Add OCSP softfail option

[freeradius.git] / raddb / mods-available / eap

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 26885e4..26a7f43 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -182,6 +182,30 @@
                        CA_file = ${cadir}/ca.pem
 
                        #
+                       #  If OpenSSL supports TLS-PSK, then we can use
+                       #  a PSK identity and (hex) password.  When the
+                       #  following two configuration items are specified,
+                       #  then certificate-based configuration items are
+                       #  not allowed.  e.g.:
+                       #
+                       #       private_key_password
+                       #       private_key_file
+                       #       certificate_file
+                       #       CA_file
+                       #       CA_path
+                       #
+                       #  For now, the identity is fixed, and must be the
+                       #  same on the client.  The passphrase must be a hex
+                       #  value, and can be up to 256 hex digits.
+                       #
+                       #  Future versions of the server may be able to
+                       #  look up the shared key (hexphrase) based on the
+                       #  identity.
+                       #
+               #       psk_identity = "test"
+               #       psk_hexphrase = "036363823"
+
+                       #
                        #  For DH cipher suites to work, you have to
                        #  run OpenSSL to create the DH file first:
                        #
@@ -419,6 +443,44 @@
                              #  Responder is running as a vhost.
                              #
                              url = "http://127.0.0.1/ocsp/"
+
+                             #
+                             # If the OCSP Responder can not cope with nonce
+                             # in the request, then it can be disabled here.
+                             #
+                             # For security reasons, disabling this option
+                             # is not recommended as nonce protects against
+                             # replay attacks.
+                             #
+                             # Note that Microsoft AD Certificate Services OCSP
+                             # Responder does not enable nonce by default. It is
+                             # more secure to enable nonce on the responder than
+                             # to disable it in the query here.
+                             # See http://technet.microsoft.com/en-us/library/cc770413%28WS.10%29.aspx
+                             #
+                             # use_nonce = yes
+
+                             #
+                             # Number of seconds before giving up waiting
+                             # for OCSP response. 0 uses system default.
+                             #
+                             # timeout = 0
+
+                             #
+                             # Normally an error in querying the OCSP
+                             # responder (no response from server, server did
+                             # not understand the request, etc) will result in
+                             # a validation failure.
+                             #
+                             # To treat these errors as 'soft' failures and
+                             # still accept the certificate, enable this
+                             # option.
+                             # 
+                             # Warning: this may enable clients with revoked
+                             # certificates to connect if the OCSP responder
+                             # is not available. Use with caution.
+                             #
+                             # softfail = no
                        }
                }