From 334d807b924427434b42d4fbae745d3d1b38a218 Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Tue, 10 Jan 2017 02:17:16 +0000 Subject: Types fix, first pass XXX marks what must change when skalibs changes. Also started writing functions for client certificate support in sbearssl, but it's not working yet (need more high-level support from BearSSL before it can work) --- doc/s6-tlsd.html | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) (limited to 'doc/s6-tlsd.html') diff --git a/doc/s6-tlsd.html b/doc/s6-tlsd.html index 16f13ec..cda5038 100644 --- a/doc/s6-tlsd.html +++ b/doc/s6-tlsd.html @@ -146,13 +146,6 @@ one per file, DER- or PEM-encoded. of trust anchors, PEM-encoded. -

-Please note that for now, support for client -certificates is experimental, and only works -with the LibreSSL -backend (BearSSL does not support client certificates yet). -

-

If s6-tlsd is run as root, it can also read two more environment variables, TLS_UID and TLS_GID, @@ -251,9 +244,10 @@ This is the default. and break the connection when prog sends EOF.

  • -s : transmit EOF by half-closing the TCP connection without using close_notify. This is the default.
    • -
  • -Y : Do not require a client certificate. This is the default.
    • -
  • -y : Require a client certificate. This is experimental and -for now unsupported by BearSSL.
    • +
  • -Y : Require an optional client certificate.
    • +
  • -y : Require a mandatory client certificate. +The default, with neither the -Y nor the -y option, +is not to require a client certificate at all.
  • -K kimeout : close the connection if kimeout milliseconds elapse without any data being received from either side. The default is 0, which means -- cgit v1.3.1