From fbd4c530ba2ee2239ddb2fc839fba418a15ac557 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Julio=20S=C3=A1nchez=20Fern=C3=A1ndez?= Date: Fri, 16 Jul 1999 19:56:32 +0000 Subject: [PATCH] Document a few TLS options that do something. --- doc/man/man5/slapd.conf.5 | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 index a075970637..d502baee46 100644 --- a/doc/man/man5/slapd.conf.5 +++ b/doc/man/man5/slapd.conf.5 @@ -216,6 +216,34 @@ meaningful if you are using Kerberos authentication. Specify the maximum number of seconds (in real time) .B slapd will spend answering a search request. The default time limit is 3600. +.SH TLS OPTIONS +If +.B slapd +is build with support for Transport Layer Security, there are more options +you can specify. +.TP +.B TLSCipherSuite +Permits configuring what ciphers will be accepted and the preference order. + should be a cipher specification for OpenSSL. Example: + +TLSCipherSuite HIGH:MEDIUM:+SSLv2 + +To check what ciphers a given spec selects, use: + +openssl ciphers -v +.TP +.B TLSCertificateFile +Specifies the file that contains the +.B slapd +server certificate. +.TP +.B TLSCertificateKeyFile +Specifies the file that contains the +.B slapd +server private key that matches the certificate stored in the +.B TLSCertificateFile +file. Currently, the private key must not be protected with a password, so +it is of critical importance that it is protected carefully. .SH GENERAL BACKEND OPTIONS Options in this section only apply to the configuration file section for the backend in which they are defined. They are supported by every -- 2.39.5