1 files changed, 25 insertions, 11 deletions

diff --git a/bin/OpenSimDefaults.ini b/bin/OpenSimDefaults.ini
index 3f8864e..a8566e2 100644
--- a/bin/OpenSimDefaults.ini
+++ b/bin/OpenSimDefaults.ini
@@ -401,7 +401,18 @@
     ; routing and land at the landmark coordinates when set to true
     ; default is false
     ; TelehubAllowLandmark = false
-   
+
+    ; #
+    ; # SSL certificates validation options
+    ; #
+    
+    ; SSL certificate validation options
+    ; you can allow selfsigned certificates or no official CA with next option set to true
+    ; NoVerifyCertChain = true
+    ; you can also bypass the hostname or domain verification
+    ; NoVerifyCertHostname = true
+    ; having both options true does provide encryption but with low security
+    ; set both true if you don't care to use SSL, they are needed to contact regions or grids that do use it.
     
 [Map]
     ; Map tile options.  
@@ -561,16 +572,18 @@
     http_listener_port = 9000
     console_port = 0
 
-    ; ssl config: Experimental!  The auto https config only really works definately on windows XP now
-    ; you need a Cert Request/Signed pair installed in the MY store with the CN specified below
-    ; you can use https on other platforms, but you'll need to configure the httpapi yourself for now
-    http_listener_ssl = false ; Also create a SSL server
-    http_listener_cn = "localhost" ; Use the cert with the common name
+    ; ssl config: Experimental!
+    http_listener_ssl = false ; if set to true main server is replaced by a ssl one
     http_listener_sslport = 9001 ; Use this port for SSL connections
-    http_listener_ssl_cert = "" ; Currently unused, but will be used for OSHttpServer
-
-    ; HTTPS for "Out of band" management applications such as the remote 
-    ; admin module
+        ; currently if using ssl, regions ExternalHostName must the the same and equal to http_listener_cn
+        ; this will change is future
+    http_listener_cn = "myRegionsExternalHostName"
+        ; if the cert doesnt have a oficial CA or is selfsigned viewers option NoVerifySSLCert need to be set true
+    http_listener_cert_path = "mycert.p12" ; path for the cert file that is valid for the ExternalHostName
+        http_listener_cert_pass = "mycertpass" ; the cert passwork
+
+    ; addicional HTTPS for "Out of band" management applications such as the remote 
+    ; admin module or scripts
     ;
     ; Create https_listener = "True" will create a listener on the port
     ; specified. Provide the path to your server certificate along with it's
@@ -578,7 +591,7 @@
     ; https_listener = False
     ; Set our listener to this port
     ; https_port = 0
-    ; Path to X509 certificate
+    ; Path to X509 certificate, can be the same as main or another
     ; cert_path = "path/to/cert.p12"
     ; Password for cert
     ; cert_pass = "password"
@@ -590,6 +603,7 @@
     ; HttpBodyMaxLenMAX=16384
 
     ; Hostname to use in llRequestURL/llRequestSecureURL
+        ; must be a valid hostname for the ssl cert.
     ; if not defined - default machine name is being used
     ; (on Windows this mean NETBIOS name - useably only inside local network)
     ; ExternalHostNameForLSL=127.0.0.1