datapath-windows: Rename switch context's nameHashArray and vport's nameLink login...

[cascardo/ovs.git] / INSTALL.SSL

diff --git a/INSTALL.SSL b/INSTALL.SSL
index 4ba0925..a6931d2 100644 (file)
--- a/INSTALL.SSL
+++ b/INSTALL.SSL
@@ -2,15 +2,13 @@
                    ================================
 
 If you plan to configure Open vSwitch to connect across the network to
                    ================================
 
 If you plan to configure Open vSwitch to connect across the network to

-an OpenFlow controller, then we recommend that you configure and
-enable SSL support in Open vSwitch.  SSL support ensures integrity and
-confidentiality of the OpenFlow connections, increasing network
-security.
+an OpenFlow controller, then we recommend that you build Open vSwitch
+with OpenSSL.  SSL support ensures integrity and confidentiality of
+the OpenFlow connections, increasing network security.

 
 This file explains how to configure an Open vSwitch to connect to an
 
 This file explains how to configure an Open vSwitch to connect to an

-OpenFlow controller over SSL.  Refer to INSTALL.Linux for instructions
-on building Open vSwitch with SSL support.  (In particular, you must
-pass --enable-ssl to the "configure" script to use SSL.)
+OpenFlow controller over SSL.  Refer to INSTALL for instructions on
+building Open vSwitch with SSL support.

 
 Open vSwitch uses TLS version 1.0 or later (TLSv1), as specified by
 RFC 2246, which is very similar to SSL version 3.0.  TLSv1 was
 
 Open vSwitch uses TLS version 1.0 or later (TLSv1), as specified by
 RFC 2246, which is very similar to SSL version 3.0.  TLSv1 was


@@ -117,10 +115,10 @@ that contains the PKI structure:
       % ovs-pki req+sign ctl controller
 
 ctl-privkey.pem and ctl-cert.pem would need to be copied to the
       % ovs-pki req+sign ctl controller
 
 ctl-privkey.pem and ctl-cert.pem would need to be copied to the

-controller for its use at runtime.  If you were to use ovs-controller,
-the simple OpenFlow controller included with Open vSwitch, then the
---private-key and --certificate options, respectively, would point to
-these files.
+controller for its use at runtime.  If, for testing purposes, you were
+to use ovs-testcontroller, the simple OpenFlow controller included
+with Open vSwitch, then the --private-key and --certificate options,
+respectively, would point to these files.

 
 It is very important to make sure that no stray copies of
 ctl-privkey.pem are created, because they could be used to impersonate
 
 It is very important to make sure that no stray copies of
 ctl-privkey.pem are created, because they could be used to impersonate


@@ -290,7 +288,7 @@ cacert.pem:
 Once you have these files, configure ovs-vswitchd to use them using
 the ovs-vsctl "set-ssl" command, e.g.:
 
 Once you have these files, configure ovs-vswitchd to use them using
 the ovs-vsctl "set-ssl" command, e.g.:
 

-    ovs-vsctl set-ssl /etc/vswitch/sc-privkey.pem /etc/vswitch/sc-cert.pem /etc/vswitch/cacert.pem
+    ovs-vsctl set-ssl /etc/openvswitch/sc-privkey.pem /etc/openvswitch/sc-cert.pem /etc/openvswitch/cacert.pem

 
 Substitute the correct file names, of course, if they differ from the
 ones used above.  You should use absolute file names (ones that begin
 
 Substitute the correct file names, of course, if they differ from the
 ones used above.  You should use absolute file names (ones that begin


@@ -301,17 +299,13 @@ If you are using self-signed certificates (see "SSL Concepts for
 OpenFlow") and you did not copy controllerca/cacert.pem from the PKI
 machine to the Open vSwitch, then add the --bootstrap option, e.g.:
 
 OpenFlow") and you did not copy controllerca/cacert.pem from the PKI
 machine to the Open vSwitch, then add the --bootstrap option, e.g.:
 

-    ovs-vsctl -- --bootstrap set-ssl /etc/vswitch/sc-privkey.pem /etc/vswitch/sc-cert.pem /etc/vswitch/cacert.pem
+    ovs-vsctl -- --bootstrap set-ssl /etc/openvswitch/sc-privkey.pem /etc/openvswitch/sc-cert.pem /etc/openvswitch/cacert.pem

 
 After you have added all of these configuration keys, you may specify
 "ssl:" connection methods elsewhere in the configuration database.
 "tcp:" connection methods are still allowed even after SSL has been
 configured, so for security you should use only "ssl:" connections.
 
 
 After you have added all of these configuration keys, you may specify
 "ssl:" connection methods elsewhere in the configuration database.
 "tcp:" connection methods are still allowed even after SSL has been
 configured, so for security you should use only "ssl:" connections.
 

-Unlike most Open vSwitch settings, the SSL settings are read only
-once, at ovs-vswitchd startup time.  For changes to take effect,
-ovs-vswitchd must be killed and restarted.
-

 Reporting Bugs
 --------------
 
 Reporting Bugs
 --------------