diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml index fbfcc9f0fedd..e302324bf9ad 100644 --- a/lib/ssl/doc/src/ssl.xml +++ b/lib/ssl/doc/src/ssl.xml @@ -1307,9 +1307,15 @@ fun(srp, Username :: binary(), UserState :: term()) -> extension in its certificate request message that will be sent if the option verify is set to verify_peer. Defaults to true.

-

A reason to exclude the extension would be if the server wants to communicate with clients +

If set to false for older TLS versions its corresponding certificate authorities + definition in its certificate request will be set to the empty list instead of + including the appropriate certificate authorities. This has the same affect + as excluding the TLS-1.3 extension. +

+ +

A reason to exclude the certificate authorities would be if the server wants to communicate with clients incapable of sending complete certificate chains that adhere to the - extension, but the server still has the capability to recreate a chain that it can verify.

+ certificate authorities, but the server still has the capability to recreate a chain that it can verify.