From 2c5ec58cedb6d88ea1ecdee4893bba54d397aeed Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin Date: Tue, 17 Mar 2015 10:47:42 +0100 Subject: ssl: Improve documentation --- lib/ssl/doc/src/ssl.xml | 18 +++++++++--------- lib/ssl/doc/src/ssl_crl_cache.xml | 2 +- lib/ssl/doc/src/ssl_crl_cache_api.xml | 16 +++++++++------- 3 files changed, 19 insertions(+), 17 deletions(-) (limited to 'lib/ssl') diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml index c9b02d44ec..47100c0d81 100644 --- a/lib/ssl/doc/src/ssl.xml +++ b/lib/ssl/doc/src/ssl.xml @@ -94,7 +94,7 @@ {log_alert, boolean()} | {server_name_indication, hostname() | disable}

-

transportoption() = {cb_info, {CallbackModule::atom(), DataTag::atom(), ClosedTag::atom(), ErrTag:atom()}} +

transportoption() = {cb_info, {CallbackModule :: atom(), DataTag :: atom(), ClosedTag :: atom(), ErrTag:atom()}} - defaults to {gen_tcp, tcp, tcp_closed, tcp_error}. Can be used to customize the transport layer. The callback module must implement a reliable transport protocol and behave as gen_tcp and in addition have functions corresponding to @@ -303,20 +303,20 @@ fun(OtpCert :: #'OTPCertificate'{}, Event :: {bad_cert, Reason :: atom() | {revo - {crl_check, boolean() | peer | best_effort ) + {crl_check, boolean() | peer | best_effort } Perform CRL (Certificate Revocation List) verification - public_key:pkix_crls_validate/3, during the + (public_key:pkix_crls_validate/3) on all the certificates during the path validation public_key:pkix_path_validation/3 - invokation on all the certificates in the peer certificate chain. Defaults to - false. - + marker="public_key:public_key#pkix_path_validation-3">(public_key:pkix_path_validation/3) + + of the certificate chain. Defaults to false. +

peer - check is only performed on the peer certificate.

-

best_effort - if certificate revokation status can not be determined +

best_effort - if certificate revocation status can not be determined it will be accepted as valid.

The CA certificates specified for the connection will be used to @@ -326,7 +326,7 @@ fun(OtpCert :: #'OTPCertificate'{}, Event :: {bad_cert, Reason :: atom() | {revo ssl_crl_cache_api(3).

- {crl_cache, {Module::atom, {DbHandle::internal | term(), Args::list()}} + {crl_cache, {Module :: atom(), {DbHandle :: internal | term(), Args :: list()}}}

Module defaults to ssl_crl_cache with DbHandle internal and an empty argument list. The following arguments may be specified for the internal cache.

diff --git a/lib/ssl/doc/src/ssl_crl_cache.xml b/lib/ssl/doc/src/ssl_crl_cache.xml index 1ed76d3e2a..b291c7b633 100644 --- a/lib/ssl/doc/src/ssl_crl_cache.xml +++ b/lib/ssl/doc/src/ssl_crl_cache.xml @@ -29,7 +29,7 @@

Implements an internal CRL (Certificate Revocation List) cache. In addition to implementing the ssl_cache_crl_api + marker="ssl_cache_crl_api"> ssl_cache_crl_api behaviour the following functions are available.

diff --git a/lib/ssl/doc/src/ssl_crl_cache_api.xml b/lib/ssl/doc/src/ssl_crl_cache_api.xml index 24365c9f59..3f518496be 100644 --- a/lib/ssl/doc/src/ssl_crl_cache_api.xml +++ b/lib/ssl/doc/src/ssl_crl_cache_api.xml @@ -27,13 +27,15 @@ API for a SSL/TLS CRL (Certificate Revocation List) cache.

- When SSL/TLS performs certificate path validation according to - RFC 5280 it should - also perform CRL validation checks. To enable the CRL checks the application - needs access to CRLs. A database of CRLs can be set up in many different ways. - This module provides an API to integrate an arbitrary CRL cache with the erlang - ssl application. It is also used by the application itself to provide a simple - default implementation of a CRL cache. + When SSL/TLS performs certificate path validation according to + RFC 5280 + it should also perform CRL validation checks. To enable the CRL + checks the application needs access to CRLs. A database of CRLs + can be set up in many different ways. This module provides the + behavior of the API needed to integrate an arbitrary CRL cache + with the erlang ssl application. It is also used by the + application itself to provide a simple default implementation of + a CRL cache.

-- cgit v1.2.3