"Diego Castillo" <[EMAIL PROTECTED]> writes:
> I have just installed mod_ssl to my Apache 1.3.22 server. I have created a
> self-signed certificate and I manage to connect to the server on HTTPS.
>
> The point is that I just wanted to encrypt the connection, I do not require
> to authenticate the server. Is there any way to activate TSL v1 without
> implementing SSL v2?
>
> I have tried commenting out the SSLCertificateFile and SSLCertificateKeyFile
> directives, but Apache refuses to start-up. Can anybody help me?
Let's take a step back:
There are two ways to do SSL/TLS without authentication:
(1) Truly without authentication: use anonymous Diffie-Hellman.
This has a number of downsides:
(a) It's only supported in TLS/SSLv3.
(b) You need to specially turn it on in the server.
(c) Very few clients support it. Even if your client
implementation supports it, few clients turn it on.
(2) Use a self-signed cert. This doesn't really give you
authentication but it lets you use the same ciphersuites
as if you had a real signed cert. This is what most
people use if they don't care about server authentication.
You can use a self-signed cert with SSLv2, SSLv3, or TLS,
but you need to provde it to the server using the same
conf file settings as a real cert.
>From what you say it sounds like you really want to do (2),
in which case you need to uncomment the SSLCertificateFile etc.
and point them at your cert and key.
-Ekr
--
[Eric Rescorla [EMAIL PROTECTED]]
Author of "SSL and TLS: Designing and Building Secure Systems"
http://www.rtfm.com/
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
