ First check the F.A.Q. (this text). If your problem is a common
+ one, it may have been answered several times before, and been included
+ in this doc.
+ </dd>
+ <dt>Postings from the modssl-users Support Mailing List
+ <a href="http://www.modssl.org/support/">http://www.modssl.org/support/</a></dt>
+ <dd>Search for your problem in the archives of the modssl-users mailing list.
+ You're probably not the first person to have had this problem!
+ </dd>
+ </dl>
+
+
+<h3><a name="contact" id="contact">What support contacts are available in case
+of mod_ssl problems?</a></h3>
+ <p>The following lists all support possibilities for mod_ssl, in order of
+ preference. Please go through these possibilities
+ <em>in this order</em> - don't just pick the one you like the look of. </p>
+ <ol>
+ <li><em>Send a Problem Report to the modssl-users Support Mailing List</em><br />
+ <a href="mailto:modssl-users@modssl.org">
+ modssl-users@modssl.org</a><br />
+ This is the preferred way of submitting your problem report, because this way,
+ others can see the problem, and learn from any answers. You must subscribe to
+ the list first, but you can then easily discuss your problem with both the
+ author and the whole mod_ssl user community.
+ </li>
+
+ <li><em>Send a Problem Report to the Apache httpd Users Support Mailing List</em><br />
+ <a href="mailto:users@httpd.apache.org">
+ users@httpd.apache.org</a><br />
+ This is the second way of submitting your problem report. Again, you must
+ subscribe to the list first, but you can then easily discuss your problem
+ with the whole Apache httpd user community.
+ </li>
+
+ <li><em>Write a Problem Report in the Bug Database</em><br />
+ <a href="http://httpd.apache.org/bug_report.html">
+ http://httpd.apache.org/bug_report.html</a><br />
+ This is the last way of submitting your problem report. You should only
+ do this if you've already posted to the mailing lists, and had no success.
+ Please follow the instructions on the above page <em>carefully</em>.
+ </li>
+ </ol>
+
+
+<h3><a name="reportdetails" id="reportdetails">What information should I
+provide when writing a bug report?</a></h3>
+<p>You should always provide at least the following information:</p>
+
+ <dl>
+ <dt>Apache and OpenSSL version information</dt>
+ <dd>The Apache version can be determined
+ by running <code>httpd -v</code>. The OpenSSL version can be
+ determined by running <code>openssl version</code>. Alternatively, if
+ you have Lynx installed, you can run the command <code>lynx -mime_header
+ http://localhost/ | grep Server</code> to gather this information in a
+ single step.
+ </dd>
+
+ <dt>The details on how you built and installed Apache+mod_ssl+OpenSSL</dt>
+ <dd>For this you can provide a logfile of your terminal session which shows
+ the configuration and install steps. If this is not possible, you
+ should at least provide the <code class="program"><a href="../programs/configure.html">configure</a></code> command line you used.
+ </dd>
+
+ <dt>In case of core dumps please include a Backtrace</dt>
+ <dd>If your Apache+mod_ssl+OpenSSL dumps its core, please attach
+ a stack-frame ``backtrace'' (see <a href="#backtrace">below</a>
+ for information on how to get this). Without this information, the
+ reason for your core dump cannot be found
+ </dd>
+
+ <dt>A detailed description of your problem</dt>
+ <dd>Don't laugh, we really mean it! Many problem reports don't
+ include a description of what the actual problem is. Without this,
+ it's very difficult for anyone to help you. So, it's in your own
+ interest (you want the problem be solved, don't you?) to include as
+ much detail as possible, please. Of course, you should still include
+ all the essentials above too.
+ </dd>
+ </dl>
+
+
+<h3><a name="coredumphelp" id="coredumphelp">I had a core dump, can you help me?</a></h3>
+<p>In general no, at least not unless you provide more details about the code
+ location where Apache dumped core. What is usually always required in
+ order to help you is a backtrace (see next question). Without this
+ information it is mostly impossible to find the problem and help you in
+ fixing it.</p>
+
+
+<h3><a name="backtrace" id="backtrace">How do I get a backtrace, to help find
+the reason for my core dump?</a></h3>
+<p>Following are the steps you will need to complete, to get a backtrace:</p>
+ <ol>
+ <li>Make sure you have debugging symbols available, at least
+ in Apache. On platforms where you use GCC/GDB, you will have to build
+ Apache+mod_ssl with ``<code>OPTIM="-g -ggdb3"</code>'' to get this. On
+ other platforms at least ``<code>OPTIM="-g"</code>'' is needed.
+ </li>
+
+ <li>Start the server and try to reproduce the core-dump. For this you may
+ want to use a directive like ``<code>CoreDumpDirectory /tmp</code>'' to
+ make sure that the core-dump file can be written. This should result
+ in a <code>/tmp/core</code> or <code>/tmp/httpd.core</code> file. If you
+ don't get one of these, try running your server under a non-root UID.
+ Many modern kernels do not allow a process to dump core after it has
+ done a <code>setuid()</code> (unless it does an <code>exec()</code>) for
+ security reasons (there can be privileged information left over in
+ memory). If necessary, you can run <code>/path/to/httpd -X</code>
+ manually to force Apache to not fork.
+ </li>
+
+ <li>Analyze the core-dump. For this, run <code>gdb /path/to/httpd
+ /tmp/httpd.core</code> or a similar command. In GDB, all you
+ have to do then is to enter <code>bt</code>, and voila, you get the
+ backtrace. For other debuggers consult your local debugger manual.
+ </li>
+ </ol>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_faq.html" title="English">&nbsp;en&nbsp;</a></p>
+</div><div id="footer">
+<p class="apache">Copyright 2006 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
+</body></html> \ No newline at end of file
diff --git a/docs/manual/ssl/ssl_howto.html b/docs/manual/ssl/ssl_howto.html
new file mode 100644
index 00000000..ca42f094
--- /dev/null
+++ b/docs/manual/ssl/ssl_howto.html
@@ -0,0 +1,3 @@
+URI: ssl_howto.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
diff --git a/docs/manual/ssl/ssl_howto.html.en b/docs/manual/ssl/ssl_howto.html.en
new file mode 100644
index 00000000..8c514409
--- /dev/null
+++ b/docs/manual/ssl/ssl_howto.html.en
@@ -0,0 +1,294 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ This file is generated from xml source: DO NOT EDIT
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ -->
+<title>SSL/TLS Strong Encryption: How-To - Apache HTTP Server</title>
+<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
+<link href="../images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.2</p>
+<img alt="" src="../images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.2</a> &gt; <a href="./">SSL/TLS</a></div><div id="page-content"><div id="preamble"><h1>SSL/TLS Strong Encryption: How-To</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_howto.html" title="English">&nbsp;en&nbsp;</a></p>
+</div>
+
+<blockquote>
+<p>The solution to this problem is trivial
+and is left as an exercise for the reader.</p>
+
+<p class="cite">-- <cite>Standard textbook cookie</cite></p>
+</blockquote>
+
+<p>How to solve particular security problems for an SSL-aware
+webserver is not always obvious because of the interactions between SSL,
+HTTP and Apache's way of processing requests. This chapter gives
+instructions on how to solve some typical situations. Treat it as a first
+step to find out the final solution, but always try to understand the
+stuff before you use it. Nothing is worse than using a security solution
+without knowing its restrictions and how it interacts with other systems.</p>
+</div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#ciphersuites">Cipher Suites and Enforcing Strong Security</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#accesscontrol">Client Authentication and Access Control</a></li>
+</ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="ciphersuites" id="ciphersuites">Cipher Suites and Enforcing Strong Security</a></h2>
+
+<ul>
+<li><a href="#realssl">How can I create a real SSLv2-only server?</a></li>
+<li><a href="#onlystrong">How can I create an SSL server which accepts strong encryption only?</a></li>
+<li><a href="#upgradeenc">How can I create an SSL server which accepts strong encryption only, but allows
+export browsers to upgrade to stronger encryption?</a></li>
+<li><a href="#strongurl">How can I create an SSL server which accepts all types of ciphers in general, but
+requires a strong cipher for access to a particular URL?</a></li>
+</ul>
+
+<h3><a name="realssl" id="realssl">How can I create a real SSLv2-only server?</a></h3>
+
+ <p>The following creates an SSL server which speaks only the SSLv2 protocol and
+ its ciphers.</p>
+
+ <div class="example"><h3>httpd.conf</h3><p><code>
+ SSLProtocol -all +SSLv2<br />
+ SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP<br />
+ </code></p></div>
+
+
+<h3><a name="onlystrong" id="onlystrong">How can I create an SSL server which accepts strong encryption
+only?</a></h3>
+
+ <p>The following enables only the seven strongest ciphers:</p>
+ <div class="example"><h3>httpd.conf</h3><p><code>
+ SSLProtocol all<br />
+ SSLCipherSuite HIGH:MEDIUM<br />
+ </code></p></div>
+
+
+<h3><a name="upgradeenc" id="upgradeenc">How can I create an SSL server which accepts strong encryption
+only, but allows export browsers to upgrade to stronger encryption?</a></h3>
+
+ <p>This facility is called Server Gated Cryptography (SGC) and requires
+ a Global ID server certificate, signed by a special CA certificate
+ from Verisign. This enables strong encryption in 'export' versions of
+ browsers, which traditionally could not support it (because of US export
+ restrictions).</p>
+ <p>When a browser connects with an export cipher, the server sends its Global
+ ID certificate. The browser verifies this, and can then upgrade its
+ cipher suite before any HTTP communication takes place. The problem
+ lies in allowing browsers to upgrade in this fashion, but still requiring
+ strong encryption. In other words, we want browsers to either start a
+ connection with strong encryption, or to start with export ciphers but
+ upgrade to strong encryption before beginning HTTP communication.</p>
+ <p>This can be done as follows:</p>
+ <div class="example"><h3>httpd.conf</h3><p><code>
+ # allow all ciphers for the initial handshake,<br />
+ # so export browsers can upgrade via SGC facility<br />
+ SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL<br />
+ <br />
+ &lt;Directory /usr/local/apache2/htdocs&gt;<br />
+ # but finally deny all browsers which haven't upgraded<br />
+ SSLRequire %{SSL_CIPHER_USEKEYSIZE} &gt;= 128<br />
+ &lt;/Directory&gt;
+ </code></p></div>
+
+
+<h3><a name="strongurl" id="strongurl">How can I create an SSL server which accepts all types of ciphers
+in general, but requires a strong ciphers for access to a particular
+URL?</a></h3>
+
+ <p>Obviously, a server-wide <code class="directive"><a href="../mod/mod_ssl.html#sslciphersuite">SSLCipherSuite</a></code> which restricts
+ ciphers to the strong variants, isn't the answer here. However,
+ <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> can be reconfigured within <code>Location</code>
+ blocks, to give a per-directory solution, and can automatically force
+ a renegotiation of the SSL parameters to meet the new configuration.
+ This can be done as follows:</p>
+ <div class="example"><p><code>
+ # be liberal in general<br />
+ SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL<br />
+ <br />
+ &lt;Location /strong/area&gt;<br />
+ # but https://hostname/strong/area/ and below<br />
+ # requires strong ciphers<br />
+ SSLCipherSuite HIGH:MEDIUM<br />
+ &lt;/Location&gt;
+ </code></p></div>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="accesscontrol" id="accesscontrol">Client Authentication and Access Control</a></h2>
+
+<ul>
+<li><a href="#allclients">How can I force clients to authenticate using certificates?</a></li>
+<li><a href="#arbitraryclients">How can I force clients to authenticate using certificates for a
+ particular URL, but still allow arbitrary clients to access the rest of the server?</a></li>
+<li><a href="#certauthenticate">How can I allow only clients who have certificates to access a
+ particular URL, but allow all clients to access the rest of the server?</a></li>
+<li><a href="#intranet">How can I require HTTPS with strong ciphers, and either
+basic authentication or client certificates, for access to part of the
+Intranet website, for clients coming from the Internet?</a></li>
+</ul>
+
+<h3><a name="allclients" id="allclients">How can I force clients to authenticate using certificates?</a></h3>
+
+
+ <p>When you know all of your users (eg, as is often the case on a corporate
+ Intranet), you can require plain certificate authentication. All you
+ need to do is to create client certificates signed by your own CA
+ certificate (<code>ca.crt</code>) and then verify the clients against this
+ certificate.</p>
+ <div class="example"><h3>httpd.conf</h3><p><code>
+ # require a client certificate which has to be directly<br />
+ # signed by our CA certificate in ca.crt<br />
+ SSLVerifyClient require<br />
+ SSLVerifyDepth 1<br />
+ SSLCACertificateFile conf/ssl.crt/ca.crt
+ </code></p></div>
+
+
+<h3><a name="arbitraryclients" id="arbitraryclients">How can I force clients to authenticate using certificates for a
+ particular URL, but still allow arbitrary clients to access the rest of the server?</a></h3>
+
+
+<p>To force clients to authenticate using certificates for a particular URL,
+ you can use the per-directory reconfiguration features of <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>:</p>
+
+ <div class="example"><h3>httpd.conf</h3><p><code>
+ SSLVerifyClient none<br />
+ SSLCACertificateFile conf/ssl.crt/ca.crt<br />
+ <br />
+ &lt;Location /secure/area&gt;<br />
+ SSLVerifyClient require<br />
+ SSLVerifyDepth 1<br />
+ &lt;/Location&gt;<br />
+ </code></p></div>
+
+
+<h3><a name="certauthenticate" id="certauthenticate">How can I allow only clients who have certificates to access a
+ particular URL, but allow all clients to access the rest of the server?</a></h3>
+
+
+ <p>The key to doing this is checking that part of the client certificate
+ matches what you expect. Usually this means checking all or part of the
+ Distinguished Name (DN), to see if it contains some known string.
+ There are two ways to do this, using either <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code> or
+ <code class="directive"><a href="../mod/mod_ssl.html#sslrequire">SSLRequire</a></code>.</p>
+
+ <p>The <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code> method is generally required when
+ the certificates are completely arbitrary, or when their DNs have
+ no common fields (usually the organisation, etc.). In this case,
+ you should establish a password database containing <em>all</em>
+ clients allowed, as follows:</p>
+
+ <div class="example"><h3>httpd.conf</h3><pre>
+SSLVerifyClient none
+&lt;Directory /usr/local/apache2/htdocs/secure/area&gt;
+
+SSLVerifyClient require
+SSLVerifyDepth 5
+SSLCACertificateFile conf/ssl.crt/ca.crt
+SSLCACertificatePath conf/ssl.crt
+SSLOptions +FakeBasicAuth
+SSLRequireSSL
+AuthName "Snake Oil Authentication"
+AuthType Basic
+AuthBasicProvider file
+AuthUserFile /usr/local/apache2/conf/httpd.passwd
+require valid-user
+&lt;/Directory&gt;</pre></div>
+
+ <div class="example"><h3>httpd.passwd</h3><pre>
+/C=DE/L=Munich/O=Snake Oil, Ltd./OU=Staff/CN=Foo:xxj31ZMTZzkVA
+/C=US/L=S.F./O=Snake Oil, Ltd./OU=CA/CN=Bar:xxj31ZMTZzkVA
+/C=US/L=L.A./O=Snake Oil, Ltd./OU=Dev/CN=Quux:xxj31ZMTZzkVA</pre></div>
+
+ <p>When your clients are all part of a common hierarchy, which is encoded
+ into the DN, you can match them more easily using <code class="directive"><a href="../mod/mod_ssl.html#sslrequire">SSLRequire</a></code>, as follows:</p>
+
+
+ <div class="example"><h3>httpd.conf</h3><pre>
+SSLVerifyClient none
+&lt;Directory /usr/local/apache2/htdocs/secure/area&gt;
+
+ SSLVerifyClient require
+ SSLVerifyDepth 5
+ SSLCACertificateFile conf/ssl.crt/ca.crt
+ SSLCACertificatePath conf/ssl.crt
+ SSLOptions +FakeBasicAuth
+ SSLRequireSSL
+ SSLRequire %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+ and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"}
+&lt;/Directory&gt;</pre></div>
+
+
+<h3><a name="intranet" id="intranet">How can I require HTTPS with strong ciphers, and either basic
+authentication or client certificates, for access to part of the
+Intranet website, for clients coming from the Internet? I still want to allow
+plain HTTP access for clients on the Intranet.</a></h3>
+
+
+ <p>These examples presume that clients on the Intranet have IPs in the range
+ 192.160.1.0/24, and that the part of the Intranet website you want to allow
+ internet access to is <code>/usr/local/apache2/htdocs/subarea</code>.
+ This configuration should remain outside of your HTTPS virtual host, so
+ that it applies to both HTTPS and HTTP.</p>
+
+ <div class="example"><h3>httpd.conf</h3><pre>
+SSLCACertificateFile conf/ssl.crt/company-ca.crt
+
+&lt;Directory /usr/local/apache2/htdocs&gt;
+# Outside the subarea only Intranet access is granted
+Order deny,allow
+Deny from all
+Allow from 192.168.1.0/24
+&lt;/Directory&gt;
+
+&lt;Directory /usr/local/apache2/htdocs/subarea&gt;
+# Inside the subarea any Intranet access is allowed
+# but from the Internet only HTTPS + Strong-Cipher + Password
+# or the alternative HTTPS + Strong-Cipher + Client-Certificate
+
+# If HTTPS is used, make sure a strong cipher is used.
+# Additionally allow client certs as alternative to basic auth.
+SSLVerifyClient optional
+SSLVerifyDepth 1
+SSLOptions +FakeBasicAuth +StrictRequire
+SSLRequire %{SSL_CIPHER_USEKEYSIZE} &gt;= 128
+
+# Force clients from the Internet to use HTTPS
+RewriteEngine on
+RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$
+RewriteCond %{HTTPS} !=on
+RewriteRule .* - [F]
+
+# Allow Network Access and/or Basic Auth
+Satisfy any
+
+# Network Access Control
+Order deny,allow
+Deny from all
+Allow 192.168.1.0/24
+
+# HTTP Basic Authentication
+AuthType basic
+AuthName "Protected Intranet Area"
+AuthBasicProvider file
+AuthUserFile conf/protected.passwd
+Require valid-user
+&lt;/Directory&gt;</pre></div>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_howto.html" title="English">&nbsp;en&nbsp;</a></p>
+</div><div id="footer">
+<p class="apache">Copyright 2006 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
+</body></html> \ No newline at end of file
diff --git a/docs/manual/ssl/ssl_intro.html b/docs/manual/ssl/ssl_intro.html
new file mode 100644
index 00000000..263c0f21
--- /dev/null
+++ b/docs/manual/ssl/ssl_intro.html
@@ -0,0 +1,7 @@
+URI: ssl_intro.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
+
+URI: ssl_intro.html.ja.euc-jp
+Content-Language: ja
+Content-type: text/html; charset=EUC-JP
diff --git a/docs/manual/ssl/ssl_intro.html.en b/docs/manual/ssl/ssl_intro.html.en
new file mode 100644
index 00000000..85d047bd
--- /dev/null
+++ b/docs/manual/ssl/ssl_intro.html.en
@@ -0,0 +1,650 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ This file is generated from xml source: DO NOT EDIT
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ -->
+<title>SSL/TLS Strong Encryption: An Introduction - Apache HTTP Server</title>
+<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
+<link href="../images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.2</p>
+<img alt="" src="../images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.2</a> &gt; <a href="./">SSL/TLS</a></div><div id="page-content"><div id="preamble"><h1>SSL/TLS Strong Encryption: An Introduction</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_intro.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="../ja/ssl/ssl_intro.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a></p>
+</div>
+
+<blockquote>
+<p>The nice thing about standards is that there are so many to choose
+from. And if you really don't like all the standards you just have to
+wait another year until the one arises you are looking for.</p>
+
+<p class="cite">-- <cite>A. Tanenbaum</cite>, "Introduction to
+Computer Networks"</p>
+</blockquote>
+
+<p>As an introduction this chapter is aimed at readers who are familiar
+with the Web, HTTP, and Apache, but are not security experts. It is not
+intended to be a definitive guide to the SSL protocol, nor does it discuss
+specific techniques for managing certificates in an organization, or the
+important legal issues of patents and import and export restrictions.
+Rather, it is intended to provide a common background to <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> users by pulling together various concepts, definitions,
+and examples as a starting point for further exploration.</p>
+
+<p>The presented content is mainly derived, with the author's permission,
+from the article <a href="http://home.comcast.net/~fjhirsch/Papers/wwwj/">Introducing
+SSL and Certificates using SSLeay</a> by <a href="http://home.comcast.net/~fjhirsch/">Frederick J. Hirsch</a>, of The
+Open Group Research Institute, which was published in <a href="http://www.ora.com/catalog/wjsum97/">Web Security: A Matter of
+Trust</a>, World Wide Web Journal, Volume 2, Issue 3, Summer 1997.
+Please send any positive feedback to <a href="mailto:hirsch@fjhirsch.com">Frederick Hirsch</a> (the original
+article author) and all negative feedback to <a href="mailto:rse@engelschall.com">Ralf S. Engelschall</a> (the
+<code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> author).</p>
+</div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#cryptographictech">Cryptographic Techniques</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#certificates">Certificates</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#ssl">Secure Sockets Layer (SSL)</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#references">References</a></li>
+</ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="cryptographictech" id="cryptographictech">Cryptographic Techniques</a></h2>
+
+<p>Understanding SSL requires an understanding of cryptographic
+algorithms, message digest functions (aka. one-way or hash functions), and
+digital signatures. These techniques are the subject of entire books (see
+for instance [<a href="#AC96">AC96</a>]) and provide the basis for privacy,
+integrity, and authentication.</p>
+
+<h3><a name="cryptographicalgo" id="cryptographicalgo">Cryptographic Algorithms</a></h3>
+
+ <p>Suppose Alice wants to send a message to her bank to transfer some
+ money. Alice would like the message to be private, since it will
+ include information such as her account number and transfer amount. One
+ solution is to use a cryptographic algorithm, a technique that would
+ transform her message into an encrypted form, unreadable until it is
+ decrypted. Once in this form, the message can only be
+ decrypted by using a secret key. Without the key the message is useless:
+ good cryptographic algorithms make it so difficult
+ for intruders to decode the original text that it isn't worth their
+ effort.</p>
+
+ <p>There are two categories of cryptographic algorithms: conventional
+ and public key.</p>
+
+ <dl>
+ <dt>Conventional cryptography</dt>
+ <dd>also known as symmetric cryptography, requires the sender and
+ receiver to share a key: a secret piece of information that may be
+ used to encrypt or decrypt a message. As long as this key is kept
+ secret, nobody other than the sender or recipient can read the message.
+ If Alice and the bank know a secret key, then they can send each other
+ private messages. The task of sharing a key between sender and recipient
+ before communicating, while also keeping it secret from others, can be
+ problematic.</dd>
+
+ <dt>Public key cryptography</dt>
+ <dd>also known as asymmetric cryptography, solves the key exchange
+ problem by defining an algorithm which uses two keys, each of which
+ may be used to encrypt a message. If one key is used to encrypt a
+ message then the other must be used to decrypt it. This makes it
+ possible to receive secure messages by simply publishing one key
+ (the public key) and keeping the other secret (the private key).</dd>
+ </dl>
+
+ <p>Anyone can encrypt a message using the public key, but only the
+ owner of the private key will be able to read it. In this way, Alice
+ can send private messages to the owner of a key-pair (the bank), by
+ encrypting it using their public key. Only the bank will be able to
+ decrypt it.</p>
+
+
+<h3><a name="messagedigests" id="messagedigests">Message Digests</a></h3>
+
+ <p>Although Alice may encrypt her message to make it private, there
+ is still a concern that someone might modify her original message or
+ substitute it with a different one, in order to transfer the money
+ to themselves, for instance. One way of guaranteeing the integrity
+ of Alice's message is for her to create a concise summary of her
+ message and send this to the bank as well. Upon receipt of the message,
+ the bank creates its own summary and compares it with the one Alice
+ sent. If the summaries are the same then the message has been received
+ intact.</p>
+
+ <p>A summary such as this is called a <dfn>message digest</dfn>, <em>one-way
+ function</em> or <em>hash function</em>. Message digests are used to create
+ a short, fixed-length representation of a longer, variable-length message.
+ Digest algorithms are designed to produce a unique digests for each
+ message. Message digests are designed to make it impractically difficult
+ to determine the message from the digest, and (in theory) impossible to
+ find two different messages which create the same digest -- thus
+ eliminating the possibility of substituting one message for another while
+ maintaining the same digest.</p>
+
+ <p>Another challenge that Alice faces is finding a way to send the digest
+ to the bank securely; if the digest is not sent securely, its integrity may
+ be compromised, and with it, the possibility for the bank to determine the
+ integrity of the original message. Only if the digest is sent securely can
+ the integrity of the associated message be determined.</p>
+
+ <p>One way to send the digest securely is to include it in a digital
+ signature.</p>
+
+
+<h3><a name="digitalsignatures" id="digitalsignatures">Digital Signatures</a></h3>
+<p>When Alice sends a message to the bank, the bank needs to ensure that the
+message is really from her, so an intruder cannot request a transaction
+involving her account. A <em>digital signature</em>, created by Alice and
+included with the message, serves this purpose.</p>
+
+<p>Digital signatures are created by encrypting a digest of the message,
+and other information (such as a sequence number) with the sender's
+private key. Though anyone can <em>decrypt</em> the signature using the public
+key, only the sender knows the private key. This means that only they can
+have signed it. Including the digest in the signature means the signature is
+only good for that message; it also ensures the integrity of the message since
+no one can change the digest and still sign it.</p>
+<p>To guard against interception and reuse of the signature by an intruder at a
+later date, the signature contains a unique sequence number. This protects
+the bank from a fraudulent claim from Alice that she did not send the message
+-- only she could have signed it (non-repudiation).</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="certificates" id="certificates">Certificates</a></h2>
+
+<p>Although Alice could have sent a private message to the bank, signed
+it, and ensured the integrity of the message, she still needs to be sure
+that she is really communicating with the bank. This means that she needs
+to be sure that the public key she is using is part of the bank's key-pair,
+and not an intruder's. Similarly, the bank needs to verify that the message
+signature really was signed by the private key that belongs to Alice.</p>
+
+<p>If each party has a certificate which validates the other's identity,
+confirms the public key, and is signed by a trusted agency, then both
+can be assured that they are communicating with whom they think they are.
+Such a trusted agency is called a <em>Certificate Authority</em>, and
+certificates are used for authentication.</p>
+
+<h3><a name="certificatecontents" id="certificatecontents">Certificate Contents</a></h3>
+
+ <p>A certificate associates a public key with the real identity of
+ an individual, server, or other entity, known as the subject. As
+ shown in <a href="#table1">Table 1</a>, information about the subject
+ includes identifying information (the distinguished name), and the
+ public key. It also includes the identification and signature of the
+ Certificate Authority that issued the certificate, and the period of
+ time during which the certificate is valid. It may have additional
+ information (or extensions) as well as administrative information
+ for the Certificate Authority's use, such as a serial number.</p>
+
+ <h4><a name="table1" id="table1">Table 1: Certificate Information</a></h4>
+
+ <table>
+
+ <tr><th>Subject</th>
+ <td>Distinguished Name, Public Key</td></tr>
+ <tr><th>Issuer</th>
+ <td>Distinguished Name, Signature</td></tr>
+ <tr><th>Period of Validity</th>
+ <td>Not Before Date, Not After Date</td></tr>
+ <tr><th>Administrative Information</th>
+ <td>Version, Serial Number</td></tr>
+ <tr><th>Extended Information</th>
+ <td>Basic Constraints, Netscape Flags, etc.</td></tr>
+ </table>
+
+
+ <p>A distinguished name is used to provide an identity in a specific
+ context -- for instance, an individual might have a personal
+ certificate as well as one for their identity as an employee.
+ Distinguished names are defined by the X.509 standard [<a href="#X509">X509</a>], which defines the fields, field names, and
+ abbreviations used to refer to the fields (see <a href="#table2">Table
+ 2</a>).</p>
+
+ <h4><a name="table2" id="table2">Table 2: Distinguished Name Information</a></h4>
+
+ <table class="bordered">
+
+ <tr><th>DN Field</th>
+ <th>Abbrev.</th>
+ <th>Description</th>
+ <th>Example</th></tr>
+ <tr><td>Common Name</td>
+ <td>CN</td>
+ <td>Name being certified</td>
+ <td>CN=Joe Average</td></tr>
+ <tr><td>Organization or Company</td>
+ <td>O</td>
+ <td>Name is associated with this<br />organization</td>
+ <td>O=Snake Oil, Ltd.</td></tr>
+ <tr><td>Organizational Unit</td>
+ <td>OU</td>
+ <td>Name is associated with this <br />organization unit, such
+ as a department</td>
+ <td>OU=Research Institute</td></tr>
+ <tr><td>City/Locality</td>
+ <td>L</td>
+ <td>Name is located in this City</td>
+ <td>L=Snake City</td></tr>
+ <tr><td>State/Province</td>
+ <td>ST</td>
+ <td>Name is located in this State/Province</td>
+ <td>ST=Desert</td></tr>
+ <tr><td>Country</td>
+ <td>C</td>
+ <td>Name is located in this Country (ISO code)</td>
+ <td>C=XZ</td></tr>
+ </table>
+
+
+ <p>A Certificate Authority may define a policy specifying which
+ distinguished field names are optional, and which are required. It
+ may also place requirements upon the field contents, as may users of
+ certificates. For example, a Netscape browser requires that the
+ Common Name for a certificate representing a server matches a wildcard
+ pattern for the domain name of that server, such
+ as <code>*.snakeoil.com</code>.</p>
+
+ <p>The binary format of a certificate is defined using the ASN.1
+ notation [<a href="#X208">X208</a>] [<a href="#PKCS">PKCS</a>]. This
+ notation defines how to specify the contents, and encoding rules
+ define how this information is translated into binary form. The binary
+ encoding of the certificate is defined using Distinguished Encoding
+ Rules (DER), which are based on the more general Basic Encoding Rules
+ (BER). For those transmissions which cannot handle binary, the binary
+ form may be translated into an ASCII form by using Base64 encoding
+ [<a href="#MIME">MIME</a>]. When placed between begin and end delimiter
+ lines (as below), this encoded version is called a PEM ("Privacy Enhanced
+ Mail") encoded certificate.</p>
+
+ <div class="example"><h3>Example of a PEM-encoded certificate (snakeoil.crt)</h3><pre>-----BEGIN CERTIFICATE-----
+MIIC7jCCAlegAwIBAgIBATANBgkqhkiG9w0BAQQFADCBqTELMAkGA1UEBhMCWFkx
+FTATBgNVBAgTDFNuYWtlIERlc2VydDETMBEGA1UEBxMKU25ha2UgVG93bjEXMBUG
+A1UEChMOU25ha2UgT2lsLCBMdGQxHjAcBgNVBAsTFUNlcnRpZmljYXRlIEF1dGhv
+cml0eTEVMBMGA1UEAxMMU25ha2UgT2lsIENBMR4wHAYJKoZIhvcNAQkBFg9jYUBz
+bmFrZW9pbC5kb20wHhcNOTgxMDIxMDg1ODM2WhcNOTkxMDIxMDg1ODM2WjCBpzEL
+MAkGA1UEBhMCWFkxFTATBgNVBAgTDFNuYWtlIERlc2VydDETMBEGA1UEBxMKU25h
+a2UgVG93bjEXMBUGA1UEChMOU25ha2UgT2lsLCBMdGQxFzAVBgNVBAsTDldlYnNl
+cnZlciBUZWFtMRkwFwYDVQQDExB3d3cuc25ha2VvaWwuZG9tMR8wHQYJKoZIhvcN
+AQkBFhB3d3dAc25ha2VvaWwuZG9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+gQDH9Ge/s2zcH+da+rPTx/DPRp3xGjHZ4GG6pCmvADIEtBtKBFAcZ64n+Dy7Np8b
+vKR+yy5DGQiijsH1D/j8HlGE+q4TZ8OFk7BNBFazHxFbYI4OKMiCxdKzdif1yfaa
+lWoANFlAzlSdbxeGVHoT0K+gT5w3UxwZKv2DLbCTzLZyPwIDAQABoyYwJDAPBgNV
+HRMECDAGAQH/AgEAMBEGCWCGSAGG+EIBAQQEAwIAQDANBgkqhkiG9w0BAQQFAAOB
+gQAZUIHAL4D09oE6Lv2k56Gp38OBDuILvwLg1v1KL8mQR+KFjghCrtpqaztZqcDt
+2q2QoyulCgSzHbEGmi0EsdkPfg6mp0penssIFePYNI+/8u9HT4LuKMJX15hxBam7
+dUHzICxBVC1lnHyYGjDuAMhe396lYAn8bCld1/L4NMGBCQ==
+-----END CERTIFICATE-----</pre></div>
+
+
+<h3><a name="certificateauthorities" id="certificateauthorities">Certificate Authorities</a></h3>
+
+ <p>By verifying the information in a certificate request
+ before granting the certificate, the Certificate Authority assures
+ itself of the identity of the private key owner of a key-pair.
+ For instance, if Alice requests a personal certificate, the
+ Certificate Authority must first make sure that Alice really is the
+ person the certificate claims she is.</p>
+
+ <h4><a name="certificatechains" id="certificatechains">Certificate Chains</a></h4>
+
+ <p>A Certificate Authority may also issue a certificate for
+ another Certificate Authority. When examining a certificate,
+ Alice may need to examine the certificate of the issuer, for each
+ parent Certificate Authority, until reaching one which she has
+ confidence in. She may decide to trust only certificates with a
+ limited chain of issuers, to reduce her risk of a "bad" certificate
+ in the chain.</p>
+
+
+ <h4><a name="rootlevelca" id="rootlevelca">Creating a Root-Level CA</a></h4>
+
+ <p>As noted earlier, each certificate requires an issuer to assert
+ the validity of the identity of the certificate subject, up to
+ the top-level Certificate Authority (CA). This presents a problem:
+ who can vouch for the certificate of the top-level
+ authority, which has no issuer? In this unique case, the
+ certificate is "self-signed", so the issuer of the certificate is
+ the same as the subject. Browsers are preconfigured to trust well-known
+ certificate authorities, but it is important to exercise extra care in
+ trusting a self-signed certificate. The wide publication of a
+ public key by the root authority reduces the risk in trusting this
+ key -- it would be obvious if someone else publicized a key
+ claiming to be the authority.</p>
+
+ <p>A number of companies, such as <a href="http://www.thawte.com/">Thawte</a> and <a href="http://www.verisign.com/">VeriSign</a>
+ have established themselves as Certificate Authorities. These
+ companies provide the following services:</p>
+
+ <ul>
+ <li>Verifying certificate requests</li>
+ <li>Processing certificate requests</li>
+ <li>Issuing and managing certificates</li>
+ </ul>
+
+ <p>It is also possible to create your own Certificate Authority.
+ Although risky in the Internet environment, it may be useful
+ within an Intranet where the organization can easily verify the
+ identities of individuals and servers.</p>
+
+
+ <h4><a name="certificatemanagement" id="certificatemanagement">Certificate Management</a></h4>
+
+ <p>Establishing a Certificate Authority is a responsibility which
+ requires a solid administrative, technical, and management
+ framework. Certificate Authorities not only issue certificates,
+ they also manage them -- that is, they determine for how long
+ certificates remain valid, they renew them, and they keep lists of
+ certificates that were issued in the past but are no longer valid
+ (Certificate Revocation Lists, or CRLs).</p>
+
+ <p>For example, if Alice is entitled to a certificate as an
+ employee of a company, but has now left
+ that company, her certificate may need to be revoked.
+ Because certificates are only issued after the subject's identity has
+ been verified, and can then be passed around to all those with whom
+ the subject may communicate, it is impossible to tell from the
+ certificate alone that it has been revoked.
+ When examining certificates for validity, therefore,
+ it is necessary to contact the issuing Certificate Authority to
+ check CRLs -- this is usually not an automated part of the process.</p>
+
+ <div class="note"><h3>Note</h3>
+ <p>If you use a Certificate Authority that browsers are not configured
+ to trust by default, it is necessary to load the Certificate
+ Authority certificate into the browser, enabling the browser to
+ validate server certificates signed by that Certificate Authority.
+ Doing so may be dangerous, since once loaded, the browser will
+ accept all certificates signed by that Certificate Authority.</p>
+ </div>
+
+
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="ssl" id="ssl">Secure Sockets Layer (SSL)</a></h2>
+
+<p>The Secure Sockets Layer protocol is a protocol layer which may be
+placed between a reliable connection-oriented network layer protocol
+(e.g. TCP/IP) and the application protocol layer (e.g. HTTP). SSL provides
+for secure communication between client and server by allowing mutual
+authentication, the use of digital signatures for integrity, and encryption
+for privacy.</p>
+
+<p>The protocol is designed to support a range of choices for specific
+algorithms used for cryptography, digests, and signatures. This allows
+algorithm selection for specific servers to be made based on legal, export
+or other concerns, and also enables the protocol to take advantage of new
+algorithms. Choices are negotiated between client and server at the start
+of establishing a protocol session.</p>
+
+<h3><a name="table4" id="table4">Table 4: Versions of the SSL protocol</a></h3>
+
+ <table class="bordered">
+
+ <tr><th>Version</th>
+ <th>Source</th>
+ <th>Description</th>
+ <th>Browser Support</th></tr>
+ <tr><td>SSL v2.0</td>
+ <td>Vendor Standard (from Netscape Corp.) [<a href="#SSL2">SSL2</a>]</td>
+ <td>First SSL protocol for which implementations exists</td>
+ <td>- NS Navigator 1.x/2.x<br />
+ - MS IE 3.x<br />
+ - Lynx/2.8+OpenSSL</td></tr>
+ <tr><td>SSL v3.0</td>
+ <td>Expired Internet Draft (from Netscape Corp.) [<a href="#SSL3">SSL3</a>]</td>
+ <td>Revisions to prevent specific security attacks, add non-RSA
+ ciphers, and support for certificate chains</td>
+ <td>- NS Navigator 2.x/3.x/4.x<br />
+ - MS IE 3.x/4.x<br />
+ - Lynx/2.8+OpenSSL</td></tr>
+ <tr><td>TLS v1.0</td>
+ <td>Proposed Internet Standard (from IETF) [<a href="#TLS1">TLS1</a>]</td>
+ <td>Revision of SSL 3.0 to update the MAC layer to HMAC, add block
+ padding for block ciphers, message order standardization and more
+ alert messages.</td>
+ <td>- Lynx/2.8+OpenSSL</td></tr>
+ </table>
+
+
+<p>There are a number of versions of the SSL protocol, as shown in
+<a href="#table4">Table 4</a>. As noted there, one of the benefits in
+SSL 3.0 is that it adds support of certificate chain loading. This feature
+allows a server to pass a server certificate along with issuer certificates
+to the browser. Chain loading also permits the browser to validate the
+server certificate, even if Certificate Authority certificates are not
+installed for the intermediate issuers, since they are included in the
+certificate chain. SSL 3.0 is the basis for the Transport Layer Security
+[<a href="#TLS1">TLS</a>] protocol standard, currently in development by
+the Internet Engineering Task Force (IETF).</p>
+
+<h3><a name="session" id="session">Establishing a Session</a></h3>
+
+ <p>The SSL session is established by following a handshake sequence
+ between client and server, as shown in <a href="#figure1">Figure 1</a>. This sequence may vary, depending on whether the server
+ is configured to provide a server certificate or request a client
+ certificate. Although cases exist where additional handshake steps
+ are required for management of cipher information, this article
+ summarizes one common scenario. See the SSL specification for the full
+ range of possibilities.</p>
+
+ <div class="note"><h3>Note</h3>
+ <p>Once an SSL session has been established, it may be reused. This
+ avoids the performance penalty of repeating the many steps needed
+ to start a session. To do this, the server assigns each SSL session a
+ unique session identifier which is cached in the server and which the
+ client can use in future connections to reduce the handshake time
+ (until the session identifer expires from the cache of the server).</p>
+ </div>
+
+ <p class="figure">
+ <img src="../images/ssl_intro_fig1.gif" alt="" width="423" height="327" /><br />
+ <a id="figure1" name="figure1"><dfn>Figure 1</dfn></a>: Simplified SSL
+ Handshake Sequence</p>
+
+ <p>The elements of the handshake sequence, as used by the client and
+ server, are listed below:</p>
+
+ <ol>
+ <li>Negotiate the Cipher Suite to be used during data transfer</li>
+ <li>Establish and share a session key between client and server</li>
+ <li>Optionally authenticate the server to the client</li>
+ <li>Optionally authenticate the client to the server</li>
+ </ol>
+
+ <p>The first step, Cipher Suite Negotiation, allows the client and
+ server to choose a Cipher Suite supported by both of them. The SSL3.0
+ protocol specification defines 31 Cipher Suites. A Cipher Suite is
+ defined by the following components:</p>
+
+ <ul>
+ <li>Key Exchange Method</li>
+ <li>Cipher for Data Transfer</li>
+ <li>Message Digest for creating the Message Authentication Code (MAC)</li>
+ </ul>
+
+ <p>These three elements are described in the sections that follow.</p>
+
+
+<h3><a name="keyexchange" id="keyexchange">Key Exchange Method</a></h3>
+
+ <p>The key exchange method defines how the shared secret symmetric
+ cryptography key used for application data transfer will be agreed
+ upon by client and server. SSL 2.0 uses RSA key exchange only, while
+ SSL 3.0 supports a choice of key exchange algorithms including
+ RSA key exchange (when certificates are used), and Diffie-Hellman key
+ exchange (for exchanging keys without certificates, or without prior
+ communication between client and server).</p>
+
+ <p>One variable in the choice of key exchange methods is digital
+ signatures -- whether or not to use them, and if so, what kind of
+ signatures to use. Signing with a private key provides protection
+ against a man-in-the-middle-attack during the information exchange
+ used to generating the shared key [<a href="#AC96">AC96</a>, p516].</p>
+
+
+<h3><a name="ciphertransfer" id="ciphertransfer">Cipher for Data Transfer</a></h3>
+
+ <p>SSL uses conventional symmetric cryptography, as described earlier,
+ for encrypting messages in a session.
+ There are nine choices of how to encrypt, including the option not to
+ encrypt:</p>
+
+ <ul>
+ <li>No encryption</li>
+ <li>Stream Ciphers
+ <ul>
+ <li>RC4 with 40-bit keys</li>
+ <li>RC4 with 128-bit keys</li>
+ </ul></li>
+ <li>CBC Block Ciphers
+ <ul><li>RC2 with 40 bit key</li>
+ <li>DES with 40 bit key</li>
+ <li>DES with 56 bit key</li>
+ <li>Triple-DES with 168 bit key</li>
+ <li>Idea (128 bit key)</li>
+ <li>Fortezza (96 bit key)</li>
+ </ul></li>
+ </ul>
+
+ <p>"CBC" refers to Cipher Block Chaining, which means that a
+ portion of the previously encrypted cipher text is used in the
+ encryption of the current block. "DES" refers to the Data Encryption
+ Standard [<a href="#AC96">AC96</a>, ch12], which has a number of
+ variants (including DES40 and 3DES_EDE). "Idea" is currently one of
+ the best and cryptographically strongest algorithms available,
+ and "RC2" is a proprietary algorithm from RSA DSI [<a href="#AC96">AC96</a>, ch13].</p>
+
+
+<h3><a name="digestfuntion" id="digestfuntion">Digest Function</a></h3>
+
+ <p>The choice of digest function determines how a digest is created
+ from a record unit. SSL supports the following:</p>
+
+ <ul>
+ <li>No digest (Null choice)</li>
+ <li>MD5, a 128-bit hash</li>
+ <li>Secure Hash Algorithm (SHA-1), a 160-bit hash</li>
+ </ul>
+
+ <p>The message digest is used to create a Message Authentication Code
+ (MAC) which is encrypted with the message to verify integrity and to
+ protect against replay attacks.</p>
+
+
+<h3><a name="handshake" id="handshake">Handshake Sequence Protocol</a></h3>
+
+ <p>The handshake sequence uses three protocols:</p>
+
+ <ul>
+ <li>The <dfn>SSL Handshake Protocol</dfn>
+ for performing the client and server SSL session establishment.</li>
+ <li>The <dfn>SSL Change Cipher Spec Protocol</dfn> for actually
+ establishing agreement on the Cipher Suite for the session.</li>
+ <li>The <dfn>SSL Alert Protocol</dfn> for conveying SSL error
+ messages between client and server.</li>
+ </ul>
+
+ <p>These protocols, as well as application protocol data, are
+ encapsulated in the <dfn>SSL Record Protocol</dfn>, as shown in
+ <a href="#figure2">Figure 2</a>. An encapsulated protocol is
+ transferred as data by the lower layer protocol, which does not
+ examine the data. The encapsulated protocol has no knowledge of the
+ underlying protocol.</p>
+
+ <p class="figure">
+ <img src="../images/ssl_intro_fig2.gif" alt="" width="428" height="217" /><br />
+ <a id="figure2" name="figure2"><dfn>Figure 2</dfn></a>: SSL Protocol Stack
+ </p>
+
+ <p>The encapsulation of SSL control protocols by the record protocol
+ means that if an active session is renegotiated the control protocols
+ will be transmitted securely. If there was no previous session,
+ the Null cipher suite is used, which means there will be no encryption and
+ messages will have no integrity digests, until the session has been
+ established.</p>
+
+
+<h3><a name="datatransfer" id="datatransfer">Data Transfer</a></h3>
+
+ <p>The SSL Record Protocol, shown in <a href="#figure3">Figure 3</a>,
+ is used to transfer application and SSL Control data between the
+ client and server, where necessary fragmenting this data into smaller units,
+ or combining multiple higher level protocol data messages into single
+ units. It may compress, attach digest signatures, and encrypt these
+ units before transmitting them using the underlying reliable transport
+ protocol (Note: currently, no major SSL implementations include support
+ for compression).</p>
+
+ <p class="figure">
+ <img src="../images/ssl_intro_fig3.gif" alt="" width="423" height="323" /><br />
+ <a id="figure3" name="figure3"><dfn>Figure 3</dfn></a>: SSL Record Protocol
+ </p>
+
+
+<h3><a name="securehttp" id="securehttp">Securing HTTP Communication</a></h3>
+
+ <p>One common use of SSL is to secure Web HTTP communication between
+ a browser and a webserver. This does not preclude the use of
+ non-secured HTTP - the secure version (called HTTPS) is the same as
+ plain HTTP over SSL, but uses the URL scheme <code>https</code>
+ rather than <code>http</code>, and a different server port (by default,
+ port 443). This functionality is a large part of what <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> provides for the Apache webserver.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="references" id="references">References</a></h2>
+
+<dl>
+<dt><a id="AC96" name="AC96">[AC96]</a></dt>
+<dd>Bruce Schneier, <q>Applied Cryptography</q>, 2nd Edition, Wiley,
+1996. See <a href="http://www.counterpane.com/">http://www.counterpane.com/</a> for various other materials by Bruce
+Schneier.</dd>
+
+<dt><a id="X208" name="X208">[X208]</a></dt>
+<dd>ITU-T Recommendation X.208, <q>Specification of Abstract Syntax Notation
+One (ASN.1)</q>, 1988. See for instance <a href="http://www.itu.int/rec/recommendation.asp?type=items&amp;lang=e&amp;parent=T-REC-X.208-198811-I">http://www.itu.int/rec/recommendation.asp?type=items&amp;lang=e&amp;parent=T-REC-X.208-198811-I</a>.
+</dd>
+
+<dt><a id="X509" name="X509">[X509]</a></dt>
+<dd>ITU-T Recommendation X.509, <q>The Directory - Authentication
+Framework</q>. See for instance <a href="http://www.itu.int/rec/recommendation.asp?type=folders&amp;lang=e&amp;parent=T-REC-X.509">http://www.itu.int/rec/recommendation.asp?type=folders&amp;lang=e&amp;parent=T-REC-X.509</a>.
+</dd>
+
+<dt><a id="PKCS" name="PKCS">[PKCS]</a></dt>
+<dd><q>Public Key Cryptography Standards (PKCS)</q>,
+RSA Laboratories Technical Notes, See <a href="http://www.rsasecurity.com/rsalabs/pkcs/">http://www.rsasecurity.com/rsalabs/pkcs/</a>.</dd>
+
+<dt><a id="MIME" name="MIME">[MIME]</a></dt>
+<dd>N. Freed, N. Borenstein, <q>Multipurpose Internet Mail Extensions
+(MIME) Part One: Format of Internet Message Bodies</q>, RFC2045.
+See for instance <a href="http://ietf.org/rfc/rfc2045.txt">http://ietf.org/rfc/rfc2045.txt</a>.</dd>
+
+<dt><a id="SSL2" name="SSL2">[SSL2]</a></dt>
+<dd>Kipp E.B. Hickman, <q>The SSL Protocol</q>, 1995. See <a href="http://www.netscape.com/eng/security/SSL_2.html">http://www.netscape.com/eng/security/SSL_2.html</a>.</dd>
+
+<dt><a id="SSL3" name="SSL3">[SSL3]</a></dt>
+<dd>Alan O. Freier, Philip Karlton, Paul C. Kocher, <q>The SSL Protocol
+Version 3.0</q>, 1996. See <a href="http://www.netscape.com/eng/ssl3/draft302.txt">http://www.netscape.com/eng/ssl3/draft302.txt</a>.</dd>
+
+<dt><a id="TLS1" name="TLS1">[TLS1]</a></dt>
+<dd>Tim Dierks, Christopher Allen, <q>The TLS Protocol Version 1.0</q>,
+1999. See <a href="http://ietf.org/rfc/rfc2246.txt">http://ietf.org/rfc/rfc2246.txt</a>.</dd>
+</dl>
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_intro.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="../ja/ssl/ssl_intro.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a></p>
+</div><div id="footer">
+<p class="apache">Copyright 2006 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
+</body></html> \ No newline at end of file
diff --git a/docs/manual/ssl/ssl_intro.html.ja.euc-jp b/docs/manual/ssl/ssl_intro.html.ja.euc-jp
new file mode 100644
index 00000000..285ea4c8
--- /dev/null
+++ b/docs/manual/ssl/ssl_intro.html.ja.euc-jp
@@ -0,0 +1,697 @@
+<?xml version="1.0" encoding="EUC-JP"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="ja" xml:lang="ja"><head><!--
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ This file is generated from xml source: DO NOT EDIT
+ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ -->
+<title>SSL/TLS 暗号化: はじめに - Apache HTTP サーバ</title>
+<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
+<link href="../images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="../mod/">モジュール</a> | <a href="../mod/directives.html">ディレクティブ</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">用語</a> | <a href="../sitemap.html">サイトマップ</a></p>
+<p class="apache">Apache HTTP サーバ バージョン 2.2</p>
+<img alt="" src="../images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP サーバ</a> &gt; <a href="http://httpd.apache.org/docs/">ドキュメンテーション</a> &gt; <a href="../">バージョン 2.2</a> &gt; <a href="./">SSL/TLS</a></div><div id="page-content"><div id="preamble"><h1>SSL/TLS 暗号化: はじめに</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_intro.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="../ja/ssl/ssl_intro.html" title="Japanese">&nbsp;ja&nbsp;</a></p>
+</div>
+<div class="outofdate">This translation may be out of date. Check the
+ English version for recent changes.</div>
+
+<blockquote>
+<p>標準規格の良い所は、たくさんの規格から選べるということだ。
+そして、もし本当にどの規格も気に入らなければ、
+一年待つだけで探していた規格が現れる。</p>
+
+<p class="cite">-- <cite>A. Tanenbaum</cite>, "Introduction to
+Computer Networks"</p>
+</blockquote>
+
+<p>
+入門ということで、この章は Web、HTTP、Apache に通じている
+読者向けですが、セキュリティ専門家向けではありません。
+SSL プロトコルの決定的な手引きであるつもりはありません。
+また、組織内の認証管理のための特定のテクニックや、
+特許や輸出規制などの重要な法的な問題についても扱いません。
+むしろ、更なる研究への出発点として色々な概念、定義、例を並べることで
+ mod_ssl のユーザに基礎知識を提供する事を目的としています。</p>
+
+<p>ここに示された内容は主に、原著者の許可の下
+The Open Group Research Institute の <a href="http://home.earthlink.net/~fjhirsch/">Frederick J. Hirsch</a>
+ 氏の記事 <a href="http://home.earthlink.net/~fjhirsch/Papers/wwwj/article.html">
+Introducing SSL and Certificates using SSLeay</a> を基にしています。
+氏の記事は <a href="http://www.ora.com/catalog/wjsum97/">Web Security: A Matter of
+Trust</a>, World Wide Web Journal, Volume 2, Issue 3, Summer 1997
+に掲載されました。
+肯定的な意見は <a href="mailto:hirsch@fjhirsch.com">Frederick Hirsch</a> 氏
+ (元記事の著者) へ全ての苦情は <a href="mailto:rse@engelschall.com">Ralf S. Engelschall</a> (
+<code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> の作者) へお願いします。
+[訳注: 訳については <a href="mailto:apache-docs@ml.apache.or.jp">
+Apache ドキュメント翻訳プロジェクト</a>
+へお願いします。]</p>
+</div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#cryptographictech">暗号化技術</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#certificates">証明書</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#ssl">Secure Sockets Layer (SSL)</a></li>
+<li><img alt="" src="../images/down.gif" /> <a href="#references">参考文献</a></li>
+</ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="cryptographictech" id="cryptographictech">暗号化技術</a></h2>
+
+<p>SSL を理解するには、暗号アルゴリズム、
+メッセージダイジェスト関数(別名: 一方向関数、ハッシュ関数)、
+電子署名などへの理解が必要です。
+これらの技術は本が丸ごと必要な題目で
+(例えば [<a href="#AC96">AC96</a>] を参照)、
+プライバシー、信用、認証などの技術の基礎となっています。</p>
+
+<h3><a name="cryptographicalgo" id="cryptographicalgo">暗号アルゴリズム</a></h3>
+
+ <p>例えば、アリスが送金のために銀行にメッセージを送りたいとします。
+ 口座番号や送金の金額が含まれるため、
+ アリスはそのメッセージを秘密にしたいと思います。
+ 解決方法の一つは暗号アルゴリズムを使って、メッセージを
+ 読ませたい人以外は読むことができない暗号化された
+ 形態に変えてしまうことです。
+ その形態になると、
+ メッセージは秘密の鍵によってのみ解釈することができます。
+ 鍵なしでは、メッセージは役に立ちません。
+ 良い暗号アルゴリズムは、侵入者が元のテキストを解読することを
+ 非常に難しくするため、努力が割に合わなくさせます。</p>
+
+ <p>暗号アルゴリズムには
+ 従来型と公開鍵の二つの種類があります。</p>
+
+ <dl>
+ <dt>従来型暗号</dt>
+ <dd>対称暗号としても知られ、
+ 送信者と受信者が鍵を共有することが必要です。
+ 鍵とは、メッセージを暗号化したり復号するのに使われる秘密
+ の情報のことです。
+ もし、この鍵が秘密なら、送信者と受信者以外は誰もメッセージを読
+ むことができません。
+ もしも、アリスと銀行が秘密の鍵を知っているなら、
+ 彼らはお互いに秘密のメッセージを送ることができるでしょう。
+ ただし、事前に内密に鍵を選ぶという仕事は問題を含んでいます。</dd>
+
+ <dt>公開鍵暗号</dt>
+ <dd>非対称暗号としても知られ、
+ メッセージを暗号化することのできる二つの鍵
+ を使用するアルゴリズムを定義することで鍵のやり取りの問題を解決
+ します。
+ もし、ある鍵が暗号化に使われたなら、
+ もう片方の鍵で復号しなければいけません。
+ この方式によって、一つの鍵を公表して(公開鍵)、
+ もう片方を秘密にしておく(秘密鍵)だけで、
+ 安全なメッセージを受け取ることができます。</dd>
+ </dl>
+
+ <p>誰もが暗号化されたメッセージを公開鍵によって暗号化
+ することができますが、秘密鍵の持ち主だけがそれを読むことが
+ できます。
+ この方法で、銀行の公開鍵を使って暗号化することで、
+ アリスは秘密のメッセージを送ることができます。
+ 銀行のみが復号することができます。</p>
+
+
+<h3><a name="messagedigests" id="messagedigests">メッセージダイジェスト</a></h3>
+
+ <p>アリスはメッセージを秘密にすることができますが、
+ 誰かが例えば自分に送金するようにメッセージを変更したり、
+ 別のものに置き換えてしまうかもしれないという問題があります。
+ アリスのメッセージの信用を保証する方法の一つは、
+ メッセージの簡潔なダイジェストを作って、それも銀行に送るというものです。
+ メッセージを受け取ると銀行もダイジェストを作成し、
+ アリスが送ったものと比べます。もし一致したなら、
+ 受け取ったメッセージは無傷だということになります。</p>
+
+ <p>このような要約は<dfn>メッセージダイジェスト</dfn>、
+ <em>一方行関数</em>、または<em>ハッシュ関数</em>と呼ばれます。
+ メッセージダイジェストは長い可変長のメッセージから
+ 短い固定長の表現を作るのに使われます。
+ ダイジェストアルゴリズムはメッセージから
+ 一意なダイジェストを生成するように作られています。
+ メッセージダイジェストはダイジェストから元のメッセージを
+ 判定するのがとても難しいようにできています。
+ また、同じ要約を作成する二つのメッセージを探すのは不可能です。
+ よって、同じ要約を使ってメッセージを置き換えるという
+ 可能性を排除しています。</p>
+
+<p>アリスへのもう一つの問題は、このダイジェストを安全に送る方法を探すことです。
+これができれば、メッセージの信用が保証されます。
+一つの方法はこのダイジェストに電子署名を含むことです。</p>
+
+
+<h3><a name="digitalsignatures" id="digitalsignatures">電子署名</a></h3>
+<p>アリスが銀行にメッセージを送ったとき、銀行は、
+侵入者が彼女になりすまして彼女の口座への取引を申請していないか、
+メッセージが本当に彼女からのものか確実に分からなければいけません。
+アリスによって作成され、メッセージに含まれた
+<em>電子署名</em>がここで役に立ちます。</p>
+
+<p>電子署名はメッセージのダイジェストやその他の情報(処理番号など)を
+送信者の秘密鍵で暗号化することで作られます。
+誰もが公開鍵を使って署名を<em>復号</em>することができますが、
+署名者のみが秘密鍵を知っています。
+これは、彼らのみが署名しえたことを意味します。
+ダイジェストを電子署名に含むことは、
+その署名がそのメッセージのみに有効であることを意味します。
+これは、誰もダイジェストを変えて署名をすることができないため、
+メッセージの信用も保証します。</p>
+
+<p>侵入者が署名を傍受して後日に再利用するのを防ぐため
+電子署名には一意な処理番号が含まれます。
+これは、アリスがそんなメッセージは送っていないと言う詐欺
+から銀行を守ります。
+彼女だけが署名しえたからです。(否認防止)</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="certificates" id="certificates">証明書</a></h2>
+
+<p>アリスは秘密のメッセージを銀行に送り、
+署名をして、メッセージの信用を保証することができるおうになりましたが、
+通信している相手が本当に銀行なのか確かめなくてはいけません。
+これは、彼女が使う公開鍵が銀行の秘密鍵と対になっているものか、
+彼女は確かめなくてはいけないということを意味します。
+同様に、銀行はメッセージの署名が本当にアリスの署名か確認する必要が
+あります。</p>
+
+<p>もし両者に身元を証明し、公開鍵を確認し、また信頼された機関が署名
+した証明書があれば、両者とも通信相手について正しい相手だと
+確信することができます。
+そのような信頼された機関は<em>認証局</em>
+ (Certificate Authority または CA) と呼ばれ、
+証明書 (certificate) が認証 (authentication) に使われます。</p>
+
+<h3><a name="certificatecontents" id="certificatecontents">証明書の内容</a></h3>
+
+ <p>証明書は公開鍵と個人、サーバ、その他の主体の実在の身元を
+ 関連付けます。
+ <a href="#table1">表1</a>に示されるように証明対象の情報は
+ 身元証明の情報(識別名)と公開鍵が含まれます。
+ 証明書はまた、認証局の身元証明と署名、そして証明書の有効期間を
+ 含みます。
+ シリアルナンバーなどの認証局の管理上の情報や
+ その他の追加の情報が含まれているかもしれません。</p>
+
+ <h4><a name="table1" id="table1">表1: 証明書情報</a></h4>
+
+ <table>
+
+ <tr><th>証明対象</th>
+ <td>識別名、公開鍵</td></tr>
+ <tr><th>発行者</th>
+ <td>識別名、公開鍵</td></tr>
+ <tr><th>有効期間</th>
+ <td>開始日、失効日</td></tr>
+ <tr><th>管理情報</th>
+ <td>バージョン、シリアルナンバー</td></tr>
+ <tr><th>拡張情報</th>
+ <td>基本的な制約、ネットスケープフラッグ、その他</td></tr>
+ </table>
+
+
+ <p>識別名(ディスティングイッシュ・ネーム)は特定の状況における
+ 身分証明を提供するのに使われています。例えば、ある人は
+ 私用と会社とで別々の身分証明を持つかもしれません。
+
+ 識別名は X.509 標準規格 [<a href="#X509">X509</a>] で定義されています。
+ X.509 標準規格は、項目、項目名、そして項目の略称を定義しています。(<a href="#table2">表
+ 2</a> 参照)</p>
+
+ <h4><a name="table2" id="table2">表 2: 識別名情報</a></h4>
+
+ <table class="bordered">
+
+ <tr><th>識別名項目</th>
+ <th>略称</th>
+ <th>説明</th>
+ <th>例</th></tr>
+ <tr><td>Common Name (コモンネーム)</td>
+ <td>CN</td>
+ <td>認証される名前<br />
+ SSL接続するURL</td>
+ <td>CN=www.example.com</td></tr>
+ <tr><td>Organization or Company (組織名)</td>
+ <td>O</td>
+ <td>団体の正式英語組織名</td>
+ <td>O=Example Japan K.K.</td></tr>
+ <tr><td>Organizational Unit (部門名)</td>
+ <td>OU</td>
+ <td>部署名など</td>
+ <td>OU=Customer Service</td></tr>
+ <tr><td>City/Locality (市区町村)</td>
+ <td>L</td>
+ <td>所在してる市区町村</td>
+ <td>L=Sapporo</td></tr>
+ <tr><td>State/Province (都道府県)</td>
+ <td>ST</td>
+ <td>所在してる都道府県</td>
+ <td>ST=Hokkaido</td></tr>
+ <tr><td>Country(国)</td>
+ <td>C</td>
+ <td>所在している国名の ISO コード<br />
+ 日本の場合 JP
+ </td>
+ <td>C=JP</td></tr>
+ </table>
+
+
+ <p>認証局はどの項目が省略可能でどれが必須かの方針を定義する
+ かもしれません。項目の内容についても認証局や証明書のユーザからの
+ 要件があるかもしれません。
+ 例えば、ネットスケープのブラウザはサーバの証明書の
+ Common Name (コモンネーム)がサーバのドメイン名の
+ <code>*.example.com</code>
+ というようなワイルドカードのパターンにマッチすること
+ を要求します。</p>
+
+ <p>バイナリ形式の証明書は ASN.1 表記法
+ [<a href="#X208">X208</a>] [<a href="#PKCS">PKCS</a>] で
+ 定義されています。
+ この表記法は内容をどのように記述するかを定義し、
+ 符号化の規定がこの情報がどのようにバイナリ形式に変換されるかを
+ 定義します。
+ 証明書のバイナリ符号化は Distinguished Encoding
+ Rules (DER) で定義され、それはより一般的な Basic Encoding Rules
+ (BER) に基づいています。
+ バイナリ形式を扱うことのできない送信では、
+ バイナリ形式は Base64 符号化 [<a href="#MIME">MIME</a>] で
+ ASCII 形式に変換されることがあります。
+ このように符号化され、以下の例に示されるように区切り行に
+ 挟まれたものは PEM 符号化されたと言います。
+ (PEM の名前は "Privacy Enhanced Mail" に由来します)</p>
+
+ <div class="example"><h3>PEM 符号化された証明書の例 (example.crt)</h3><pre>-----BEGIN CERTIFICATE-----
+MIIC7jCCAlegAwIBAgIBATANBgkqhkiG9w0BAQQFADCBqTELMAkGA1UEBhMCWFkx
+FTATBgNVBAgTDFNuYWtlIERlc2VydDETMBEGA1UEBxMKU25ha2UgVG93bjEXMBUG
+A1UEChMOU25ha2UgT2lsLCBMdGQxHjAcBgNVBAsTFUNlcnRpZmljYXRlIEF1dGhv
+cml0eTEVMBMGA1UEAxMMU25ha2UgT2lsIENBMR4wHAYJKoZIhvcNAQkBFg9jYUBz
+bmFrZW9pbC5kb20wHhcNOTgxMDIxMDg1ODM2WhcNOTkxMDIxMDg1ODM2WjCBpzEL
+MAkGA1UEBhMCWFkxFTATBgNVBAgTDFNuYWtlIERlc2VydDETMBEGA1UEBxMKU25h
+a2UgVG93bjEXMBUGA1UEChMOU25ha2UgT2lsLCBMdGQxFzAVBgNVBAsTDldlYnNl
+cnZlciBUZWFtMRkwFwYDVQQDExB3d3cuc25ha2VvaWwuZG9tMR8wHQYJKoZIhvcN
+AQkBFhB3d3dAc25ha2VvaWwuZG9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+gQDH9Ge/s2zcH+da+rPTx/DPRp3xGjHZ4GG6pCmvADIEtBtKBFAcZ64n+Dy7Np8b
+vKR+yy5DGQiijsH1D/j8HlGE+q4TZ8OFk7BNBFazHxFbYI4OKMiCxdKzdif1yfaa
+lWoANFlAzlSdbxeGVHoT0K+gT5w3UxwZKv2DLbCTzLZyPwIDAQABoyYwJDAPBgNV
+HRMECDAGAQH/AgEAMBEGCWCGSAGG+EIBAQQEAwIAQDANBgkqhkiG9w0BAQQFAAOB
+gQAZUIHAL4D09oE6Lv2k56Gp38OBDuILvwLg1v1KL8mQR+KFjghCrtpqaztZqcDt
+2q2QoyulCgSzHbEGmi0EsdkPfg6mp0penssIFePYNI+/8u9HT4LuKMJX15hxBam7
+dUHzICxBVC1lnHyYGjDuAMhe396lYAn8bCld1/L4NMGBCQ==
+-----END CERTIFICATE-----</pre></div>
+
+
+<h3><a name="certificateauthorities" id="certificateauthorities">認証局</a></h3>
+
+ <p>まず証明書の申請の情報を確認することで、
+ 認証局は秘密鍵の持ち主の身元を保証します。
+ 例えば、アリスが個人証明書を申請したとすると、
+ 認証局はアリスが証明書の申請が主張する通りの
+ 人物だということを確認しなくてはいけません。</p>
+
+ <h4><a name="certificatechains" id="certificatechains">証明書階層構造</a></h4>
+
+ <p>認証局は他の認証局への証明書を発行することができます。
+ 未知の証明書を調べる時に、アリスはその証明書の発行者
+ に自信が持てるまで、発行者の証明書を
+ その上位階層の認証局をたどって調べる必要があります。
+ 「悪質な」証明書の危険性を減らすため、
+ 彼女は限られた連鎖の発行者のみ信頼するように
+ 決めることもできます。</p>
+
+
+ <h4><a name="rootlevelca" id="rootlevelca">最上位認証局の作成</a></h4>
+
+ <p>前に述べたように、全ての証明書について、
+ 最上位の認証局(CA)までそれぞれの発行者が
+ 対象の身元証明の有効性を明らかにする必要があります。
+ 問題は、誰がその最上位の認証機関の証明書を保証するのか、
+ ということです。
+ このような場合に限り、証明書は「自己署名」されます。
+ つまり、証明書の発行者と証明対象が同じということになります。
+ その結果、自己署名された証明書を信用するには
+ 細心の注意が必要です。
+ 最上位認証局が公開鍵を広く公表することで、
+ その鍵を信頼するリスクを低くすることができます。
+ もし、他人がその認証局になりすました時に、それが露見しや
+ すいからです。
+ 多くのブラウザは有名な認証局を信頼するように
+ 設定されています。</p>
+
+ <p><a href="http://www.thawte.com/">Thawte</a>
+ や <a href="http://www.verisign.com/">VeriSign</a>
+ のような多くの会社が認証局として開設しました。
+ このような会社は以下のサービスを提供します:</p>
+
+ <ul>
+ <li>証明書申請の確認</li>
+ <li>証明書申請の処理</li>
+ <li>証明書の発行と管理</li>
+ </ul>
+
+ <p>自分で認証局を作ることも可能です。
+ インターネット環境では危険ですが、
+ 個人やサーバの身元証明が簡単に行える組織の
+ イントラネット内では役に立つかもしれません。</p>
+
+
+ <h4><a name="certificatemanagement" id="certificatemanagement">証明書管理</a></h4>
+
+ <p>認証局の開設は徹底した管理、技術、運用の体制を必要とする
+ 責任のある仕事です。
+ 認証局は証明書を発行するだけでなく、
+ 管理もしなければなりません。
+ 具体的には、証明書がいつまで有効かを決定し、更新し、
+ また既に発行されたが失効した証明書のリスト
+ (Certificate Revocation Lists または CRL)
+ を管理しなければいけません。
+ 例えば、アリスが会社から社員として証明書を与えられたとします。
+ そして、アリスが会社を辞めるときには証明書を取り消さなければ
+ いけないとします。
+ 証明書は次々と人に渡されていくものなので、
+ 証明書そのものから、それが取り消されたか判断することは
+ 不可能です。
+ よって、証明書の有効性を調べるときには、
+ 認証局に連絡して CRL を照合する必要があります。
+ 普通この過程は自動化されているものではありません。</p>
+
+ <div class="note"><h3>注意</h3>
+ <p>デフォルトでブラウザに設定されていない認証局を使った場合、
+ 認証局の証明書をブラウザに読み込んで、
+ ブラウザがその認証局によって署名されたサーバの証明書を
+ 有効化する必要があります。
+ 一度読み込まれると、その認証局によって署名された全ての
+ 証明書を受け入れるため、危険を伴います。</p>
+ </div>
+
+
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="ssl" id="ssl">Secure Sockets Layer (SSL)</a></h2>
+
+<p>Secure Sockets Layer プロトコルは信頼性のあるコネクション型の
+ネットワーク層のプロトコル(例えば、TCP/IP)と
+アプリケーション層のプロトコル(例えば、HTTP)
+の間に置くことができます。
+SSL は、相互認証によってサーバとクライアント間の安全な通信を、
+電子署名によってデータの完全性を、
+そして暗号化によってプライバシを提供します。</p>
+
+<p>SSL プロトコルは暗号化、ダイジェスト、電子署名について、
+様々なアルゴリズムをサポートするようにできています。
+こうすることで、法や輸出の規制を考慮に入れて、サーバに合わせた
+アルゴリズムを選ぶことができ、また、新しいアルゴリズムを
+利用していくことも可能にしています。
+アルゴリズムの選択はプロトコルセッション開始時に
+サーバとクライアント間で取り決められます。</p>
+
+<h3><a name="table4" id="table4">表4: SSL プロトコルのバージョン</a></h3>
+
+ <table class="bordered">
+
+ <tr><th>バージョン</th>
+ <th>出典</th>
+ <th>説明</th>
+ <th>ブラウザのサポート</th></tr>
+ <tr><td>SSL v2.0</td>
+ <td>Vendor Standard (Netscape Corp. より) [<a href="#SSL2">SSL2</a>]</td>
+ <td>実装が現存する初めての SSL プロトコル</td>
+ <td>- NS Navigator 1.x/2.x<br />
+ - MS IE 3.x<br />
+ - Lynx/2.8+OpenSSL</td></tr>
+ <tr><td>SSL v3.0</td>
+ <td>Expired Internet Draft (Netscape Corp. より) [<a href="#SSL3">SSL3</a>]</td>
+ <td>特定のセキュリティ攻撃を防ぐための改訂、
+ 非RSA 暗号の追加、証明書階層構造のサポート</td>
+ <td>- NS Navigator 2.x/3.x/4.x<br />
+ - MS IE 3.x/4.x<br />
+ - Lynx/2.8+OpenSSL</td></tr>
+ <tr><td>TLS v1.0</td>
+ <td>Proposed Internet Standard (IETF より) [<a href="#TLS1">TLS1</a>]</td>
+ <td>MAC レイヤを HMAC へ更新、ブロック暗号の block
+ padding、メッセージ順序の標準化、警告文の充実などのため
+ SSL 3.0 を改訂。</td>
+ <td>- Lynx/2.8+OpenSSL</td></tr>
+ </table>
+
+
+<p><a href="#table4">表4</a>に示されるとおり、SSL プロトコルには
+いくつものバージョンがあります。
+表にも書かれているように、SSL 3.0 の利点の一つは
+証明書階層構造をサポートすることです。
+この機能によって、サーバは自分の証明書に加えて、
+発行者の証明書をブラウザに渡すことができます。
+証明書階層構造によって、
+ブラウザに発行者の証明書が直接登録されていなくても、
+階層の中に含まれていれば、
+ブラウザはサーバの証明書を有効化することができます。
+SSL 3.0 は現在 Internet Engineering Task Force (IETF)
+によって開発されている Transport Layer Security
+[<a href="#TLS1">TLS</a>] プロトコル標準規格の基礎となっています。</p>
+
+<h3><a name="session" id="session">セッションの確立</a></h3>
+
+ <p><a href="#figure1">図1</a>で示されるように、
+ セッションの確立はクライアントとサーバ間の
+ ハンドシェークシークエンスによって行なわれます。
+ サーバが証明書を提供するか、クライアントの証明書をリクエストするか
+ というサーバの設定により、このシークエンスは異なるものとなります。
+ 暗号情報の管理のために、追加のハンドシェーク過程が必要になる
+ 場合もありますが、この記事では
+ よくあるシナリオを手短に説明します。
+ 全ての可能性についは、SSL 仕様書を参照してください。</p>
+
+ <div class="note"><h3>注意</h3>
+ <p>一度 SSL セッションが確立すると、セッションを再利用することで、
+ セッションを開始するための多くの過程を繰り返すという
+ パフォーマンスの損失を防ぎます。
+ そのため、サーバは全てのセッションに一意なセッション識別名を
+ 割り当て、サーバにキャッシュし、クライアントは次回から
+ (識別名がサーバのキャッシュで期限切れになるまでは)
+ ハンドシェークなしで接続することができます。</p>
+ </div>
+
+ <p class="figure">
+ <img src="../images/ssl_intro_fig1.gif" alt="" width="423" height="327" /><br />
+ <a id="figure1" name="figure1"><dfn>図1</dfn></a>: SSL
+ ハンドシェークシークエンス概略</p>
+
+ <p>サーバとクライアントで使われる
+ ハンドシェークシークエンスの要素を以下に示します:</p>
+
+ <ol>
+ <li>データ通信に使われる暗号スイートの取り決め</li>
+ <li>クライアントとサーバ間でのセッション鍵の確立と共有</li>
+ <li>オプションとして、クライアントに対するサーバの認証</li>
+ <li>オプションとして、サーバに対するクライアントの認証</li>
+ </ol>
+
+ <p>第一ステップの暗号スイート取り決めによって、
+ サーバとクライアントはそれぞれにあった
+ 暗号スイートを選ぶことができます。
+ SSL3.0 プロトコルの仕様書は 31 の暗号スイートを定義しています。
+ 暗号スイートは以下のコンポーネントにより定義されています:</p>
+
+ <ul>
+ <li>鍵の交換手段</li>
+ <li>データ通信の暗号術</li>
+ <li>Message Authentication Code (MAC) 作成のための
+ メッセージダイジェスト</li>
+ </ul>
+
+ <p>これらの三つの要素は以下のセクションで説明されています。</p>
+
+
+<h3><a name="keyexchange" id="keyexchange">鍵の交換手段</a></h3>
+
+ <p>鍵の交換手段はアプリケーションのデータ通信に使われ、
+ 共有される対称暗号鍵をどのようにがクライアントとサーバで
+ 取り決めるかを定義します。
+ SSL 2.0 は RSA 鍵交換しか使いませんが、
+ SSL 3.0 は証明書が使われるときは RSA 鍵交換を使い、
+ 証明書が無く、クライアントとサーバの事前の通信が無い場合は
+ Diffie-Hellman 鍵交換を使う
+ など様々な鍵交換アルゴリズムをサポートします。</p>
+
+ <p>鍵の交換方法における一つの選択肢は電子署名です。
+ 電子署名を使うかどうか、また、
+ どの種類の署名を使うかという選択があります。
+ 秘密鍵で署名することで共有鍵を生成すし、情報交換する時の
+ マン・イン・ザ・ミドル攻撃を防ぐことができます。
+ [<a href="#AC96">AC96</a>, p516]</p>
+
+
+<h3><a name="ciphertransfer" id="ciphertransfer">データ通信の暗号術</a></h3>
+
+ <p>SSL はセッションのメッセージの暗号化に前述した
+ 従来型暗号(対称暗号)を用います。
+ 暗号化しないという選択肢も含め九つの選択肢があります:</p>
+
+ <ul>
+ <li>暗号化なし</li>
+ <li>ストリーム暗号
+ <ul>
+ <li>40-bit 鍵での RC4</li>
+ <li>128-bit 鍵での RC4</li>
+ </ul></li>
+ <li>CBC ブロック暗号
+ <ul><li>40 bit 鍵での RC2</li>
+ <li>40 bit 鍵での DES</li>
+ <li>56 bit 鍵での DES</li>
+ <li>168 bit 鍵での Triple-DES</li>
+ <li>Idea (128 bit 鍵)</li>
+ <li>Fortezza (96 bit 鍵)</li>
+ </ul></li>
+ </ul>
+
+ <p>ここでの CBC とは暗号ブロック連鎖 (Cipher Block Chaining)
+ の略で、一つ前の暗号化された暗号文の一部が
+ ブロックの暗号化に使われることを意味します。
+ DES はデータ暗号化標準規格 (Data Encryption Standard)
+ [<a href="#AC96">AC96</a>, ch12] の略で、
+ DES40 や 3DES_EDE を含むいくつもの種類があります。
+ Idea は最高なものの一つで、暗号術的には現在ある中で
+ 最も強力なものです。
+ RC2 は RSA DSI による独占的なアルゴリズムです。
+ [<a href="#AC96">AC96</a>,
+ ch13]</p>
+
+
+<h3><a name="digestfuntion" id="digestfuntion">ダイジェスト関数</a></h3>
+
+ <p>
+ ダイジェスト関数の選択はレコードユニットからどのようにダイジェストが生成されるかを決定します。
+ SSL は以下をサポートします:</p>
+
+ <ul>
+ <li>ダイジェストなし</li>
+ <li>MD5 (128-bit ハッシュ)</li>
+ <li>Secure Hash Algorithm (SHA-1) (160-bit ハッシュ)</li>
+ </ul>
+
+ <p>メッセージダイジェストは Message Authentication Code (MAC)
+ の生成に使われ、メッセージと共に暗号化され、メッセージの信用を
+ 提供し、リプレイ攻撃を防ぎます。</p>
+
+
+<h3><a name="handshake" id="handshake">ハンドシェークシークエンスプロトコル</a></h3>
+
+ <p>ハンドシェークシークエンスは三つのプロトコルを使います:</p>
+
+ <ul>
+ <li><dfn>SSL ハンドシェークプロトコル</dfn>は
+ クライアントとサーバ間での SSL セッションの確立に使われます。</li>
+ <li><dfn>SSL 暗号仕様変更プロトコル</dfn>は
+ セッションでの暗号スイートの取り決めに使われます。</li>
+ <li><dfn>SSL 警告プロトコル</dfn>は
+ クライアントサーバ間で SSL エラーを伝達するのに使われます。</li>
+ </ul>
+
+ <p>三つのプロトコルは、アプリケーションプロトコルデータとともに、
+ <a href="#figure2">図2</a>に示すとおり <dfn>SSL レコードプロトコル</dfn>
+ でカプセル化されます。
+ カプセル化されたプロトコルはデータを検査しない
+ 下層のプロトコルによってデータとして伝達されます。
+ カプセル化されたプロトコルは下層のプロトコルに関して一切関知しません。</p>
+
+ <p class="figure">
+ <img src="../images/ssl_intro_fig2.gif" alt="" width="428" height="217" /><br />
+ <a id="figure2" name="figure2"><dfn>図2</dfn></a>: SSL プロトコルスタック
+ </p>
+
+ <p>
+ レコードプロトコルによる SSL コントロールプロトコルのカプセル化は、
+ アクティブなセッションの二回目の通信があった場合、
+ コントロールプロトコルが安全であることを意味します。
+ 既にセッションが無い場合は、Null 暗号スイートが使われ、
+ 暗号化は行なわれず、セッションが確立するまでは
+ ダイジェストも無い状態となります。</p>
+
+
+<h3><a name="datatransfer" id="datatransfer">データ通信</a></h3>
+
+ <p><a href="#figure3">図3</a>に示される SSL レコードプロトコル
+ はクライアントとサーバ間のアプリケーションや
+ SSL コントロールデータの通信に使われます。
+ このデータはより小さいユニットに分けられたり、
+ いくつかの高級プロトコルをまとめて一ユニットとして通信が
+ 行なわれることもあります。
+ データを圧縮し、ダイジェスト署名を添付して、
+ これらのユニットを暗号化したのち、ベースとなっている
+ 信頼性のあるトランスポートプロトコルを用いるかもしれません。
+ (注意: 現在メジャーな SLL 実装で圧縮をサポートしているものはありません)</p>
+
+ <p class="figure">
+ <img src="../images/ssl_intro_fig3.gif" alt="" width="423" height="323" /><br />
+ <a id="figure3" name="figure3"><dfn>図 3</dfn></a>: SSL レコードプロトコル
+ </p>
+
+
+<h3><a name="securehttp" id="securehttp">HTTP 通信の安全化</a></h3>
+
+ <p>よくある SSL の使い方はブラウザとウェブサーバ間の HTTP 通信
+ の安全化です。
+ これは、従来の安全ではない HTTP の使用を除外するものではありません。
+ 安全化されたものは主に SSH 上の普通の HTTP で、HTTPS と呼ばれます。
+ 大きな違いは、URL スキームに <code>http</code> の代わりに <code>https</code>
+ を用い、サーバが別のポートを使うことです (デフォルトでは443)。
+ これが主に <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> が Apache ウェブサーバに提供する機能です。</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="references" id="references">参考文献</a></h2>
+
+<dl>
+<dt><a id="AC96" name="AC96">[AC96]</a></dt>
+<dd>Bruce Schneier, <q>Applied Cryptography</q>, 2nd Edition, Wiley,
+1996. See <a href="http://www.counterpane.com/">http://www.counterpane.com/</a> for various other materials by Bruce
+Schneier.</dd>
+
+<dt><a id="X208" name="X208">[X208]</a></dt>
+<dd>ITU-T Recommendation X.208, <q>Specification of Abstract Syntax Notation
+One (ASN.1)</q>, 1988. See for instance <a href="http://www.itu.int/rec/recommendation.asp?type=items&amp;lang=e&amp;parent=T-REC-X.208-198811-I">http://www.itu.int/rec/recommendation.asp?type=items&amp;lang=e&amp;parent=T-REC-X.208-198811-I</a>.
+</dd>
+
+<dt><a id="X509" name="X509">[X509]</a></dt>
+<dd>ITU-T Recommendation X.509, <q>The Directory - Authentication
+Framework</q>. See for instance <a href="http://www.itu.int/rec/recommendation.asp?type=folders&amp;lang=e&amp;parent=T-REC-X.509">http://www.itu.int/rec/recommendation.asp?type=folders&amp;lang=e&amp;parent=T-REC-X.509</a>.
+</dd>
+
+<dt><a id="PKCS" name="PKCS">[PKCS]</a></dt>
+<dd><q>Public Key Cryptography Standards (PKCS)</q>,
+RSA Laboratories Technical Notes, See <a href="http://www.rsasecurity.com/rsalabs/pkcs/">http://www.rsasecurity.com/rsalabs/pkcs/</a>.</dd>
+
+<dt><a id="MIME" name="MIME">[MIME]</a></dt>
+<dd>N. Freed, N. Borenstein, <q>Multipurpose Internet Mail Extensions
+(MIME) Part One: Format of Internet Message Bodies</q>, RFC2045.
+See for instance <a href="http://ietf.org/rfc/rfc2045.txt">http://ietf.org/rfc/rfc2045.txt</a>.</dd>
+
+<dt><a id="SSL2" name="SSL2">[SSL2]</a></dt>
+<dd>Kipp E.B. Hickman, <q>The SSL Protocol</q>, 1995. See <a href="http://www.netscape.com/eng/security/SSL_2.html">http://www.netscape.com/eng/security/SSL_2.html</a>.</dd>
+
+<dt><a id="SSL3" name="SSL3">[SSL3]</a></dt>
+<dd>Alan O. Freier, Philip Karlton, Paul C. Kocher, <q>The SSL Protocol
+Version 3.0</q>, 1996. See <a href="http://www.netscape.com/eng/ssl3/draft302.txt">http://www.netscape.com/eng/ssl3/draft302.txt</a>.</dd>
+
+<dt><a id="TLS1" name="TLS1">[TLS1]</a></dt>
+<dd>Tim Dierks, Christopher Allen, <q>The TLS Protocol Version 1.0</q>,
+1999. See <a href="http://ietf.org/rfc/rfc2246.txt">http://ietf.org/rfc/rfc2246.txt</a>.</dd>
+</dl>
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="../en/ssl/ssl_intro.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="../ja/ssl/ssl_intro.html" title="Japanese">&nbsp;ja&nbsp;</a></p>
+</div><div id="footer">
+<p class="apache">Copyright 2006 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="../mod/">モジュール</a> | <a href="../mod/directives.html">ディレクティブ</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">用語</a> | <a href="../sitemap.html">サイトマップ</a></p></div>
+</body></html> \ No newline at end of file
generated by cgit v1.2.3 (git 2.46.0) at 2025-10-30 23:51:59 +0000