Update ticket callback docs.

[oweals/openssl.git] / doc / ssl / SSL_CONF_cmd.pod

diff --git a/doc/ssl/SSL_CONF_cmd.pod b/doc/ssl/SSL_CONF_cmd.pod
index c57bf80109b60ee94937cb67d58f19f74fe21370..f96d8d941d26ee858100ed3c9b40964d5802f937 100644 (file)
--- a/doc/ssl/SSL_CONF_cmd.pod
+++ b/doc/ssl/SSL_CONF_cmd.pod
@@ -29,7 +29,7 @@ or to process defaults.
 
 Currently supported B<cmd> names for command lines (i.e. when the
 flag B<SSL_CONF_CMDLINE> is set) are listed below. Note: all B<cmd> names
-and are case sensitive. Unless otherwise stated commands can be used by
+are case sensitive. Unless otherwise stated commands can be used by
 both clients and servers and the B<value> parameter is not used. The default
 prefix for command line commands is B<-> and that is reflected below.
 
@@ -91,8 +91,8 @@ associated with B<cctx>.
 =item B<-cert>
 
 Attempts to use the file B<value> as the certificate for the appropriate
-context. It currently uses SSL_CTX_use_cerificate_chain_file if an B<SSL_CTX>
-structure is set or SSL_use_certifcate_file with filetype PEM if an B<SSL>
+context. It currently uses SSL_CTX_use_certificate_chain_file() if an B<SSL_CTX>
+structure is set or SSL_use_certificate_file() with filetype PEM if an B<SSL>
 structure is set. This option is only supported if certificate operations
 are permitted.
 
@@ -103,6 +103,12 @@ context. This option is only supported if certificate operations
 are permitted. Note: if no B<-key> option is set then a private key is
 not loaded: it does not currently use the B<-cert> file.
 
+=item B<-dhparam>
+
+Attempts to use the file B<value> as the set of temporary DH parameters for
+the appropriate context. This option is only supported if certificate
+operations are permitted.
+
 =item B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
 
 Disables protocol support for SSLv2, SSLv3, TLS 1.0, TLS 1.1 or TLS 1.2 
@@ -127,6 +133,10 @@ Use server and not client preference order when determining which cipher suite,
 signature algorithm or elliptic curve to use for an incoming connection.
 Equivalent to B<SSL_OP_CIPHER_SERVER_PREFERENCE>. Only used by servers.
 
+=item B<-no_resumption_on_reneg>
+
+set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag. Only used by servers.
+
 =item B<-legacyrenegotiation>
 
 permits the use of unsafe legacy renegotiation. Equivalent to setting
@@ -156,7 +166,7 @@ B<-DOPENSSL_SSL_DEBUG_BROKEN_PROTOCOL>.
 
 Currently supported B<cmd> names for configuration files (i.e. when the
 flag B<SSL_CONF_FLAG_FILE> is set) are listed below. All configuration file
-B<cmd> names and are case insensitive so B<signaturealgorithms> is recognised
+B<cmd> names are case insensitive so B<signaturealgorithms> is recognised
 as well as B<SignatureAlgorithms>. Unless otherwise stated the B<value> names
 are also case insensitive.
 
@@ -173,8 +183,8 @@ associated with B<cctx>.
 =item B<Certificate>
 
 Attempts to use the file B<value> as the certificate for the appropriate
-context. It currently uses SSL_CTX_use_cerificate_chain_file if an B<SSL_CTX>
-structure is set or SSL_use_certifcate_file with filetype PEM if an B<SSL>
+context. It currently uses SSL_CTX_use_certificate_chain_file() if an B<SSL_CTX>
+structure is set or SSL_use_certificate_file() with filetype PEM if an B<SSL>
 structure is set. This option is only supported if certificate operations
 are permitted.
 
@@ -185,6 +195,17 @@ context. This option is only supported if certificate operations
 are permitted. Note: if no B<-key> option is set then a private key is
 not loaded: it does not currently use the B<Certificate> file.
 
+=item B<ServerInfoFile>
+
+Attempts to use the file B<value> in the "serverinfo" extension using the
+function SSL_CTX_use_serverinfo_file.
+
+=item B<DHParameters>
+
+Attempts to use the file B<value> as the set of temporary DH parameters for
+the appropriate context. This option is only supported if certificate
+operations are permitted.
+
 =item B<SignatureAlgorithms>
 
 This sets the supported signature algorithms for TLS v1.2. For clients this
@@ -275,6 +296,9 @@ determining which cipher suite, signature algorithm or elliptic curve
 to use for an incoming connection.  Equivalent to
 B<SSL_OP_CIPHER_SERVER_PREFERENCE>. Only used by servers.
 
+B<NoResumptionOnRenegotiation> set
+B<SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION> flag. Only used by servers.
+
 B<UnsafeLegacyRenegotiation> permits the use of unsafe legacy renegotiation.
 Equivalent to B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION>.
 
@@ -308,6 +332,8 @@ The value is a file name.
 
 The value is a directory name.
 
+=back
+
 =head1 NOTES
 
 The order of operations is significant. This can be used to set either defaults