INSTALL: clarify 386 and no-sse2 options.

[oweals/openssl.git] / doc / ssl / SSL_CTX_set_options.pod

diff --git a/doc/ssl/SSL_CTX_set_options.pod b/doc/ssl/SSL_CTX_set_options.pod
index fded0601b566b65ba84769a7ced7df3df7c4a6e3..9a7e98c1d4146dc2312b76cb31cd82f5d3079989 100644 (file)
--- a/doc/ssl/SSL_CTX_set_options.pod
+++ b/doc/ssl/SSL_CTX_set_options.pod
@@ -112,6 +112,12 @@ vulnerability affecting CBC ciphers, which cannot be handled by some
 broken SSL implementations.  This option has no effect for connections
 using other ciphers.
 
 broken SSL implementations.  This option has no effect for connections
 using other ciphers.
 

+=item SSL_OP_TLSEXT_PADDING
+
+Adds a padding extension to ensure the ClientHello size is never between
+256 and 511 bytes in length. This is needed as a workaround for some
+implementations.
+

 =item SSL_OP_ALL
 
 All of the above bug workarounds.
 =item SSL_OP_ALL
 
 All of the above bug workarounds.


@@ -152,15 +158,7 @@ temporary/ephemeral DH parameters are used.
 
 =item SSL_OP_EPHEMERAL_RSA
 
 
 =item SSL_OP_EPHEMERAL_RSA
 

-Always use ephemeral (temporary) RSA key when doing RSA operations
-(see L<SSL_CTX_set_tmp_rsa_callback(3)|SSL_CTX_set_tmp_rsa_callback(3)>).
-According to the specifications this is only done, when a RSA key
-can only be used for signature operations (namely under export ciphers
-with restricted RSA keylength). By setting this option, ephemeral
-RSA keys are always used. This option breaks compatibility with the
-SSL/TLS specifications and may lead to interoperability problems with
-clients and should therefore never be used. Ciphers with EDH (ephemeral
-Diffie-Hellman) key exchange should be used instead.
+This option is no longer implemented and is treated as no op.

 
 =item SSL_OP_CIPHER_SERVER_PREFERENCE
 
 
 =item SSL_OP_CIPHER_SERVER_PREFERENCE
 


@@ -191,15 +189,25 @@ browser has a cert, it will crash/hang.  Works for 3.x and 4.xbeta
 =item SSL_OP_NO_SSLv2
 
 Do not use the SSLv2 protocol.
 =item SSL_OP_NO_SSLv2
 
 Do not use the SSLv2 protocol.

+As of OpenSSL 1.0.2g the B<SSL_OP_NO_SSLv2> option is set by default.

 
 =item SSL_OP_NO_SSLv3
 
 Do not use the SSLv3 protocol.
 
 =item SSL_OP_NO_SSLv3
 
 Do not use the SSLv3 protocol.

+It is recommended that applications should set this option.

 
 =item SSL_OP_NO_TLSv1
 
 Do not use the TLSv1 protocol.
 
 
 =item SSL_OP_NO_TLSv1
 
 Do not use the TLSv1 protocol.
 

+=item SSL_OP_NO_TLSv1_1
+
+Do not use the TLSv1.1 protocol.
+
+=item SSL_OP_NO_TLSv1_2
+
+Do not use the TLSv1.2 protocol.
+

 =item SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 
 When performing renegotiation as a server, always start a new session
 =item SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 
 When performing renegotiation as a server, always start a new session


@@ -250,7 +258,7 @@ Connections and renegotiation are always permitted by OpenSSL implementations.
 
 =head2 Unpatched client and patched OpenSSL server
 
 
 =head2 Unpatched client and patched OpenSSL server
 

-The initial connection suceeds but client renegotiation is denied by the
+The initial connection succeeds but client renegotiation is denied by the

 server with a B<no_renegotiation> warning alert if TLS v1.0 is used or a fatal
 B<handshake_failure> alert in SSL v3.0.
 
 server with a B<no_renegotiation> warning alert if TLS v1.0 is used or a fatal
 B<handshake_failure> alert in SSL v3.0.