On Thu, Jan 7, 2010 at 5:20 PM, Lou Picciano <[email protected]> wrote: > Kyle, > > Meanwhile, as we now gird our loins for the impending reversion of many big > apps on our servers (only to re-implement updates when openSSL 0.0.8m > becomes available!), is there any tweaking of a simple SSL-enabled Apache > /Directory we might be able to do to bypass the renegotiation? I'm > anticipating your answer to be 'no', as a renegotiation is required at load > of any object in the site, correct? > > Many thanks in advance. Lou
I honestly don't know. You would do better asking on an Apache support list, I think; most of us don't know the Apache codebase (or mod_ssl's requirements on the library) at all. I *think* you might be able to do it at a /VirtualHost level, for the https server, as long as you get rid of any SSL configuration statements (other than SSLRequire SSL) in the /Directory clauses. (Use the highest security you need, and disable renegotiation.) -Kyle H ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
