doc: improve ssl_ecdh_curve descriptions

Patch by Marko Kreen

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index d9e5985a16a3ad9757f1bcacb4645396e28d2471..4a666d0d2d960bce91f56b6bbe7a6b21ddf74d9f 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1020,13 +1020,23 @@ include 'filename'
       
       
        
-        Specifies the name of the curve to use in ECDH key exchanges.  The
-        default is prime256p1.
+        Specifies the name of the curve to use in ECDH key exchange.
+        It needs to be supported by all clients that connect.
+        It does not need to be same curve as used by server's
+        Elliptic Curve key.  The default is prime256v1.  
        
 
        
-        The list of available curves can be shown with the command
-        openssl ecparam -list_curves.
+        OpenSSL names for most common curves:
+        prime256v1 (NIST P-256),
+        secp384r1 (NIST P-384),
+        secp521r1 (NIST P-521).
+       
+
+       
+        The full list of available curves can be shown with the command
+        openssl ecparam -list_curves.  Not all of them
+        are usable in TLS though.
        
       
      

diff --git a/doc/src/sgml/release-9.4.sgml b/doc/src/sgml/release-9.4.sgml
index 24862fef3810ff26d9f94f9c4993896e05752560..ae059f88183d877860b63df1e3effb24ad6ea073 100644 (file)
--- a/doc/src/sgml/release-9.4.sgml
+++ b/doc/src/sgml/release-9.4.sgml
@@ -616,17 +616,18 @@
        
 
        
-        Such keys are faster and have improved security over previous
-        options. The new configuration
-        parameter ssl_ecdh_curve
-        controls which curve is used.
+        This allows use of Elliptic Curve keys for server authentication.
+        Such keys are faster and have improved security over RSA keys.
+        The new configuration parameter
+        ssl_ecdh_curve
+        controls which curve is used for ECDH.
        
       
 
       
        
         Improve the default 
-        linkend="guc-ssl-ciphers">ssl_ciphers ciphers
+        linkend="guc-ssl-ciphers">ssl_ciphers value
         (Marko Kreen)