On Sun, Nov 01, 1998, John Leveron wrote:
>[...]
> When doing an AuthType Basic transaction via https on a mod_ssl
> implementation of Apache, is the information sent from the browser
> encrypted via SSL? That is, "is SSL already active at the point of the
> challenge being sent to the browser, and active when the browsers returns
> the credentials the user typed" ???
>
> I am hoping it is; if not I may set up a cgi based access again.
The Basic Auth is at the HTTP level of HTTPS, so as long as no NULL cipher is
used for HTTPS the Basic Auth transaction is done encrypted, yes. The NULL
cipher you can control yourself: Per default SSLeay has it not even compiled
in. So don't panic unless you build SSLeay with -DSSL_ALLOW_ENULL. When you
compiled it this way you should at least disable the NULL cipher with
SSLRequiredCiphers (mod_ssl 2.0) or SSLCipherSuite (mod_ssl 2.1).
> Thanks! mod_ssl is working out very well for me on a fairly well-loaded
> production web server now.
Oh, thanks for this positive feedback, John.
Together with www.engelschall.com we are then at least 2 guys ;-)
OTOH without any joke: Shouldn't we setup a mod_ssl reference list somewhere
on the website where users can register there website, so others see who is
already running Apache+mod_ssl? I mean a similar list as Apache has (although
it's not up-to-date, of course), but where the registering can be done through
a HTML form. For my WML project this was interesting for the user community.
At least in the hope there are already more than we two guys who run
Apache+mod_ssl ;-)
Opinions?
Ralf S. Engelschall
[EMAIL PROTECTED]
www.engelschall.com
______________________________________________________________________
Apache Interface to SSLeay (mod_ssl) www.engelschall.com/sw/mod_ssl/
Official Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
