DOC: crt: advise to move away from cert bundle
especially when starting to use `new ssl cert` runtime API, it might
become a bit confusing for users to mix bundle and single cert,
especially when it comes to use the commit command:
e.g.:
- start the process with `crt` loading a bundle
- use `set ssl cert my_cert.pem.ecdsa`: API detects it as a replacement
of a bundle.
- `commit` has to be done on the bundle: `commit ssl cert my_cert.pem`
however:
- add a new cert: `new ssl cert my_cert.pem.rsa`: added as a single
certificate
- `commit` has to be done on the certificate: `commit ssl cert
my_cert.pem.rsa`
this should resolve github issue #872
this should probably be backported in >= v2.2 in order to encourage
people to move away from bundle certificates loading.
Signed-off-by: William Dauchy <w.dauchy@criteo.com>
diff --git a/doc/management.txt b/doc/management.txt
index adbad95..42e8ddb 100644
--- a/doc/management.txt
+++ b/doc/management.txt
@@ -1725,6 +1725,10 @@
Create a new empty SSL certificate store to be filled with a certificate and
added to a directory or a crt-list. This command should be used in
combination with "set ssl cert" and "add ssl crt-list".
+ Note that bundle certificates are not supported; it is recommended to use
+ `ssl-load-extra-file none` in global config to avoid loading certificates as
+ bundle and then mixing with single certificates in the runtime API. This will
+ avoid confusion, especailly when it comes to the `commit` command.
prompt
Toggle the prompt at the beginning of the line and enter or leave interactive