summaryrefslogtreecommitdiffstats
path: root/crypto/openssl/doc/ssl
diff options
context:
space:
mode:
authorjkim <jkim@FreeBSD.org>2014-10-15 19:59:43 +0000
committerjkim <jkim@FreeBSD.org>2014-10-15 19:59:43 +0000
commit0b5b22505e1ef2430c5c6add5faa65f35be97ad4 (patch)
tree97eced83822374c92f4921f85ffbe3d7a5208843 /crypto/openssl/doc/ssl
parent44cc4e9f2029f7ca83413a801230adbf8e00915d (diff)
downloadFreeBSD-src-0b5b22505e1ef2430c5c6add5faa65f35be97ad4.zip
FreeBSD-src-0b5b22505e1ef2430c5c6add5faa65f35be97ad4.tar.gz
MFC: r273144, r273146
Merge OpenSSL 1.0.1j. Relnotes: yes
Diffstat (limited to 'crypto/openssl/doc/ssl')
-rw-r--r--crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod15
1 files changed, 8 insertions, 7 deletions
diff --git a/crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod b/crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod
index b34c68a..7a27eef 100644
--- a/crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod
+++ b/crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod
@@ -48,12 +48,13 @@ even if he gets hold of the normal (certified) key, as this key was
only used for signing.
In order to perform a DH key exchange the server must use a DH group
-(DH parameters) and generate a DH key. The server will always generate a new
-DH key during the negotiation, when the DH parameters are supplied via
-callback and/or when the SSL_OP_SINGLE_DH_USE option of
-L<SSL_CTX_set_options(3)|SSL_CTX_set_options(3)> is set. It will
-immediately create a DH key, when DH parameters are supplied via
-SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. In this case,
+(DH parameters) and generate a DH key.
+The server will always generate a new DH key during the negotiation
+if either the DH parameters are supplied via callback or the
+SSL_OP_SINGLE_DH_USE option of SSL_CTX_set_options(3) is set (or both).
+It will immediately create a DH key if DH parameters are supplied via
+SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set.
+In this case,
it may happen that a key is generated on initialization without later
being needed, while on the other hand the computer time during the
negotiation is being saved.
@@ -139,7 +140,7 @@ partly left out.)
dh_tmp = dh_512;
break;
case 1024:
- if (!dh_1024)
+ if (!dh_1024)
dh_1024 = get_dh1024();
dh_tmp = dh_1024;
break;
OpenPOWER on IntegriCloud