ITS#8544 - Grammar and escaping fixes

[openldap] / doc / man / man5 / ldap.conf.5

diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5
index 8f7fecda1c7cdfaa6aef9352e069e388fb7db7fd..782d2b1737cfd10c7e8a8dc2843a6c47e8e3eca0 100644 (file)
--- a/doc/man/man5/ldap.conf.5
+++ b/doc/man/man5/ldap.conf.5
@@ -1,6 +1,6 @@
 .TH LDAP.CONF 5 "RELEASEDATE" "OpenLDAP LDVERSION"
 .\" $OpenLDAP$
-.\" Copyright 1998-2013 The OpenLDAP Foundation All Rights Reserved.
+.\" Copyright 1998-2017 The OpenLDAP Foundation All Rights Reserved.
 .\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
 .SH NAME
 ldap.conf, .ldaprc \- LDAP configuration file/environment variables
@@ -338,9 +338,9 @@ token name first, followed by a colon:
 .nf
        TLS_CERT my hardware device:Certificate for Sam Carter
 .fi
-Use certutil -L to list the certificates by name:
+Use certutil \-L to list the certificates by name:
 .nf
-       certutil -d /path/to/certdbdir -L
+       certutil \-d /path/to/certdbdir \-L
 .fi
 .TP
 .B TLS_KEY <filename>
@@ -358,7 +358,7 @@ database.  For example, if TLS_CACERTDIR specifies /home/scarter/.moznss as
 the location of the cert/key database, use modutil to change the password
 to the empty string:
 .nf
-       modutil -dbdir ~/.moznss -changepw 'NSS Certificate DB'
+       modutil \-dbdir ~/.moznss \-changepw 'NSS Certificate DB'
 .fi
 You must have the old password, if any.  Ignore the WARNING about the running
 browser.  Press 'Enter' for the new password.
@@ -407,6 +407,23 @@ is in the source code for Mozilla NSS in the file sslinfo.c in the structure
 .fi
 .RE
 .TP
+.B TLS_PROTOCOL_MIN <major>[.<minor>]
+Specifies minimum SSL/TLS protocol version that will be negotiated.
+If the server doesn't support at least that version,
+the SSL handshake will fail.
+To require TLS 1.x or higher, set this option to 3.(x+1),
+e.g.,
+
+.nf
+       TLS_PROTOCOL_MIN 3.2
+.fi
+
+would require TLS 1.1.
+Specifying a minimum that is higher than that supported by the
+OpenLDAP implementation will result in it requiring the
+highest level that it does support.
+This parameter is ignored with GnuTLS.
+.TP
 .B TLS_RANDFILE <filename>
 Specifies the file to obtain random bits from when /dev/[u]random is
 not available. Generally set to the name of the EGD/PRNGD socket.