ITS#7645, #5655 TLSProtocolMin docs

diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5
index c0bdfac5b16343f78c1865de8efa99604fb8f600..7f5bc64711e426c9bc7d2382f440dc553c1523da 100644 (file)
--- a/doc/man/man5/ldap.conf.5
+++ b/doc/man/man5/ldap.conf.5
@@ -413,7 +413,11 @@ If the server doesn't support at least that version,
 the SSL handshake will fail.
 To require TLS 1.x or higher, set this option to 3.(x+1),
 e.g.,
-.B TLS_PROTOCOL_MIN 3.2
+
+.nf
+       TLS_PROTOCOL_MIN 3.2
+.fi
+
 would require TLS 1.1.
 Specifying a minimum that is higher than that supported by the
 OpenLDAP implementation will result in it requiring the

diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5
index 560285125643c922f92d577bf91e439e14738c0d..af8beb33a7758bce604213f73507e4d1d925b7f5 100644 (file)
--- a/doc/man/man5/slapd-config.5
+++ b/doc/man/man5/slapd-config.5
@@ -928,6 +928,23 @@ from the default, otherwise no certificate exchanges or verification will
 be done. When using GnuTLS or Mozilla NSS these parameters are always generated randomly
 so this directive is ignored.
 .TP
+.B olcTLSProtocolMin: <major>[.<minor>]
+Specifies minimum SSL/TLS protocol version that will be negotiated.
+If the server doesn't support at least that version,
+the SSL handshake will fail.
+To require TLS 1.x or higher, set this option to 3.(x+1),
+e.g.,
+
+.nf
+       olcTLSProtocolMin: 3.2
+.fi
+
+would require TLS 1.1.
+Specifying a minimum that is higher than that supported by the
+OpenLDAP implementation will result in it requiring the
+highest level that it does support.
+This directive is ignored with GnuTLS.
+.TP
 .B olcTLSRandFile: <filename>
 Specifies the file to obtain random bits from when /dev/[u]random
 is not available.  Generally set to the name of the EGD/PRNGD socket.

diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5
index 8eb1dc9d29e71087a4c58708595fede5c5d4fb8c..70116df6ca304a28ecc849b0998ed4ca3f83b7e1 100644 (file)
--- a/doc/man/man5/slapd.conf.5
+++ b/doc/man/man5/slapd.conf.5
@@ -1159,6 +1159,23 @@ from the default, otherwise no certificate exchanges or verification will
 be done. When using GnuTLS these parameters are always generated randomly so
 this directive is ignored.  This directive is ignored when using Mozilla NSS.
 .TP
+.B TLSProtocolMin <major>[.<minor>]
+Specifies minimum SSL/TLS protocol version that will be negotiated.
+If the server doesn't support at least that version,
+the SSL handshake will fail.
+To require TLS 1.x or higher, set this option to 3.(x+1),
+e.g.,
+
+.nf
+       TLSProtocolMin 3.2
+.fi
+
+would require TLS 1.1.
+Specifying a minimum that is higher than that supported by the
+OpenLDAP implementation will result in it requiring the
+highest level that it does support.
+This directive is ignored with GnuTLS.
+.TP
 .B TLSRandFile <filename>
 Specifies the file to obtain random bits from when /dev/[u]random
 is not available.  Generally set to the name of the EGD/PRNGD socket.