Mercurial > hg > nginx-site

annotate xml/cn/docs/http/configuring_https_servers.xml @ 593:130fad6dc1b4

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Replaced the uses of "url" element with "literal".
author Ruslan Ermilov <ru@nginx.com>
date Thu, 19 Jul 2012 05:17:45 +0000
parents 149f54c158f0
children 9934338f83af
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
1 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
2
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
3 <article name="配置HTTPS服务器"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
4 link="/cn/docs/http/configuring_https_servers.html"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
5 lang="cn"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
6 author="Igor Sysoev"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7 editor="Brian Mercer">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 <section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
12 配置HTTPS主机，必须在server配置块中打开SSL协议，还需要指定服务器端证书和密钥文件的位置：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
13
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16 listen 443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 server_name www.nginx.com;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 ssl_certificate www.nginx.com.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20 ssl_certificate_key www.nginx.com.key;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
21 ssl_protocols SSLv3 TLSv1;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
22 ssl_ciphers HIGH:!aNULL:!MD5;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
24 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
27 服务器证书是公开的，会被传送到所有连接到服务器的客户端。而私钥不是公开的，需要存放在访问受限的文件中，当然，nginx主进程必须有读取密钥的权限。还有一种情况，私钥和证书存放在同一个文件中：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
28
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
29
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
30 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31 ssl_certificate www.nginx.com.cert;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 ssl_certificate_key www.nginx.com.cert;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36 这种情况下，证书文件同样得设置访问限制。当然，虽然证书和密钥存放在同一个文件，只有证书会发送给客户端，密钥不会发送。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41 <literal>ssl_protocols</literal>和<literal>ssl_ciphers</literal>指令可以用来强制用户连接只能引入SSL/TLS那些强壮的协议版本和强大的加密算法。从1.0.5版本开始，nginx默认使用<literal>ssl_protocols SSLv3 TLSv1</literal>和<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>，所以只有在之前的版本，明确地配置它们才是有意义的。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
42 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 CBC模式的加密算法容易受到一些攻击，尤其是BEAST攻击（参见<link url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389">CVE-2011-3389</link>）。可以通过下面配置调整为优先使用RC4-SHA加密算法：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48 ssl_ciphers RC4:HIGH:!aNULL:!MD5;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49 ssl_prefer_server_ciphers on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
50 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
54
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56 <section id="optimization" name="HTTPS服务器优化">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59 SSL操作需要消耗CPU资源，所以在多处理器的系统，需要启动多个工作进程，而且数量需要不少于可用CPU的个数。最消耗CPU资源的SSL操作是SSL握手，有两种方法可以将每个客户端的握手操作数量降到最低：第一种是保持客户端长连接，在一个SSL连接发送多个请求，第二种是在并发的连接或者后续的连接中重用SSL会话参数，这样可以避免SSL握手的操作。会话缓存用于保存SSL会话，这些缓存在工作进程间共享，可以使用<literal>ssl_session_cache</literal>指令进行配置。1M缓存可以存放大约4000个会话。默认的缓存超时是5分钟，可以使用<literal>ssl_session_timeout</literal>来修改。下面是一个针对4核系统的配置优化的例子，使用10M的共享会话缓存：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62 <b>worker_processes 4</b>;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
63
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
64 http {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
65 <b>ssl_session_cache shared:SSL:10m</b>;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 <b>ssl_session_timeout 10m</b>;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69 listen 443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
70 server_name www.nginx.com;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
71 <b>keepalive_timeout 70</b>;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
72
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74 ssl_certificate www.nginx.com.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 ssl_certificate_key www.nginx.com.key;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76 ssl_protocols SSLv3 TLSv1;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 ssl_ciphers HIGH:!aNULL:!MD5;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85 <section id="chains" name="SSL证书链">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88 有些浏览器不接受那些众所周知的证书认证机构签署的证书，而另外一些浏览器却接受它们。这是由于证书签发使用了一些中间认证机构，这些中间机构被众所周知的证书认证机构授权代为签发证书，但是它们自己却不被广泛认知，所以有些客户端不予识别。针对这种情况，证书认证机构提供一个证书链的包裹，用来声明众所周知的认证机构和自己的关系，需要将这个证书链包裹与服务器证书合并成一个文件。在这个文件里，服务器证书需要出现在认证方证书链的前面：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 $ cat www.nginx.com.crt bundle.crt > www.nginx.com.chained.crt
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 这个文件需要使用<literal>ssl_certificate</literal>指令来引用：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 listen 443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99 server_name www.nginx.com;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101 ssl_certificate www.nginx.com.chained.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
102 ssl_certificate_key www.nginx.com.key;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
103 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
105 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107 如果服务器证书和认证方证书链合并时顺序弄错了，nginx就不能正常启动，而且会显示下面的错误信息：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
109 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110 SSL_CTX_use_PrivateKey_file(" ... /www.nginx.com.key") failed
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111 (SSL: error:0B080074:x509 certificate routines:
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
112 X509_check_private_key:key values mismatch)
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
113 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
114
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
115 因为nginx首先需要用私钥去解密服务器证书，而遇到的却是认证方的证书。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
116 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119 浏览器通常会将那些被受信的认证机构认证的中间认证机构保存下来，那么这些浏览器以后在遇到使用这些中间认证机构但不包含证书链的情况时，因为已经保存了这些中间认证机构的信息，所以不会报错。可以使用<command>openssl</command>命令行工具来确认服务器发送了完整的证书链：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121 $ openssl s_client -connect www.godaddy.com:443
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123 Certificate chain
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126 /OU=MIS Department/<b>CN=www.GoDaddy.com</b>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
128 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129 /OU=http://certificates.godaddy.com/repository
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130 /CN=Go Daddy Secure Certification Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131 /serialNumber=07969287
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 /OU=http://certificates.godaddy.com/repository
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 /CN=Go Daddy Secure Certification Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 /serialNumber=07969287
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 i:/C=US/O=The Go Daddy Group, Inc.
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 /OU=Go Daddy Class 2 Certification Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138 2 s:/C=US/O=The Go Daddy Group, Inc.
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 /OU=Go Daddy Class 2 Certification Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 /OU=ValiCert Class 2 Policy Validation Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142 /CN=http://www.valicert.com//emailAddress=info@valicert.com
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
143 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
144 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146 在这个例子中，www.GoDaddy.com的服务器证书（#0）的受签者（“s”）是被签发机构（“i”）签名的，而这个签发机构又是证书（#1）的受签者，接着证书（#1）的签发机构又是证书（#2）的受签者，最后证书（#2）是被众所周知的签发机构ValiCert, Inc签发。ValiCert, Inc的证书内嵌在浏览器中，被浏览器自动识别。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
150 如果没有加入认证方证书链，那只能看到服务器证书（#0）。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
152
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 <section id="single_http_https_server" name="统一的HTTP/HTTPS主机">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159 从开始就将HTTP主机和HTTPS主机分开配置是很好一个很好的实践。虽然它们的功能现在看来是一样的，但是这个情况将来可能会有很大变化，那么合在一起的配置就有问题了。如果HTTP和HTTPS主机配置相同，而又不考虑将来重写配置的话，可以用一个主机配置统一处理HTTP和HTTPS请求。方法是删除<literal>ssl on</literal>的配置项，并在*:443端口添加参数<literal>ssl</literal>：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162 listen 80;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 listen 443 ssl;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
164 server_name www.nginx.com;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 ssl_certificate www.nginx.com.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166 ssl_certificate_key www.nginx.com.key;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
167 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
168 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
169 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
170
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
171 <note>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172 在0.8.21版本以前，只有添加了<literal>default</literal>参数的监听端口才能添加<literal>ssl</literal>参数：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
173 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174 listen 443 default ssl;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176 </note>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
177 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
178
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
179 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
180
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
181
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
182 <section id="name_based_https_servers" name="基于名字的HTTPS主机">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
183
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
184 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
185 在同一个IP上配置多个HTTPS主机，会出现问题：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
186
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
187 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
188 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
189 listen 443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
190 server_name www.nginx.com;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
191 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
192 ssl_certificate www.nginx.com.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
193 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
194 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
195
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
196 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
197 listen 443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198 server_name www.nginx.org;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
199 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200 ssl_certificate www.nginx.org.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
201 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
202 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
203 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
204
593
130fad6dc1b4 Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents: 558
diff changeset
205 使用上面的配置，不论浏览器请求哪个主机，都只会收到默认主机的证书，比方说就是<literal>www.nginx.com</literal>。这是由SSL协议本身的行为引起的。因为SSL规定在建立SSL连接以后，才能发送HTTP请求，所以nginx建立SSL连接时不知道所请求主机的名字，因此，它只会返回默认主机的证书。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
208 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209 最古老的也是最稳定的解决方法就是每个HTTPS主机使用不同的IP地址：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
210
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213 listen 192.168.1.1:443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214 server_name www.nginx.com;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216 ssl_certificate www.nginx.com.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
217 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
218 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
219
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
220 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
221 listen 192.168.1.2:443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
222 server_name www.nginx.org;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
223 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
224 ssl_certificate www.nginx.org.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
225 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
226 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
227 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
228 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
229
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
230 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
231
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
232
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
233 <section id="certificate_with_several_names"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
234 name="带有多个主机名的SSL证书">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
235
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
236 <para>
593
130fad6dc1b4 Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents: 558
diff changeset
237 也有其他一些方法可以实现多个HTTPS主机共享一个IP地址，但都有不足。其中一种方法是使用在“SubjectAltName”字段中存放多个名字的证书，比如<literal>www.nginx.com</literal>和<literal>www.nginx.org</literal>。这种方法的限制是“SubjectAltName”字段的长度。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
238 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
239
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
240 <para>
593
130fad6dc1b4 Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents: 558
diff changeset
241 另一种方式是使用主机名中含有通配符的证书，比如<literal>*.nginx.org</literal>。这个证书匹配<literal>www.nginx.org</literal>，但是不匹配<literal>nginx.org</literal>和<literal>www.sub.nginx.org</literal>。这两种方法可以结合在一起——使用在“SubjectAltName”字段中存放的多个名字的证书，这些名字既可以是确切的名字，也可以是通配符，比如<literal>nginx.org</literal>和<literal>*.nginx.org</literal>。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
242 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
243
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
244 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
245 最好将带有多个名字的证书和它的密钥文件配置在http配置块中，这样可以只保存一份内容拷贝，所有主机的配置都从中继承：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
246
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
247 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
248 ssl_certificate common.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
249 ssl_certificate_key common.key;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
250
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252 listen 443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253 server_name www.nginx.com;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
257
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
258 server {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
259 listen 443;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260 server_name www.nginx.org;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261 ssl on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
264 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
265 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
266
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
267 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
268
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
269
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270 <section id="sni" name="主机名指示">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
272 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
273 在一个IP上运行多个HTTPS主机的更通用的方案是<link url="http://en.wikipedia.org/wiki/Server_Name_Indication">TLSv1.1 主机名指示扩展</link>（SNI，RFC3546），它允许浏览器和服务器进行SSL握手时，将请求的主机名传递服务器，因此服务器可以知道使用哪一个证书来服务这个连接。但SNI只得到有限的浏览器的支持。下面列举支持SNI的浏览器最低版本和平台信息：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
274 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276 <list type="bullet">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
279 Opera 8.0；
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
280 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
281
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
283 MSIE 7.0（仅在Windows Vista操作系统及后续操作系统）；
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
284 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
285
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
286 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
287 Firefox 2.0和使用Mozilla平台1.8.1版本的其他浏览器；
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
288 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
289
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
290 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
291 Safari 3.2.1（Windows版需要最低Vista操作系统）；
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
292 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
293
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
294 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
295 Chrome（Windows版需要最低Vista操作系统）。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
297
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298 </list>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
299
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
300 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
301 为了在nginx中使用SNI，那么无论是在编译nginx时使用的OpenSSL类库，还是在运行nginx时使用的OpenSSL运行库，都必须支持SNI。从0.9.8f版本开始，OpenSSL通过<nobr>&ldquo;--enable-tlsext&rdquo;</nobr>配置选项加入SNI支持，从0.9.8j版本开始，此选项成为默认选项。当nginx被编译成支持SNI时，在使用“-V”选项运行时会显示如下信息：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
302
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304 $ nginx -V
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
305 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
306 TLS SNI support enabled
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
307 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
308 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
309
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
310 但是，当开启SNI支持的nginx被动态链接到不支持SNI的OpenSSL库上时，nginx会显示如下警告：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
311
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
312 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
313 nginx was built with SNI support, however, now it is linked
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
314 dynamically to an OpenSSL library which has no tlsext support,
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
315 therefore SNI is not available
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
316 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
317 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
318
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
319 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
320
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
321
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
322 <section id="compatibility" name="兼容性">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
323
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
324 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
325 <list type="bullet">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
326
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
327 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
328 从0.8.21和0.7.62版本开始，使用“-V”选项运行nginx时，将显示SNI支持状态信息。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
329 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
330
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
331 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
332 从0.7.14版本开始，<literal>listen</literal>指令支持<literal>ssl</literal>参数。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
333 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
334
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336 从0.5.32版本开始，支持SNI。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
337 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
338
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
339 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
340 从0.5.6版本开始，支持SSL会话缓存，并可在工作进程间共享。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
341 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
342
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
343 </list>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
344 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
345
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
346 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
347 <list type="bullet">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
348
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
349 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
350 0.7.65、0.8.19及以后版本，默认SSL协议是SSLv3和TLSv1。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
351 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
352
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
353 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
354 0.7.64、0.8.18及以前版本，默认SSL协议是SSLv2、SSLv3和TLSv1。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
355 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
356
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
357 </list>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
358 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
359
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
360 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
361 <list type="bullet">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
362
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
363 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
364 1.0.5及以后版本，默认SSL密码算法是<literal>HIGH:!aNULL:!MD5</literal>。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
365 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
367 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368 0.7.65、0.8.20及以后版本，默认SSL密码算法是<literal>HIGH:!ADH:!MD5</literal>。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
371 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372 0.8.19版本，默认SSL密码算法是<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376 0.7.64、0.8.18及以前版本，默认SSL密码算法是<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
379 </list>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
386 </article>