Fixed #5789

20 files changed, 79 insertions, 73 deletions

diff --git a/src/usr/local/www/services_captiveportal.php b/src/usr/local/www/services_captiveportal.php
index 70b1d63..b20b567 100644
--- a/src/usr/local/www/services_captiveportal.php
+++ b/src/usr/local/www/services_captiveportal.php
@@ -985,7 +985,7 @@ $section->addInput(new Form_Select(
 	'radiusvendor',
 	'Type',
 	$pconfig['radiusvendor'],
-	['default' => 'default', 'cisco' => 'cisco']
+	['default' => gettext('default'), 'cisco' => 'cisco']
 ))->setHelp('If RADIUS type is set to Cisco, in Access-Requests the value of Calling-Station-ID will be set to the client\'s IP address and the ' .
 			'Called-Station-Id to the client\'s MAC address. Default behavior is Calling-Station-Id = client\'s MAC address and ' .
 			'Called-Station-ID = pfSense\'s WAN IP address.');
@@ -1009,7 +1009,7 @@ $section->addInput(new Form_Select(
 	'radmac_format',
 	'MAC address format',
 	$pconfig['radmac_format'],
-	['default' => 'Default', 'singledash' => 'Single dash', 'ietf' => 'IETF', 'cisco' => 'Cisco', 'unformatted' => 'Unformatted']
+	['default' => 'Default', 'singledash' => gettext('Single dash'), 'ietf' => 'IETF', 'cisco' => 'Cisco', 'unformatted' => gettext('Unformatted')]
 ))->setHelp('This option changes the MAC address format used in the whole RADIUS system. Change this if you also need to change the username format for ' .
 			'RADIUS MAC authentication.' . '<br />' .
 			'Default: 00:11:22:33:44:55' . '<br />' .
diff --git a/src/usr/local/www/services_captiveportal_mac_edit.php b/src/usr/local/www/services_captiveportal_mac_edit.php
index 762c608..e71e6a4 100644
--- a/src/usr/local/www/services_captiveportal_mac_edit.php
+++ b/src/usr/local/www/services_captiveportal_mac_edit.php
@@ -233,7 +233,7 @@ $section->addInput(new Form_Select(
 	'action',
 	'Action',
 	strtolower($pconfig['action']),
-	array('pass' => 'Pass', 'block' => 'Block')
+	array('pass' => gettext('Pass'), 'block' => gettext('Block'))
 ))->setHelp('Choose what to do with packets coming from this MAC address.');
 
 $macaddress = new Form_Input(
diff --git a/src/usr/local/www/services_ntpd_gps.php b/src/usr/local/www/services_ntpd_gps.php
index f319d45..31357e0 100644
--- a/src/usr/local/www/services_ntpd_gps.php
+++ b/src/usr/local/www/services_ntpd_gps.php
@@ -245,7 +245,7 @@ $section->addInput(new Form_StaticText(
 	' to minimize clock drift if the GPS data is not valid over time. Otherwise ntpd may only use values from the unsynchronized local clock when providing time to clients.'
 ));
 
-$gpstypes = array('Custom', 'Default', 'Generic', 'Garmin', 'MediaTek', 'SiRF', 'U-Blox', 'SureGPS');
+$gpstypes = array(gettext('Custom'), gettext('Default'), 'Generic', 'Garmin', 'MediaTek', 'SiRF', 'U-Blox', 'SureGPS');
 
 $section->addInput(new Form_Select(
 	'gpstype',
diff --git a/src/usr/local/www/services_router_advertisements.php b/src/usr/local/www/services_router_advertisements.php
index 2222ca5..c841469 100644
--- a/src/usr/local/www/services_router_advertisements.php
+++ b/src/usr/local/www/services_router_advertisements.php
@@ -129,15 +129,17 @@ if (!is_array($pconfig['subnets'])) {
 	$pconfig['subnets'] = array();
 }
 
-$advertise_modes = array("disabled" => "Disabled",
-	"router" => "Router Only",
-	"unmanaged" => "Unmanaged",
-	"managed" => "Managed",
-	"assist" => "Assisted",
-	"stateless_dhcp" => "Stateless DHCP");
-$priority_modes = array("low" => "Low",
-	"medium" => "Normal",
-	"high" => "High");
+$advertise_modes = array(
+	"disabled" => 	gettext("Disabled"),
+	"router" => 	gettext("Router Only"),
+	"unmanaged" => 	gettext("Unmanaged"),
+	"managed" => 	gettext("Managed"),
+	"assist" => 	gettext("Assisted"),
+	"stateless_dhcp" => gettext("Stateless DHCP"));
+$priority_modes = array(
+	"low" => 	gettext("Low"),
+	"medium" => gettext("Normal"),
+	"high" => 	gettext("High"));
 $carplist = get_configured_carp_interface_list();
 
 $subnets_help = '<span class="help-block">' . gettext("Subnets are specified in CIDR format.  " .
diff --git a/src/usr/local/www/services_unbound_acls.php b/src/usr/local/www/services_unbound_acls.php
index bc8a7ab..7f2dc63 100644
--- a/src/usr/local/www/services_unbound_acls.php
+++ b/src/usr/local/www/services_unbound_acls.php
@@ -259,7 +259,7 @@ if ($act == "new" || $act == "edit") {
 		'aclaction',
 		'Action',
 		strtolower($pconfig['aclaction']),
-		array('allow' => 'Allow', 'deny' => 'Deny', 'refuse' => 'Refuse', 'allow snoop' => 'Allow Snoop')
+		array('allow' => gettext('Allow'), 'deny' => gettext('Deny'), 'refuse' => gettext('Refuse'), 'allow snoop' => gettext('Allow Snoop'))
 	))->setHelp($actionHelp);
 
 	$section->addInput(new Form_Input(
diff --git a/src/usr/local/www/services_unbound_advanced.php b/src/usr/local/www/services_unbound_advanced.php
index cfef93d..c50248d 100644
--- a/src/usr/local/www/services_unbound_advanced.php
+++ b/src/usr/local/www/services_unbound_advanced.php
@@ -340,11 +340,12 @@ $section->addInput(new Form_Input(
 			'The default is 0 seconds. If the minimum value kicks in, the data is cached for longer than the domain owner intended, and thus less queries are made to look up the data. ' .
 			'The 0 value ensures the data in the cache is as the domain owner intended. High values can lead to trouble as the data in the cache might not match up with the actual data anymore.');
 
+$mnt = gettext("minutes");
 $section->addInput(new Form_Select(
 	'infra_host_ttl',
 	'TTL for Host Cache Entries',
 	$pconfig['infra_host_ttl'],
-	array_combine(array("60", "120", "300", "600", "900"), array("1 minute", "2 minutes", "5 minutes", "10 minutes", "15 minutes"))
+	array_combine(array("60", "120", "300", "600", "900"), array("1 " . $mnt, "2  " . $mnt, "5  " . $mnt, "10 " . $mnt, "15 " . $mnt))
 ))->setHelp('Time to Live, in seconds, for entries in the infrastructure host cache. The infrastructure host cache contains round trip timing, lameness, and EDNS support information for DNS servers. The default value is 15 minutes.');
 
 $section->addInput(new Form_Select(
@@ -354,21 +355,23 @@ $section->addInput(new Form_Select(
 	array_combine(array("1000", "5000", "10000", "20000", "50000"), array("1000", "5000", "10000", "20000", "50000"))
 ))->setHelp('Number of infrastructure hosts for which information is cached. The default is 10,000.');
 
+$mln = gettext("million");
 $section->addInput(new Form_Select(
 	'unwanted_reply_threshold',
 	'Unwanted Reply Threshold',
 	$pconfig['unwanted_reply_threshold'],
 	array_combine(array("disabled", "5000000", "10000000", "20000000", "40000000", "50000000"),
-				  array("Disabled", "5 million", "10 million", "20 million", "40 million", "50 million"))
+				  array("Disabled", "5 " . $mln, "10 " . $mln, "20 " . $mln, "40 " . $mln, "50 " . $mln))
 ))->setHelp('If enabled, a total number of unwanted replies is kept track of in every thread. When it reaches the threshold, a defensive action is taken ' .
 			'and a warning is printed to the log file. This defensive action is to clear the RRSet and message caches, hopefully flushing away any poison. ' .
 			'The default is disabled, but if enabled a value of 10 million is suggested.');
 
+$lvl = gettext("level");
 $section->addInput(new Form_Select(
 	'log_verbosity',
 	'Log Level',
 	$pconfig['log_verbosity'],
-	array_combine(array("0", "1", "2", "3", "4", "5"), array("Level 0", "Level 1", "Level 2", "Level 3", "Level 4", "Level 5"))
+	array_combine(array("0", "1", "2", "3", "4", "5"), array($lvl + " 0", $lvl + " 1", $lvl + " 2", $lvl + " 3", $lvl + " 4", $lvl + " 5"))
 ))->setHelp('Select the log verbosity.');
 
 $section->addInput(new Form_Checkbox(
diff --git a/src/usr/local/www/status_graph.php b/src/usr/local/www/status_graph.php
index db1c5ec..440b434 100644
--- a/src/usr/local/www/status_graph.php
+++ b/src/usr/local/www/status_graph.php
@@ -170,8 +170,8 @@ $group->add(new Form_Select(
 	null,
 	$cursort,
 	array (
-		'in'	=> 'Bandwidth In',
-		'out'	=> 'Bandwidth Out'
+		'in'	=> gettext('Bandwidth In'),
+		'out'	=> gettext('Bandwidth Out')
 	)
 ))->setHelp('Sort by');
 
@@ -180,9 +180,9 @@ $group->add(new Form_Select(
 	null,
 	$curfilter,
 	array (
-		'local'	=> 'Local',
-		'remote'=> 'Remote',
-		'all'	=> 'All'
+		'local'	=> gettext('Local'),
+		'remote'=> gettext('Remote'),
+		'all'	=> gettext('All')
 	)
 ))->setHelp('Filter');
 
@@ -191,10 +191,10 @@ $group->add(new Form_Select(
 	null,
 	$curhostipformat,
 	array (
-		''			=> 'IP Address',
-		'hostname'	=> 'Host Name',
-		'descr'		=> 'Description',
-		'fqdn'		=> 'FQDN'
+		''			=> gettext('IP Address'),
+		'hostname'	=> gettext('Host Name'),
+		'descr'		=> gettext('Description'),
+		'fqdn'		=> gettext('FQDN')
 	)
 ))->setHelp('Display');
 
diff --git a/src/usr/local/www/status_logs_common.inc b/src/usr/local/www/status_logs_common.inc
index 1e4a930..99610da 100644
--- a/src/usr/local/www/status_logs_common.inc
+++ b/src/usr/local/www/status_logs_common.inc
@@ -896,9 +896,9 @@ function manage_log_section() {
 			'Where to show rule descriptions',
 			!isset($pconfig['filterdescriptions']) ? '0':$pconfig['filterdescriptions'],
 			array(
-				'0' => 'Dont load descriptions',
-				'1' => 'Display as column',
-				'2' => 'Display as second row'
+				'0' => gettext('Dont load descriptions'),
+				'1' => gettext('Display as column'),
+				'2' => gettext('Display as second row')
 			)
 		))->setHelp('Show the applied rule description below or in the firewall log rows' . '<br />' .
 					'Displaying rule descriptions for all lines in the log might affect performance with large rule sets');
diff --git a/src/usr/local/www/status_logs_settings.php b/src/usr/local/www/status_logs_settings.php
index c11fcad..587b281 100644
--- a/src/usr/local/www/status_logs_settings.php
+++ b/src/usr/local/www/status_logs_settings.php
@@ -320,9 +320,9 @@ $section->addInput(new Form_Select(
 	'Where to show rule descriptions',
 	!isset($pconfig['filterdescriptions']) ? '0':$pconfig['filterdescriptions'],
 	array(
-		'0' => 'Dont load descriptions',
-		'1' => 'Display as column',
-		'2' => 'Display as second row'
+		'0' => gettext('Dont load descriptions'),
+		'1' => gettext('Display as column'),
+		'2' => gettext('Display as second row')
 	)
 ))->setHelp('Show the applied rule description below or in the firewall log rows' . '<br />' .
 			'Displaying rule descriptions for all lines in the log might affect performance with large rule sets');
diff --git a/src/usr/local/www/system.php b/src/usr/local/www/system.php
index a8d16bf..c0c5489 100644
--- a/src/usr/local/www/system.php
+++ b/src/usr/local/www/system.php
@@ -507,7 +507,7 @@ $section->addInput(new Form_Select(
 	'webguifixedmenu',
 	'Top Navigation',
 	$pconfig['webguifixedmenu'],
-	["" => "Scrolls with page", "fixed" => "Fixed (Remains visible at top of page)"]
+	["" => gettext("Scrolls with page"), "fixed" => gettext("Fixed (Remains visible at top of page)")]
 ))->setHelp("The fixed option is intended for large screens only.");
 
 $section->addInput(new Form_Input(
diff --git a/src/usr/local/www/system_advanced_admin.php b/src/usr/local/www/system_advanced_admin.php
index 56367a1..73f981f 100644
--- a/src/usr/local/www/system_advanced_admin.php
+++ b/src/usr/local/www/system_advanced_admin.php
@@ -534,8 +534,8 @@ if (!$g['enableserial_force'] && ($g['platform'] == $g['product_name'] || $g['pl
 		'Primary Console',
 		$pconfig['primaryconsole'],
 		array(
-			'serial' => 'Serial Console',
-			'video' => 'VGA Console',
+			'serial' => gettext('Serial Console'),
+			'video' => gettext('VGA Console'),
 		)
 	))->setHelp('Select the preferred console if multiple consoles are present. '.
 		'The preferred console will show pfSense boot script output. All consoles '.
diff --git a/src/usr/local/www/system_advanced_firewall.php b/src/usr/local/www/system_advanced_firewall.php
index 43af9bc..29b92af 100644
--- a/src/usr/local/www/system_advanced_firewall.php
+++ b/src/usr/local/www/system_advanced_firewall.php
@@ -451,9 +451,9 @@ $section->addInput($input = new Form_Select(
 	$config['system']['optimization'],
 	array(
 		'normal' => 'Normal',
-		'high-latency' => 'High-latency',
-		'aggressive' => 'Aggressive',
-		'conservative' => 'Conservative',
+		'high-latency' => gettext('High-latency'),
+		'aggressive' => gettext('Aggressive'),
+		'conservative' => gettext('Conservative'),
 	)
 ))->setHelp('Select the type of state table optimization to use');
 
@@ -594,9 +594,9 @@ $section->addInput(new Form_Select(
 	'Update Frequency',
 	empty($pconfig['bogonsinterval']) ? 'monthly' : $pconfig['bogonsinterval'],
 	array(
-		'monthly' => 'Monthly',
-		'weekly' => 'Weekly',
-		'daily' => 'Daily',
+		'monthly' => gettext('Monthly'),
+		'weekly' => gettext('Weekly'),
+		'daily' => gettext('Daily'),
 	)
 ))->setHelp('The frequency of updating the lists of IP addresses that are '.
 	'reserved (but not RFC 1918) or not yet assigned by IANA.');
@@ -619,9 +619,9 @@ if (count($config['interfaces']) > 1) {
 		'NAT Reflection mode for port forwards',
 		$value,
 		array(
-			'disable' => 'disabled',
-			'proxy' => 'NAT + proxy',
-			'purenat' => 'Pure NAT',
+			'disable' => gettext('disabled'),
+			'proxy' => gettext('NAT + proxy'),
+			'purenat' => gettext('Pure NAT'),
 		)
 	))->setHelp('</span><ul class="help-block"><li>The pure NAT mode uses a set of NAT rules to direct '.
 		'packets to the target of the port forward. It has better scalability, '.
diff --git a/src/usr/local/www/system_advanced_misc.php b/src/usr/local/www/system_advanced_misc.php
index b3d78a4..7d296b2 100644
--- a/src/usr/local/www/system_advanced_misc.php
+++ b/src/usr/local/www/system_advanced_misc.php
@@ -417,10 +417,10 @@ $section->addInput(new Form_Checkbox(
 	'lower CPU load.');
 
 $modes = array(
-	'hadp' => 'Hiadaptive',
-	'adp' => 'Adaptive',
-	'min' => 'Minimum',
-	'max' => 'Maximum',
+	'hadp' => gettext('Hiadaptive'),
+	'adp' => gettext('Adaptive'),
+	'min' => gettext('Minimum'),
+	'max' => gettext('Maximum'),
 );
 
 $section->addInput(new Form_Select(
diff --git a/src/usr/local/www/system_certmanager.php b/src/usr/local/www/system_certmanager.php
index f8f8841..5a996cd 100644
--- a/src/usr/local/www/system_certmanager.php
+++ b/src/usr/local/www/system_certmanager.php
@@ -808,10 +808,10 @@ foreach ($pconfig['altnames']['item'] as $item) {
 		'Type',
 		$item['type'],
 		array(
-			'DNS' => 'FQDN or Hostname',
-			'IP' => 'IP address',
-			'URI' => 'URI',
-			'email' => 'email address',
+			'DNS' => gettext('FQDN or Hostname'),
+			'IP' => gettext('IP address'),
+			'URI' => gettext('URI'),
+			'email' => gettext('email address'),
 		)
 	))->setHelp(($counter == $numrows) ? 'Type':null);
 
diff --git a/src/usr/local/www/system_gateway_groups_edit.php b/src/usr/local/www/system_gateway_groups_edit.php
index 4b0e1e6..c026615 100644
--- a/src/usr/local/www/system_gateway_groups_edit.php
+++ b/src/usr/local/www/system_gateway_groups_edit.php
@@ -268,17 +268,18 @@ foreach ($a_gateways as $gwname => $gateway) {
 	))->setHelp($row == $numrows ? 'Gateway':null)
 	  ->setReadonly();
 
+	$tr = gettext("Tier");
 	$group->add(new Form_Select(
 		$gwname,
 		'Tier',
 		$selected,
 		array(
 			'0' => 'Never',
-			'1' => 'Tier 1',
-			'2' => 'Tier 2',
-			'3' => 'Tier 3',
-			'4' => 'Tier 4',
-			'5' => 'Tier 5'
+			'1' => $tr . ' 1',
+			'2' => $tr . ' 2',
+			'3' => $tr . ' 3',
+			'4' => $tr . ' 4',
+			'5' => $tr . ' 5'
 		)
 	))->setHelp($row == $numrows ? 'Tier':null)->addClass('row')->addClass($gateway['ipprotocol']);
 
@@ -329,10 +330,10 @@ $section->addInput(new Form_Select(
 	'Trigger Level',
 	$pconfig['trigger'],
 	array(
-		'0' => 'Member down',
-		'1' => 'Packet Loss',
-		'2' => 'High Latency',
-		'3' => 'Packet Loss or High latency'
+		'0' => gettext('Member down'),
+		'1' => gettext('Packet Loss'),
+		'2' => gettext('High Latency'),
+		'3' => gettext('Packet Loss or High latency')
 	)
 ))->setHelp('When to trigger exclusion of a member');
 
diff --git a/src/usr/local/www/vpn_ipsec_mobile.php b/src/usr/local/www/vpn_ipsec_mobile.php
index 03c8aa8..55692c3 100644
--- a/src/usr/local/www/vpn_ipsec_mobile.php
+++ b/src/usr/local/www/vpn_ipsec_mobile.php
@@ -491,8 +491,8 @@ $section->addInput(new Form_Select(
 	'Group Authentication',
 	$pconfig['group_source'],
 	array(
-		'none' => 'none',
-		'system' => 'system',
+		'none' => gettext('none'),
+		'system' => gettext('system'),
 	)
 ))->setHelp('Source');
 
diff --git a/src/usr/local/www/vpn_ipsec_phase1.php b/src/usr/local/www/vpn_ipsec_phase1.php
index c96f1fb..445bd41 100644
--- a/src/usr/local/www/vpn_ipsec_phase1.php
+++ b/src/usr/local/www/vpn_ipsec_phase1.php
@@ -672,7 +672,7 @@ $section->addInput(new Form_Select(
 	'iketype',
 	'Key Exchange version',
 	$pconfig['iketype'],
-	array("ikev1" => "V1", "ikev2" => "V2", "auto" => "Auto")
+	array("ikev1" => "V1", "ikev2" => "V2", "auto" => gettext("Auto"))
 ))->setHelp('Select the Internet Key Exchange protocol version to be used, IKEv1 or IKEv2.');
 
 $section->addInput(new Form_Select(
@@ -720,7 +720,7 @@ $section->addInput(new Form_Select(
 	'mode',
 	'Negotiation mode',
 	$pconfig['mode'],
-	array("main" => "Main", "aggressive" => "Aggressive")
+	array("main" => gettext("Main"), "aggressive" => gettext("Aggressive"))
 ))->setHelp('Aggressive is more flexible, but less secure.');
 
 $group = new Form_Group('My identifier');
@@ -857,7 +857,7 @@ $section->addInput(new Form_Select(
 	'nat_traversal',
 	'NAT Traversal',
 	$pconfig['nat_traversal'],
-	array('on' => 'Auto', 'force' => 'Force')
+	array('on' => gettext('Auto'), 'force' => gettext('Force'))
 ))->setHelp('Set this option to enable the use of NAT-T (i.e. the encapsulation of ESP in UDP packets) if needed, ' .
 			'which can help with clients that are behind restrictive firewalls.');
 
@@ -865,7 +865,7 @@ $section->addInput(new Form_Select(
 	'mobike',
 	'MOBIKE',
 	$pconfig['mobike'],
-	array('on' => 'Enable', 'off' => 'Disable')
+	array('on' => gettext('Enable'), 'off' => gettext('Disable'))
 ))->setHelp('Set this option to control the use of MOBIKE');
 
 $section->addInput(new Form_Checkbox(
diff --git a/src/usr/local/www/vpn_ipsec_phase2.php b/src/usr/local/www/vpn_ipsec_phase2.php
index e00be54..d861384 100644
--- a/src/usr/local/www/vpn_ipsec_phase2.php
+++ b/src/usr/local/www/vpn_ipsec_phase2.php
@@ -556,7 +556,7 @@ $group->add(new Form_Select(
 	'localid_type',
 	null,
 	$pconfig['localid_type'],
-	['address' => 'Address', 'network' => 'Network'] + $subnetarray
+	['address' => gettext('Address'), 'network' => gettext('Network')] + $subnetarray
 ))->setHelp('Type');
 
 $group->add(new Form_IpAddress(
@@ -576,7 +576,7 @@ foreach ($subnetarray as $ifname => $ifdescr) {
 }
 
 // Tack none, address & network on the beginning
-$subnetarray = array('none' => gettext('None'), 'address' => 'Address', 'network' => 'Network') + $subnetarray;
+$subnetarray = array('none' => gettext('None'), 'address' => gettext('Address'), 'network' => gettext('Network')) + $subnetarray;
 
 $group->add(new Form_Select(
 	'natlocalid_type',
@@ -602,7 +602,7 @@ if (!isset($pconfig['mobile'])) {
 		'remoteid_type',
 		null,
 		$pconfig['remoteid_type'],
-		array('address' => 'Address', 'network' => 'Network')
+		array('address' => gettext('Address'), 'network' => gettext('Network'))
 	))->setHelp('Type');
 
 	$group->add(new Form_IpAddress(
@@ -660,7 +660,7 @@ foreach ($p2_ealgos as $algo => $algodata) {
 			'keylen_' . $algo,
 			null,
 			$pconfig["keylen_".$algo],
-			['auto' => 'Auto'] + $list
+			['auto' => gettext('Auto')] + $list
 		));
 	}
 
diff --git a/src/usr/local/www/vpn_openvpn_client.php b/src/usr/local/www/vpn_openvpn_client.php
index 8d41ddb..4f7cb9e 100644
--- a/src/usr/local/www/vpn_openvpn_client.php
+++ b/src/usr/local/www/vpn_openvpn_client.php
@@ -512,7 +512,7 @@ if ($act=="new" || $act=="edit"):
 		'proxy_authtype',
 		'Proxy Auth. - Extra options',
 		$pconfig['proxy_authtype'],
-		array('none' => 'none', 'basic' => 'basic', 'ntlm' => 'ntlm')
+		array('none' => gettext('none'), 'basic' => gettext('basic'), 'ntlm' => gettext('ntlm'))
 		));
 
 	$section->addInput(new Form_Input(
diff --git a/src/usr/local/www/vpn_openvpn_server.php b/src/usr/local/www/vpn_openvpn_server.php
index db033ff..403a88b 100644
--- a/src/usr/local/www/vpn_openvpn_server.php
+++ b/src/usr/local/www/vpn_openvpn_server.php
@@ -824,7 +824,7 @@ if ($act=="new" || $act=="edit"):
 		'cert_depth',
 		'Certificate Depth',
 		$pconfig['cert_depth'],
-		["" => "Do Not Check"] + $openvpn_cert_depths
+		["" => gettext("Do Not Check")] + $openvpn_cert_depths
 		))->setHelp('When a certificate-based client logs in, do not accept certificates below this depth. ' .
 					'Useful for denying certificates made with intermediate CAs generated from the same CA as the server.');