Skip to content

Commit 42344a9

Browse files
icingicing
committed
update mod_md documentation now in line with trunk
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1926086 13f79535-47bb-0310-9956-ffa450edef68
1 parent 4fc2ac2 commit 42344a9

File tree

1 file changed

+86
-4
lines changed

1 file changed

+86
-4
lines changed

‎docs/manual/mod/mod_md.xml‎

Lines changed: 86 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
ACME protocol (<a href="https://tools.ietf.org/html/rfc8555">RFC 8555</a>).
3838
Certificates will be renewed by the module ahead of their expiration to account
3939
for disruption in internet services. There are ways to monitor the status of all
40-
certififcates managed this way and configurations that will run your own
40+
certificates managed this way and configurations that will run your own
4141
notification commands on renewal, expiration and errors.
4242
</p><p>
4343
Second, mod_md offers an alternate OCSP Stapling implementation. This works with
@@ -495,7 +495,7 @@ MDomain example2.org auto
495495
For testing, CAs commonly offer a second service URL.
496496
The 'test' service does not give certificates valid in a browser,
497497
but are more relaxed in regard to rate limits.
498-
This allows for verfication of your own setup before switching
498+
This allows for verification of your own setup before switching
499499
to the production service URL.
500500
</p>
501501
<example><title>LE Test Setup</title>
@@ -1299,7 +1299,7 @@ MDMessageCmd /etc/apache/md-message
12991299

13001300
<directivesynopsis>
13011301
<name>MDCertificateCheck</name>
1302-
<description>Set name and URL pattern for a certificate monitoring sitSet name and URL pattern for a certificate monitoring sitee</description>
1302+
<description>Set name and URL pattern for a certificate monitoring site.</description>
13031303
<syntax>MDCertificateCheck <var>name</var> <var>url</var></syntax>
13041304
<contextlist>
13051305
<context>server config</context>
@@ -1369,7 +1369,7 @@ MDMessageCmd /etc/apache/md-message
13691369
<p>
13701370
You can configure those globally or for a specific MDomain. Since
13711371
these values allow anyone to register under the same account, it is
1372-
adivsable to give the configuration file restricted permissions,
1372+
advisable to give the configuration file restricted permissions,
13731373
e.g. root only.
13741374
</p>
13751375
<p>
@@ -1512,4 +1512,86 @@ MDMessageCmd /etc/apache/md-message
15121512
</usage>
15131513
</directivesynopsis>
15141514

1515+
<directivesynopsis>
1516+
<name>MDCheckInterval</name>
1517+
<description>Determines how often certificates are checked</description>
1518+
<syntax>MDCheckInterval <var>duration</var></syntax>
1519+
<default>MDCheckInterval 12h</default>
1520+
<contextlist>
1521+
<context>server config</context>
1522+
</contextlist>
1523+
<compatibility>Available in version 2.4.60 and later</compatibility>
1524+
<usage>
1525+
<p>
1526+
The time between certificate checks. By default, the validity
1527+
and need for renewals is checked twice a day. This interval is
1528+
not followed precisely. Instead the module randomly applies
1529+
a +/-50% jitter to it. With the default of 12 hours, this
1530+
means the actual time between runs varies between 6 and 18
1531+
hours, jittered anew every run. This helps to mitigate
1532+
traffic peaks at ACME servers.
1533+
</p><p>
1534+
The minimum duration you may configure is 1 second. It is
1535+
not recommended to use such short times in production.
1536+
</p>
1537+
</usage>
1538+
</directivesynopsis>
1539+
1540+
<directivesynopsis>
1541+
<name>MDProfile</name>
1542+
<description>Use a specific ACME profile from the CA</description>
1543+
<syntax>MDProfile name</syntax>
1544+
<contextlist>
1545+
<context>server config</context>
1546+
</contextlist>
1547+
<compatibility>Available in version 2.4.64 and later</compatibility>
1548+
<usage>
1549+
<p>
1550+
This about a non-standard ACME extension by Let's Encrypt.
1551+
</p><p>
1552+
Lets Encrypt announced they will add Certificate Profiles
1553+
support in their CA during 2025, beginning with their staging
1554+
servers. This, among some other details, let's you select the
1555+
lifetime of the certificates you get. The "default" profile
1556+
will keep the 90 days and a "tlsserver" profile will issue
1557+
certificates with only 6 days of validity.
1558+
</p><p>
1559+
If you do not change your mod_md configuration, you will
1560+
continue to get the 90 days certificates. Should you believe
1561+
that a shorter lifetime is beneficial for you (and take the
1562+
risk that the renewal time is way shorter),
1563+
you can configure the profile to use via 'MDProfile tlsserver'.
1564+
</p><p>
1565+
The profile names are defined by the CA. If a profile you
1566+
configure is not available, no profile will be used and
1567+
the certificate will be issue according to what the CA
1568+
considers default.
1569+
</p><p>
1570+
See <directive module="mod_md">MDProfileMandatory</directive>
1571+
on how to disable defaults for profiles.
1572+
</p>
1573+
</usage>
1574+
</directivesynopsis>
1575+
1576+
<directivesynopsis>
1577+
<name>MDProfileMandatory</name>
1578+
<description>Control if an MDProfile is mandatory.</description>
1579+
<syntax>MDProfileMandatory on|off</syntax>
1580+
<default>MDProfileMandatory off</default>
1581+
<contextlist>
1582+
<context>server config</context>
1583+
</contextlist>
1584+
<usage>
1585+
<p>
1586+
Controls if a <directive module="mod_md">MDProfile</directive>
1587+
you configure is mandatory or not. When mandatory and the CA
1588+
does not offer a configured profile, the certificate
1589+
renewal will fail.
1590+
</p><p>
1591+
When not mandatory and a profile is not offered by the CA,
1592+
renewals will be performed without specifying a profile and
1593+
the CA will issue a certificates according to its defaults.
1594+
</p>
1595+
</usage>
1596+
</directivesynopsis>
15151597
</modulesynopsis>

0 commit comments

Comments
 (0)